cobaltstrike | e4f988fdf8637baab71e1683c014b562621ac00fa2937f5191efdce75bd64e88

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-npc7dacb37
SHA256 e4f988fdf8637baab71e1683c014b562621ac00fa2937f5191efdce75bd64e88
MD5 8f31c8a9b31dfbb1a503f8dfa43a916f
SHA1 a4752bf5a31d6bbfdc053954ddc30b3bbd67a400
SHA512 f0efe9b5ac87b0870c8427f27d8ed6ad10285ada2fd1d9d5ca591e96b25d66218cfacb92dab585e7e6d9311c106aa6322f3bdda042851e8a33d7a5c6b3b1d311
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a000000023421-4.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-18.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-28.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002342a-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-40.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-115.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229e1-117.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023397-120.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023398-127.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023421-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002342a-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229e1-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023397-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023398-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1940-0-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	UPX
behavioral2/files/0x000a000000023421-4.dat	UPX
behavioral2/memory/3796-9-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-11.dat	UPX
behavioral2/files/0x000700000002342e-18.dat	UPX
behavioral2/memory/1736-14-0x00007FF787530000-0x00007FF787884000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-23.dat	UPX
behavioral2/memory/2736-21-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	UPX
behavioral2/memory/3016-26-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-28.dat	UPX
behavioral2/files/0x000900000002342a-34.dat	UPX
behavioral2/memory/4516-36-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-40.dat	UPX
behavioral2/memory/436-42-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	UPX
behavioral2/memory/3620-49-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023433-53.dat	UPX
behavioral2/files/0x0007000000023434-58.dat	UPX
behavioral2/files/0x0007000000023435-67.dat	UPX
behavioral2/files/0x0007000000023436-72.dat	UPX
behavioral2/files/0x0007000000023438-82.dat	UPX
behavioral2/files/0x000700000002343b-101.dat	UPX
behavioral2/files/0x0007000000023439-99.dat	UPX
behavioral2/memory/3376-98-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-94.dat	UPX
behavioral2/memory/4720-93-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023437-90.dat	UPX
behavioral2/memory/4628-89-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	UPX
behavioral2/memory/4852-85-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	UPX
behavioral2/memory/2768-84-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	UPX
behavioral2/memory/748-78-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	UPX
behavioral2/memory/2776-65-0x00007FF680D20000-0x00007FF681074000-memory.dmp	UPX
behavioral2/memory/1940-64-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	UPX
behavioral2/memory/1444-57-0x00007FF744010000-0x00007FF744364000-memory.dmp	UPX
behavioral2/memory/5016-55-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-47.dat	UPX
behavioral2/memory/3656-104-0x00007FF751030000-0x00007FF751384000-memory.dmp	UPX
behavioral2/memory/4784-112-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-115.dat	UPX
behavioral2/files/0x00030000000229e1-117.dat	UPX
behavioral2/memory/4436-114-0x00007FF671740000-0x00007FF671A94000-memory.dmp	UPX
behavioral2/memory/436-113-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	UPX
behavioral2/files/0x000a000000023397-120.dat	UPX
behavioral2/files/0x000b000000023398-127.dat	UPX
behavioral2/memory/3968-125-0x00007FF7ECF50000-0x00007FF7ED2A4000-memory.dmp	UPX
behavioral2/memory/2796-129-0x00007FF6643F0000-0x00007FF664744000-memory.dmp	UPX
behavioral2/memory/2768-130-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	UPX
behavioral2/memory/4628-131-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	UPX
behavioral2/memory/4852-132-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	UPX
behavioral2/memory/4720-133-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	UPX
behavioral2/memory/3376-134-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	UPX
behavioral2/memory/4784-135-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	UPX
behavioral2/memory/4436-136-0x00007FF671740000-0x00007FF671A94000-memory.dmp	UPX
behavioral2/memory/3796-137-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	UPX
behavioral2/memory/1736-138-0x00007FF787530000-0x00007FF787884000-memory.dmp	UPX
behavioral2/memory/2736-139-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	UPX
behavioral2/memory/3016-140-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	UPX
behavioral2/memory/4516-141-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	UPX
behavioral2/memory/436-142-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	UPX
behavioral2/memory/3620-143-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	UPX
behavioral2/memory/5016-144-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	UPX
