cobaltstrike | ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
Size 5.9MB
Sample240601-nnvd9scb28
SHA256 ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20
MD5 5bd8957839cfd9b8e59ec42284640d20
SHA1 9e96570c62f442ab61f02ae77c4643bba2cd3ae2
SHA512 ee70bf8769d7e5dca1581faaea5a8b6dae8af2310d23b4bc072494dc1b819145dee72a991f1f2eea74b4cbcaf90f4f96dc3e3c2ac0985a2dc5917a6c31fc7cdb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a00000002346a-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023473-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023472-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023474-22.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002346f-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023475-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023476-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023477-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023479-64.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347c-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023482-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023485-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023484-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023483-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023481-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023480-94.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347f-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347e-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347d-79.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347b-68.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347a-58.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1032-0-0x00007FF635260000-0x00007FF6355B4000-memory.dmp	xmrig
behavioral2/files/0x000a00000002346a-4.dat	xmrig
behavioral2/files/0x0007000000023473-10.dat	xmrig
behavioral2/files/0x0007000000023472-9.dat	xmrig
behavioral2/memory/4488-17-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp	xmrig
behavioral2/memory/4172-18-0x00007FF624D40000-0x00007FF625094000-memory.dmp	xmrig
behavioral2/memory/336-7-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023474-22.dat	xmrig
behavioral2/memory/4500-26-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	xmrig
behavioral2/files/0x000a00000002346f-28.dat	xmrig
behavioral2/files/0x0007000000023475-34.dat	xmrig
behavioral2/memory/3036-33-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	xmrig
behavioral2/memory/4656-39-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	xmrig
behavioral2/files/0x0007000000023476-42.dat	xmrig
behavioral2/files/0x0007000000023477-46.dat	xmrig
behavioral2/memory/5084-54-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	xmrig
behavioral2/memory/1020-57-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	xmrig
behavioral2/memory/5064-59-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023479-64.dat	xmrig
behavioral2/files/0x000700000002347c-74.dat	xmrig
behavioral2/files/0x0007000000023482-104.dat	xmrig
behavioral2/files/0x0007000000023485-115.dat	xmrig
behavioral2/files/0x0007000000023484-112.dat	xmrig
behavioral2/files/0x0007000000023483-109.dat	xmrig
behavioral2/files/0x0007000000023481-99.dat	xmrig
behavioral2/files/0x0007000000023480-94.dat	xmrig
behavioral2/files/0x000700000002347f-86.dat	xmrig
behavioral2/files/0x000700000002347e-84.dat	xmrig
behavioral2/files/0x000700000002347d-79.dat	xmrig
behavioral2/files/0x000700000002347b-68.dat	xmrig
behavioral2/files/0x000700000002347a-58.dat	xmrig
behavioral2/memory/4992-55-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	xmrig
behavioral2/memory/1032-117-0x00007FF635260000-0x00007FF6355B4000-memory.dmp	xmrig
behavioral2/memory/4916-120-0x00007FF6778E0000-0x00007FF677C34000-memory.dmp	xmrig
behavioral2/memory/4380-119-0x00007FF7552C0000-0x00007FF755614000-memory.dmp	xmrig
behavioral2/memory/4624-122-0x00007FF79A750000-0x00007FF79AAA4000-memory.dmp	xmrig
behavioral2/memory/4864-123-0x00007FF703950000-0x00007FF703CA4000-memory.dmp	xmrig
behavioral2/memory/4872-124-0x00007FF607C60000-0x00007FF607FB4000-memory.dmp	xmrig
behavioral2/memory/4984-121-0x00007FF6032F0000-0x00007FF603644000-memory.dmp	xmrig
behavioral2/memory/3860-118-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp	xmrig
behavioral2/memory/396-125-0x00007FF67F650000-0x00007FF67F9A4000-memory.dmp	xmrig
behavioral2/memory/2312-126-0x00007FF6673F0000-0x00007FF667744000-memory.dmp	xmrig
behavioral2/memory/1388-127-0x00007FF624F50000-0x00007FF6252A4000-memory.dmp	xmrig
behavioral2/memory/5012-128-0x00007FF77CA60000-0x00007FF77CDB4000-memory.dmp	xmrig
behavioral2/memory/336-129-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	xmrig
behavioral2/memory/4172-130-0x00007FF624D40000-0x00007FF625094000-memory.dmp	xmrig
behavioral2/memory/4500-131-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	xmrig
behavioral2/memory/3036-132-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	xmrig
behavioral2/memory/4656-133-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	xmrig
behavioral2/memory/5084-134-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	xmrig
behavioral2/memory/4992-135-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	xmrig
behavioral2/memory/5064-136-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	xmrig
behavioral2/memory/336-137-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	xmrig
behavioral2/memory/4488-138-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp	xmrig
behavioral2/memory/4172-139-0x00007FF624D40000-0x00007FF625094000-memory.dmp	xmrig