behavioral2/memory/1444-145-0x00007FF744010000-0x00007FF744364000-memory.dmp	UPX
behavioral2/memory/2776-146-0x00007FF680D20000-0x00007FF681074000-memory.dmp	UPX
behavioral2/memory/748-147-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	UPX
behavioral2/memory/2768-148-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1940-0-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	xmrig
behavioral2/files/0x000a000000023421-4.dat	xmrig
behavioral2/memory/3796-9-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-11.dat	xmrig
behavioral2/files/0x000700000002342e-18.dat	xmrig
behavioral2/memory/1736-14-0x00007FF787530000-0x00007FF787884000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-23.dat	xmrig
behavioral2/memory/2736-21-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	xmrig
behavioral2/memory/3016-26-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-28.dat	xmrig
behavioral2/files/0x000900000002342a-34.dat	xmrig
behavioral2/memory/4516-36-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-40.dat	xmrig
behavioral2/memory/436-42-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	xmrig
behavioral2/memory/3620-49-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-53.dat	xmrig
behavioral2/files/0x0007000000023434-58.dat	xmrig
behavioral2/files/0x0007000000023435-67.dat	xmrig
behavioral2/files/0x0007000000023436-72.dat	xmrig
behavioral2/files/0x0007000000023438-82.dat	xmrig
behavioral2/files/0x000700000002343b-101.dat	xmrig
behavioral2/files/0x0007000000023439-99.dat	xmrig
behavioral2/memory/3376-98-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-94.dat	xmrig
behavioral2/memory/4720-93-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-90.dat	xmrig
behavioral2/memory/4628-89-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	xmrig
behavioral2/memory/4852-85-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	xmrig
behavioral2/memory/2768-84-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	xmrig
behavioral2/memory/748-78-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	xmrig
behavioral2/memory/2776-65-0x00007FF680D20000-0x00007FF681074000-memory.dmp	xmrig
behavioral2/memory/1940-64-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	xmrig
behavioral2/memory/1444-57-0x00007FF744010000-0x00007FF744364000-memory.dmp	xmrig
behavioral2/memory/5016-55-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-47.dat	xmrig
behavioral2/memory/3656-104-0x00007FF751030000-0x00007FF751384000-memory.dmp	xmrig
behavioral2/memory/4784-112-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-115.dat	xmrig
behavioral2/files/0x00030000000229e1-117.dat	xmrig
behavioral2/memory/4436-114-0x00007FF671740000-0x00007FF671A94000-memory.dmp	xmrig
behavioral2/memory/436-113-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	xmrig
behavioral2/files/0x000a000000023397-120.dat	xmrig
behavioral2/files/0x000b000000023398-127.dat	xmrig
behavioral2/memory/3968-125-0x00007FF7ECF50000-0x00007FF7ED2A4000-memory.dmp	xmrig
behavioral2/memory/2796-129-0x00007FF6643F0000-0x00007FF664744000-memory.dmp	xmrig
behavioral2/memory/2768-130-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	xmrig
behavioral2/memory/4628-131-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	xmrig
behavioral2/memory/4852-132-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	xmrig
behavioral2/memory/4720-133-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	xmrig
behavioral2/memory/3376-134-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	xmrig
behavioral2/memory/4784-135-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	xmrig
behavioral2/memory/4436-136-0x00007FF671740000-0x00007FF671A94000-memory.dmp	xmrig
behavioral2/memory/3796-137-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	xmrig
behavioral2/memory/1736-138-0x00007FF787530000-0x00007FF787884000-memory.dmp	xmrig
behavioral2/memory/2736-139-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	xmrig
behavioral2/memory/3016-140-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	xmrig
behavioral2/memory/4516-141-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	xmrig
behavioral2/memory/436-142-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	xmrig
behavioral2/memory/3620-143-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	xmrig
behavioral2/memory/5016-144-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	xmrig
behavioral2/memory/1444-145-0x00007FF744010000-0x00007FF744364000-memory.dmp	xmrig
behavioral2/memory/2776-146-0x00007FF680D20000-0x00007FF681074000-memory.dmp	xmrig
behavioral2/memory/748-147-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	xmrig
behavioral2/memory/2768-148-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3796	jmNucrC.exe
1736	Socrbjh.exe
2736	rbNfZnc.exe
3016	yGtvSIA.exe
4516	NiiZceg.exe
436	TawXTDe.exe
3620	UMwKnpn.exe
5016	uhjQSqo.exe
1444	BWgWbJY.exe
2776	iKBtNNI.exe
748	EwEmeIp.exe
2768	XSbnaFj.exe
4720	vSXCwIW.exe
4852	AroTPPi.exe
4628	YgaeyFS.exe
3376	hqvGnfs.exe
3656	KHwZxWf.exe
4784	iTYJTUy.exe
4436	QYZGCJL.exe
3968	flsEawX.exe
2796	srZdlbh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1940-0-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	upx
behavioral2/files/0x000a000000023421-4.dat	upx
behavioral2/memory/3796-9-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	upx
behavioral2/files/0x000700000002342d-11.dat	upx
behavioral2/files/0x000700000002342e-18.dat	upx
behavioral2/memory/1736-14-0x00007FF787530000-0x00007FF787884000-memory.dmp	upx
behavioral2/files/0x000700000002342f-23.dat	upx
behavioral2/memory/2736-21-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	upx
behavioral2/memory/3016-26-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	upx
behavioral2/files/0x0007000000023430-28.dat	upx
behavioral2/files/0x000900000002342a-34.dat	upx
behavioral2/memory/4516-36-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	upx
behavioral2/files/0x0007000000023431-40.dat	upx
behavioral2/memory/436-42-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	upx
behavioral2/memory/3620-49-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	upx
behavioral2/files/0x0007000000023433-53.dat	upx
behavioral2/files/0x0007000000023434-58.dat	upx
behavioral2/files/0x0007000000023435-67.dat	upx
behavioral2/files/0x0007000000023436-72.dat	upx
behavioral2/files/0x0007000000023438-82.dat	upx
behavioral2/files/0x000700000002343b-101.dat	upx
behavioral2/files/0x0007000000023439-99.dat	upx
behavioral2/memory/3376-98-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	upx
behavioral2/files/0x000700000002343a-94.dat	upx
behavioral2/memory/4720-93-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	upx
behavioral2/files/0x0007000000023437-90.dat	upx
behavioral2/memory/4628-89-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	upx
behavioral2/memory/4852-85-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	upx
behavioral2/memory/2768-84-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	upx
behavioral2/memory/748-78-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	upx
behavioral2/memory/2776-65-0x00007FF680D20000-0x00007FF681074000-memory.dmp	upx
behavioral2/memory/1940-64-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp	upx
behavioral2/memory/1444-57-0x00007FF744010000-0x00007FF744364000-memory.dmp	upx
behavioral2/memory/5016-55-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	upx
behavioral2/files/0x0007000000023432-47.dat	upx
behavioral2/memory/3656-104-0x00007FF751030000-0x00007FF751384000-memory.dmp	upx
behavioral2/memory/4784-112-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	upx
behavioral2/files/0x000700000002343c-115.dat	upx
behavioral2/files/0x00030000000229e1-117.dat	upx
behavioral2/memory/4436-114-0x00007FF671740000-0x00007FF671A94000-memory.dmp	upx
behavioral2/memory/436-113-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	upx
behavioral2/files/0x000a000000023397-120.dat	upx
behavioral2/files/0x000b000000023398-127.dat	upx
behavioral2/memory/3968-125-0x00007FF7ECF50000-0x00007FF7ED2A4000-memory.dmp	upx
behavioral2/memory/2796-129-0x00007FF6643F0000-0x00007FF664744000-memory.dmp	upx
behavioral2/memory/2768-130-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	upx
behavioral2/memory/4628-131-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp	upx
behavioral2/memory/4852-132-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp	upx
behavioral2/memory/4720-133-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp	upx
behavioral2/memory/3376-134-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp	upx
behavioral2/memory/4784-135-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp	upx
behavioral2/memory/4436-136-0x00007FF671740000-0x00007FF671A94000-memory.dmp	upx
behavioral2/memory/3796-137-0x00007FF68F120000-0x00007FF68F474000-memory.dmp	upx
behavioral2/memory/1736-138-0x00007FF787530000-0x00007FF787884000-memory.dmp	upx
behavioral2/memory/2736-139-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp	upx
behavioral2/memory/3016-140-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp	upx
behavioral2/memory/4516-141-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp	upx
behavioral2/memory/436-142-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp	upx
behavioral2/memory/3620-143-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp	upx
behavioral2/memory/5016-144-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp	upx
behavioral2/memory/1444-145-0x00007FF744010000-0x00007FF744364000-memory.dmp	upx
behavioral2/memory/2776-146-0x00007FF680D20000-0x00007FF681074000-memory.dmp	upx
behavioral2/memory/748-147-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp	upx
behavioral2/memory/2768-148-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\XSbnaFj.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\flsEawX.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\srZdlbh.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vSXCwIW.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QYZGCJL.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NiiZceg.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TawXTDe.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UMwKnpn.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iKBtNNI.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AroTPPi.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YgaeyFS.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KHwZxWf.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iTYJTUy.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rbNfZnc.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yGtvSIA.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uhjQSqo.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EwEmeIp.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jmNucrC.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Socrbjh.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BWgWbJY.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hqvGnfs.exe	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3796	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	83