behavioral2/memory/4500-140-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	xmrig
behavioral2/memory/3036-141-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	xmrig
behavioral2/memory/4656-142-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	xmrig
behavioral2/memory/5084-143-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	xmrig
behavioral2/memory/1020-144-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	xmrig
behavioral2/memory/4992-145-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	xmrig
behavioral2/memory/5064-146-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	xmrig
behavioral2/memory/3860-148-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp	xmrig
behavioral2/memory/4380-147-0x00007FF7552C0000-0x00007FF755614000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
336	MzEgahp.exe
4488	mVKNEup.exe
4172	iBpitNG.exe
4500	GpAQsob.exe
3036	zVKYlqZ.exe
4656	MTfBNmC.exe
5084	kHrKwvw.exe
1020	VzefQtl.exe
4992	Elnhkiu.exe
5064	doATtpU.exe
3860	yOuvAHW.exe
4380	vNKhfPq.exe
4916	TVCrLEM.exe
4984	SFADwmX.exe
4624	oudOCAN.exe
4864	HDnKsLs.exe
4872	KLnuRbz.exe
396	vOLEbOZ.exe
2312	uYBJbRg.exe
1388	sRorSFq.exe
5012	cRGZRfL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1032-0-0x00007FF635260000-0x00007FF6355B4000-memory.dmp	upx
behavioral2/files/0x000a00000002346a-4.dat	upx
behavioral2/files/0x0007000000023473-10.dat	upx
behavioral2/files/0x0007000000023472-9.dat	upx
behavioral2/memory/4488-17-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp	upx
behavioral2/memory/4172-18-0x00007FF624D40000-0x00007FF625094000-memory.dmp	upx
behavioral2/memory/336-7-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	upx
behavioral2/files/0x0007000000023474-22.dat	upx
behavioral2/memory/4500-26-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	upx
behavioral2/files/0x000a00000002346f-28.dat	upx
behavioral2/files/0x0007000000023475-34.dat	upx
behavioral2/memory/3036-33-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	upx
behavioral2/memory/4656-39-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	upx
behavioral2/files/0x0007000000023476-42.dat	upx
behavioral2/files/0x0007000000023477-46.dat	upx
behavioral2/memory/5084-54-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	upx
behavioral2/memory/1020-57-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	upx
behavioral2/memory/5064-59-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	upx
behavioral2/files/0x0007000000023479-64.dat	upx
behavioral2/files/0x000700000002347c-74.dat	upx
behavioral2/files/0x0007000000023482-104.dat	upx
behavioral2/files/0x0007000000023485-115.dat	upx
behavioral2/files/0x0007000000023484-112.dat	upx
behavioral2/files/0x0007000000023483-109.dat	upx
behavioral2/files/0x0007000000023481-99.dat	upx
behavioral2/files/0x0007000000023480-94.dat	upx
behavioral2/files/0x000700000002347f-86.dat	upx
behavioral2/files/0x000700000002347e-84.dat	upx
behavioral2/files/0x000700000002347d-79.dat	upx
behavioral2/files/0x000700000002347b-68.dat	upx
behavioral2/files/0x000700000002347a-58.dat	upx
behavioral2/memory/4992-55-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	upx
behavioral2/memory/1032-117-0x00007FF635260000-0x00007FF6355B4000-memory.dmp	upx
behavioral2/memory/4916-120-0x00007FF6778E0000-0x00007FF677C34000-memory.dmp	upx
behavioral2/memory/4380-119-0x00007FF7552C0000-0x00007FF755614000-memory.dmp	upx
behavioral2/memory/4624-122-0x00007FF79A750000-0x00007FF79AAA4000-memory.dmp	upx
behavioral2/memory/4864-123-0x00007FF703950000-0x00007FF703CA4000-memory.dmp	upx
behavioral2/memory/4872-124-0x00007FF607C60000-0x00007FF607FB4000-memory.dmp	upx
behavioral2/memory/4984-121-0x00007FF6032F0000-0x00007FF603644000-memory.dmp	upx
behavioral2/memory/3860-118-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp	upx
behavioral2/memory/396-125-0x00007FF67F650000-0x00007FF67F9A4000-memory.dmp	upx
behavioral2/memory/2312-126-0x00007FF6673F0000-0x00007FF667744000-memory.dmp	upx
behavioral2/memory/1388-127-0x00007FF624F50000-0x00007FF6252A4000-memory.dmp	upx
behavioral2/memory/5012-128-0x00007FF77CA60000-0x00007FF77CDB4000-memory.dmp	upx
behavioral2/memory/336-129-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	upx
behavioral2/memory/4172-130-0x00007FF624D40000-0x00007FF625094000-memory.dmp	upx
behavioral2/memory/4500-131-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	upx
behavioral2/memory/3036-132-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	upx
behavioral2/memory/4656-133-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	upx
behavioral2/memory/5084-134-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	upx
behavioral2/memory/4992-135-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	upx
behavioral2/memory/5064-136-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	upx
behavioral2/memory/336-137-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp	upx
behavioral2/memory/4488-138-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp	upx
behavioral2/memory/4172-139-0x00007FF624D40000-0x00007FF625094000-memory.dmp	upx
behavioral2/memory/4500-140-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp	upx
behavioral2/memory/3036-141-0x00007FF7792B0000-0x00007FF779604000-memory.dmp	upx
behavioral2/memory/4656-142-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp	upx
behavioral2/memory/5084-143-0x00007FF714CF0000-0x00007FF715044000-memory.dmp	upx
behavioral2/memory/1020-144-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp	upx