PID 1940 wrote to memory of 3796	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	83
PID 1940 wrote to memory of 1736	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	85
PID 1940 wrote to memory of 1736	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	85
PID 1940 wrote to memory of 2736	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	86
PID 1940 wrote to memory of 2736	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	86
PID 1940 wrote to memory of 3016	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	87
PID 1940 wrote to memory of 3016	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	87
PID 1940 wrote to memory of 4516	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	91
PID 1940 wrote to memory of 4516	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	91
PID 1940 wrote to memory of 436	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	92
PID 1940 wrote to memory of 436	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	92
PID 1940 wrote to memory of 3620	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	93
PID 1940 wrote to memory of 3620	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	93
PID 1940 wrote to memory of 5016	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	94
PID 1940 wrote to memory of 5016	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	94
PID 1940 wrote to memory of 1444	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	95
PID 1940 wrote to memory of 1444	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	95
PID 1940 wrote to memory of 2776	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	96
PID 1940 wrote to memory of 2776	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	96
PID 1940 wrote to memory of 748	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	97
PID 1940 wrote to memory of 748	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	97
PID 1940 wrote to memory of 2768	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	98
PID 1940 wrote to memory of 2768	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	98
PID 1940 wrote to memory of 4720	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	99
PID 1940 wrote to memory of 4720	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	99
PID 1940 wrote to memory of 4852	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	100
PID 1940 wrote to memory of 4852	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	100
PID 1940 wrote to memory of 4628	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	101
PID 1940 wrote to memory of 4628	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	101
PID 1940 wrote to memory of 3376	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	102
PID 1940 wrote to memory of 3376	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	102
PID 1940 wrote to memory of 3656	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	103
PID 1940 wrote to memory of 3656	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	103
PID 1940 wrote to memory of 4784	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	104
PID 1940 wrote to memory of 4784	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	104
PID 1940 wrote to memory of 4436	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	105
PID 1940 wrote to memory of 4436	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	105
PID 1940 wrote to memory of 3968	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	106
PID 1940 wrote to memory of 3968	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	106
PID 1940 wrote to memory of 2796	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	107
PID 1940 wrote to memory of 2796	1940	2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_8f31c8a9b31dfbb1a503f8dfa43a916f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System\jmNucrC.exe
  C:\Windows\System\jmNucrC.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\Socrbjh.exe
  C:\Windows\System\Socrbjh.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\rbNfZnc.exe
  C:\Windows\System\rbNfZnc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\yGtvSIA.exe
  C:\Windows\System\yGtvSIA.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\NiiZceg.exe
  C:\Windows\System\NiiZceg.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\TawXTDe.exe
  C:\Windows\System\TawXTDe.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\UMwKnpn.exe
  C:\Windows\System\UMwKnpn.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\uhjQSqo.exe
  C:\Windows\System\uhjQSqo.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\BWgWbJY.exe
  C:\Windows\System\BWgWbJY.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\iKBtNNI.exe
  C:\Windows\System\iKBtNNI.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\EwEmeIp.exe
  C:\