behavioral2/memory/4992-145-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp	upx
behavioral2/memory/5064-146-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp	upx
behavioral2/memory/3860-148-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp	upx
behavioral2/memory/4380-147-0x00007FF7552C0000-0x00007FF755614000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\oudOCAN.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\MTfBNmC.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\Elnhkiu.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\VzefQtl.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\uYBJbRg.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\cRGZRfL.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\mVKNEup.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\iBpitNG.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\kHrKwvw.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\vNKhfPq.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\SFADwmX.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\HDnKsLs.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\vOLEbOZ.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\MzEgahp.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\GpAQsob.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\yOuvAHW.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\TVCrLEM.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\KLnuRbz.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\sRorSFq.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\zVKYlqZ.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
File created	C:\Windows\System\doATtpU.exe	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
Token: SeLockMemoryPrivilege	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 336	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	83
PID 1032 wrote to memory of 336	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	83
PID 1032 wrote to memory of 4488	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	84
PID 1032 wrote to memory of 4488	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	84
PID 1032 wrote to memory of 4172	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	85
PID 1032 wrote to memory of 4172	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	85
PID 1032 wrote to memory of 4500	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	86
PID 1032 wrote to memory of 4500	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	86
PID 1032 wrote to memory of 3036	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	89
PID 1032 wrote to memory of 3036	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	89
PID 1032 wrote to memory of 4656	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	90
PID 1032 wrote to memory of 4656	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	90
PID 1032 wrote to memory of 5084	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	91
PID 1032 wrote to memory of 5084	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	91
PID 1032 wrote to memory of 1020	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	92
PID 1032 wrote to memory of 1020	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	92
PID 1032 wrote to memory of 5064	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	94
PID 1032 wrote to memory of 5064	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	94
PID 1032 wrote to memory of 4992	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	95
PID 1032 wrote to memory of 4992	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	95
PID 1032 wrote to memory of 3860	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	96
PID 1032 wrote to memory of 3860	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	96
PID 1032 wrote to memory of 4380	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	97
PID 1032 wrote to memory of 4380	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	97
PID 1032 wrote to memory of 4916	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	98
PID 1032 wrote to memory of 4916	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	98
PID 1032 wrote to memory of 4984	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	99
PID 1032 wrote to memory of 4984	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	99
PID 1032 wrote to memory of 4624	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	100
PID 1032 wrote to memory of 4624	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	100
PID 1032 wrote to memory of 4864	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	101
PID 1032 wrote to memory of 4864	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	101
PID 1032 wrote to memory of 4872	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	102
PID 1032 wrote to memory of 4872	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	102
PID 1032 wrote to memory of 396	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	103
PID 1032 wrote to memory of 396	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	103
PID 1032 wrote to memory of 2312	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	104
PID 1032 wrote to memory of 2312	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	104
PID 1032 wrote to memory of 1388	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	105
PID 1032 wrote to memory of 1388	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	105
PID 1032 wrote to memory of 5012	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	106
PID 1032 wrote to memory of 5012	1032	ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe	106

C:\Users\Admin\AppData\Local\Temp\ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe
"C:\Users\Admin\AppData\Local\Temp\ee6d2d8e826267e6bacc43b5da4ab6b1cd1be632c69fc88c4ca9623bf32c6a20.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System\MzEgahp.exe
  C:\Windows\System\MzEgahp.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\mVKNEup.exe
  C:\Windows\System\mVKNEup.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\iBpitNG.exe
  C:\Windows\System\iBpitNG.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\GpAQsob.exe
  C:\Windows\System\GpAQsob.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\zVKYlqZ.exe
  C:\Windows\System\zVKYlqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MTfBNmC.exe
  C:\Windows\System\MTfBNmC.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\kHrKwvw.exe
  C:\Windows\System\kHrKwvw.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\VzefQtl.exe
  C:\Windows\System\VzefQtl.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\doATtpU.exe
  C:\Windows\System\doATtpU.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\Elnhkiu.exe
  C:\Windows\System\Elnhkiu.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\yOuvAHW.exe
  C:\Windows\System\yOuvAHW.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\vNKhfPq.exe
  C:\Windows\System\vNKhfPq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\TVCrLEM.exe
  C:\Windows\System\TVCrLEM.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\SFADwmX.exe
  C:\Windows\System\SFADwmX.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\oudOCAN.exe
  C:\Windows\System\oudOCAN.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\HDnKsLs.exe
  C:\Windows\System\HDnKsLs.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\KLnuRbz.exe
  C:\Windows\System\KLnuRbz.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\vOLEbOZ.exe
  C:\Windows\System\vOLEbOZ.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\uYBJbRg.exe
  C:\Windows\System\uYBJbRg.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\sRorSFq.exe
  C:\Windows\System\sRorSFq.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\cRGZRfL.exe
  C:\Windows\System\cRGZRfL.exe
  2⤵
  - Executes dropped EXE
  PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Elnhkiu.exe

Path C:\Windows\System\Elnhkiu.exe
Size 5.9MB
SHA256 94d6464304387ea7565dd2fa552d07abd556410d728b6eca7b7270b73fbfa5b1
MD5 33f04b34280b3dc0e026a8288fc6d2ff
SHA1 fb82dbc0801d19c2defd4d46ab5cade159502302
SHA512 42c5deb10416f75925012bfa23e57e831226997f5c39d30fb5c690c424aaa237e7e3ce8400e7565e8d1478696b99abb0cb27b2e585bff9a56f4750695a5a5906
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

GpAQsob.exe

Path C:\Windows\System\GpAQsob.exe
Size 5.9MB
SHA256 7cf0ac87ed896bcfbe2776136ba4b012086a8c945ae9d19d18cde04ebb7f5a57
MD5 0af182324d2a5285f45161a997e0ce07
SHA1 73eeeb30ca40bb55ea6271bd3d148bd40ef4b1d8
SHA512 8d373c04338c0778753d6c138bd9c6719d78146fe65f01a04f90c045cf13a594ea4d1e60969339f76d373a8948a2e75745b62465c3f80d6fc2aa92c1cb552847
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

HDnKsLs.exe

Path C:\Windows\System\HDnKsLs.exe
Size 5.9MB
SHA256 c51530bf8a8b8cac27c9fc9516e16fbc633f37ca6ad420640d7a331cc5ddf423
MD5 a33d11710829823899ec03dd5d2c924d
SHA1 1bd85af18979591c28f7efb3bbbace84feda2a16
SHA512 c9e07f8f6f7f27311dce23d5f486b182db4aab3028d71af26bfdf565047940da0433298102e0c00b118a30365650c42cf1430c47359bee1207da52977f58ca93
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

KLnuRbz.exe

Path C:\Windows\System\KLnuRbz.exe
Size 5.9MB
SHA256 75732e6cd6d8c2e38315272efa7ff8bf2a196f5adf1c2ce36a806af51747b724
MD5 6ba8503a1dd333db0c2646cd8af04582
SHA1 dad545569715fe002730789f5f14c3394ddbb11e
SHA512 978963cd3199cb035e773cd7774c34a4e3f00ddebeaf80c98bce0bbd78f05783b93e8a7321c84f2f85c9f1132cb06ce56cb7bdc57fe1f7ca876febc46bff4593
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

MTfBNmC.exe

Path C:\Windows\System\MTfBNmC.exe
Size 5.9MB
SHA256 e5b6a451638830a0eb75ce92bbfa08d9a7e8f7d72657b6d9e7e5889aa91a9622
MD5 2e50e67b0bfcb02068b9a218ad5fbf39
SHA1 4bcbe72e6258b069d67c48eb9ae88eb5d4cd6cf7
SHA512 5b9134d1c823a72710f5da8519fdf2fe25d684167b9d9c4269338f1ab413de45bd364a50114e4ed84acb535bc1fa4222444ed6f8f4fc355dcec1bf58162b6037
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MzEgahp.exe

Path C:\Windows\System\MzEgahp.exe
Size 5.9MB
SHA256 f479233bd9dcd3909ee5afa6fb11e945a0b6ef584d56e7c24740bd2d460a34f5
MD5 51c7c09a1d90d157b2f28b85b11f265f
SHA1 da8b980d2edea04aff592f7ece48e3a45c5ce925
SHA512 4d9ae623097aa60822f9bd3f17bb9f85e302daad0ef171648d8c33e9f739c1dab868080885da7d255e393dd5739ec06cb0d7b34e0c9c6ddaffdadbf74154589d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFADwmX.exe

Path C:\Windows\System\SFADwmX.exe
Size 5.9MB
SHA256 f03117384d55dec40502f0dc6cee88fee7ecbccbb97c5f153c4528fe1467c236
MD5 e3ff768f9f4a5a1350ee463301af0fea
SHA1 e5f78ce9a24ea8fd8632e8a038a1ff957af5c2b8
SHA512 38d9b84f7f092cd7818b2e0831637295042955c17961c9aee16d3d97a667bf8324fdb82534dd666d1d88f0c220e1f4ac0ef7b16839e98407f811aeab2383fbff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

TVCrLEM.exe

Path C:\Windows\System\TVCrLEM.exe
Size 5.9MB
SHA256 92b9296eb5e5a8b17093391aab50dd61f71e3920634b39b7533bb0dc366dc09d
MD5 d67aa2253b4cd2335f52bc9c5e36aa70
SHA1 68f7c34ec39db43d400b14a886cba8b7500725fc
SHA512 c070e80612647f3ccabfe3129de6e10fd99b9d1ea0b60c9c058b45c8893304c8dd6bbcad303fd26ce6dd77c22659f8eedea1d52839c2b1c1bd69e32cd8d522b9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

VzefQtl.exe

Path C:\Windows\System\VzefQtl.exe
Size 5.9MB
SHA256 377d5f3ffada57a3f587fe8c558ddcad678167289f40290bf7f37023c15d6759
MD5 e893b63a5189ab79dac5349ca9443263
SHA1 de8e974dd57fcaf17340629b3902469c31e5a2d2
SHA512 9de8ecb23b3e5d94a2a0288838d99527ff9c3bcfe25499815272596b4fcd3041cc3bdfb6966166be3e37475b88e1b3180b608212b6eeeaec30bf9e4ab5d9356d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

cRGZRfL.exe

Path C:\Windows\System\cRGZRfL.exe
Size 5.9MB
SHA256 77b90d4974e2afd64095d5f98f9fa3ed6f3be3cf76c64bed5b69f6d5441cda4c
MD5 eb53d84d01e29703b97fbba4102a82c8
SHA1 adcb1d3f6be9acaf2ebc470be75c6248d144ce67
SHA512 32948656574a1a29b4657a2b5f2a09496e34930fe2854dd6cb6cbfe30594106f32bcec22a8d52b63e8150715786fa91a51a87e37b716e6348d5a4269fae3d168
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

doATtpU.exe

Path C:\Windows\System\doATtpU.exe
Size 5.9MB
SHA256 7180e2b088c70d32d65fda008e52003345eb221055a08317ed4b55d7580991a2
MD5 0f1b20567d6905b4ef9bb89a7954b0bf
SHA1 13e5eb6b6d4c3624a8c6540f3f6d1f6e535b7c30
SHA512 93c432bd2170dcce872c95c70f5433eb52468c19f60a46819a1354d02b84862445069d9f2a8b8d2b2275b9dbc868892eb34cf31ebebb8cacbcc4c93034b117ed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

iBpitNG.exe

Path C:\Windows\System\iBpitNG.exe
Size 5.9MB
SHA256 54d5428924c3b27a63d38b33e2e2e2d027a3d5c32a248d5ee51fbe85dfa1e674
MD5 aaf6c463734a263114e907989a665a26
SHA1 e72eab7d18f2b605320f9c4e4593d6357c8046cc
SHA512 c78e403d09617218d24a97907d35799b631c306f768a47bc19a78cccd652602da08f4e74bffe056d5a7838fc26845ffac290f0eb8ed20634436ca286dd41126c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

kHrKwvw.exe

Path C:\Windows\System\kHrKwvw.exe
Size 5.9MB
SHA256 633536106312c8e892d6e3b0f0362cec5d014e0f6a12b8e4d3a6b6cbc029d6a9
MD5 5234d740745b2ab48353f4efda2d4208
SHA1 3df4ce29f235a9024a31f1e42258b99b67ac0bd2
SHA512 07abc0794764367c42e12e1272e379082eed0b51374ffd6ea1a11e780c985ae4998d3d470dcf40ddb4f82d2a72c730f602472c8810fab93d3dc061b24de67535
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

mVKNEup.exe

Path C:\Windows\System\mVKNEup.exe
Size 5.9MB
SHA256 935b73a73665a9ea182cf59ceac0318542ed4b4bcffb75aa0f499538efc9d285
MD5 1a0adad33d47b1e150e1c5573c3f8a59
SHA1 32c4ed70ccd4a5978e37fe35818da086979271c7
SHA512 043890e2a3fc76fcbc1832fb73721a7410cc7d8f1e0bfe234853c7243b64ad7f034c4d66d9ec9e17ee3eed554ca8d383c47ed3dedbb59e62ded80404001fcfa6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

oudOCAN.exe

Path C:\Windows\System\oudOCAN.exe
Size 5.9MB
SHA256 9293954ff891f9ca033d0baee270b38c5172836433d9bfffc3aa3150dac1f892
MD5 7f430e0b9b725f7bec921381772e5962
SHA1 13710cf54c6b8f4003615512041eb8bcaffaf772
SHA512 376213a76e68934b6dfe7543a1f96ec75d5868758bf4d3a3c5153f3e3e75995eafabdbbd6ff008488fd1f2512f7c05856f1aa08e43f0d5c1879b18798efc0bcc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

sRorSFq.exe

Path C:\Windows\System\sRorSFq.exe
Size 5.9MB
SHA256 8e281dd8d9952606b02c2fbf105e7c099ed9c6c4c4ad6e3bf9e41ede8ce9987d
MD5 61cc153e8129e57215a3c0a02a3321c1
SHA1 07fa8269b046cb76ed80a43f72ac9e0362814952
SHA512 37c792d4e9fe07e053e62596d91fa3980c9b9f79db6ae9686b3b90de16e7be4fa9bde888d6002ab091e93730cdba958cd72c9ab18f5776c7f8b460deb40b0b08
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

uYBJbRg.exe

Path C:\Windows\System\uYBJbRg.exe
Size 5.9MB
SHA256 5bdd80479b6fd36f38126012b2ee66f11da506435e5666b2d2aa1fa11d54de8f
MD5 052decb94e795b3548bbfeeb6190f077
SHA1 3eafaefe1388de40193db28a3b0313fc466a7c8b
SHA512 79ef098491c47a373163c2bfc8bd560fc13d16bc300e8fbe1c1fa808ef370c1294b3fc92b442651ff6a4bbbcb281f6291f6be6f4978386f5ab04174175b4ca13
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vNKhfPq.exe

Path C:\Windows\System\vNKhfPq.exe
Size 5.9MB
SHA256 eadc7569faa8b92a4fd9ade0802246aef26a0f16a283ada936d90017bc8838af
MD5 8cf26005b8f9b4dca3ef44d2e09204c0
SHA1 207518dd0602ab7805881097e10f6f000efe5f4e
SHA512 58d98d7243fb16813d113a6e1c8bbda06fb60fa8c330ed2987fd27e190c22840f84639dabf602b1f8f552cf17f1a8a248c49f50e0b244b3752f5ee0d4cf675d0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

vOLEbOZ.exe

Path C:\Windows\System\vOLEbOZ.exe
Size 5.9MB
SHA256 cf6003daa43207598e437a749ffb3fc09469311151bdda33738512c8bc3f3d08
MD5 8eb6f0813b77d2d9a3a8f744843a1659
SHA1 c282f2a38aacfe6a4608616dcf38059f837ba63c
SHA512 5325a26a481905ead42098d580de859589392f5439b51f1bba5a4bf814e24510bd6cb49d47c233aec135fcc775ce8b60a165b994e6a4ebc3d6c394a01327c600
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

yOuvAHW.exe

Path C:\Windows\System\yOuvAHW.exe
Size 5.9MB
SHA256 b5e84a6fc4d6c72e9f708ced9aa60100025f8861fddb1c4dae1a64f56c856db3
MD5 8cabc4814adc5ba204df8aa8f57fe7eb
SHA1 526ec3fd439d6c1ab516760e02e3fb1bccd664c5
SHA512 89bcd6ef384a972a7d1e1cdc14f203f45506d2e4ed3bbd45b90475f2f973164b6bf0faf251fa0ec57d3526359e0606d5f9623bfe9bfaede94c48b4e4f3a6b075
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

zVKYlqZ.exe

Path C:\Windows\System\zVKYlqZ.exe
Size 5.9MB
SHA256 ff44b580bf96af66f51caec9e97101fa03f27c5acd4adb6515b40387a9ca06d1
MD5 a1431990a4e08dd470a12cb167043c50
SHA1 ab11dce1bfae8a612d61c3671aa12c52ff8bc73f
SHA512 3eda26a990268589b107a50706e6b8633eca5bb912242687543465bdfaa02330a0b3a42b2a8d0e3cbfb5124ab3eebab8d930b47d2b1fe4e84c9da600f51a8218
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/336-137-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp

Download

memory/336-7-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp

Download

memory/336-129-0x00007FF6DEAA0000-0x00007FF6DEDF4000-memory.dmp

Download

memory/396-153-0x00007FF67F650000-0x00007FF67F9A4000-memory.dmp

Download

memory/396-125-0x00007FF67F650000-0x00007FF67F9A4000-memory.dmp

Download

memory/1020-144-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp

Download

memory/1020-57-0x00007FF71B1F0000-0x00007FF71B544000-memory.dmp

Download

memory/1032-1-0x000002190AA80000-0x000002190AA90000-memory.dmp

Download

memory/1032-0-0x00007FF635260000-0x00007FF6355B4000-memory.dmp

Download

memory/1032-117-0x00007FF635260000-0x00007FF6355B4000-memory.dmp

Download

memory/1388-156-0x00007FF624F50000-0x00007FF6252A4000-memory.dmp

Download

memory/1388-127-0x00007FF624F50000-0x00007FF6252A4000-memory.dmp

Download

memory/2312-126-0x00007FF6673F0000-0x00007FF667744000-memory.dmp

Download

memory/2312-157-0x00007FF6673F0000-0x00007FF667744000-memory.dmp

Download

memory/3036-132-0x00007FF7792B0000-0x00007FF779604000-memory.dmp

Download

memory/3036-141-0x00007FF7792B0000-0x00007FF779604000-memory.dmp

Download

memory/3036-33-0x00007FF7792B0000-0x00007FF779604000-memory.dmp

Download

memory/3860-118-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp

Download

memory/3860-148-0x00007FF7DB9F0000-0x00007FF7DBD44000-memory.dmp

Download

memory/4172-139-0x00007FF624D40000-0x00007FF625094000-memory.dmp

Download

memory/4172-18-0x00007FF624D40000-0x00007FF625094000-memory.dmp

Download

memory/4172-130-0x00007FF624D40000-0x00007FF625094000-memory.dmp

Download

memory/4380-119-0x00007FF7552C0000-0x00007FF755614000-memory.dmp

Download

memory/4380-147-0x00007FF7552C0000-0x00007FF755614000-memory.dmp

Download

memory/4488-138-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp

Download

memory/4488-17-0x00007FF7D7660000-0x00007FF7D79B4000-memory.dmp

Download

memory/4500-140-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp

Download

memory/4500-131-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp

Download

memory/4500-26-0x00007FF7D8E30000-0x00007FF7D9184000-memory.dmp

Download

memory/4624-149-0x00007FF79A750000-0x00007FF79AAA4000-memory.dmp

Download

memory/4624-122-0x00007FF79A750000-0x00007FF79AAA4000-memory.dmp

Download

memory/4656-39-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp

Download

memory/4656-133-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp

Download

memory/4656-142-0x00007FF7DF4C0000-0x00007FF7DF814000-memory.dmp

Download

memory/4864-151-0x00007FF703950000-0x00007FF703CA4000-memory.dmp

Download

memory/4864-123-0x00007FF703950000-0x00007FF703CA4000-memory.dmp

Download

memory/4872-152-0x00007FF607C60000-0x00007FF607FB4000-memory.dmp

Download

memory/4872-124-0x00007FF607C60000-0x00007FF607FB4000-memory.dmp

Download

memory/4916-120-0x00007FF6778E0000-0x00007FF677C34000-memory.dmp

Download

memory/4916-154-0x00007FF6778E0000-0x00007FF677C34000-memory.dmp

Download

memory/4984-150-0x00007FF6032F0000-0x00007FF603644000-memory.dmp

Download

memory/4984-121-0x00007FF6032F0000-0x00007FF603644000-memory.dmp

Download

memory/4992-145-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp

Download

memory/4992-55-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp

Download

memory/4992-135-0x00007FF7DC3A0000-0x00007FF7DC6F4000-memory.dmp

Download

memory/5012-128-0x00007FF77CA60000-0x00007FF77CDB4000-memory.dmp

Download

memory/5012-155-0x00007FF77CA60000-0x00007FF77CDB4000-memory.dmp

Download

memory/5064-146-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp

Download

memory/5064-59-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp

Download

memory/5064-136-0x00007FF7808C0000-0x00007FF780C14000-memory.dmp

Download

memory/5084-54-0x00007FF714CF0000-0x00007FF715044000-memory.dmp

Download

memory/5084-143-0x00007FF714CF0000-0x00007FF715044000-memory.dmp

Download

memory/5084-134-0x00007FF714CF0000-0x00007FF715044000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads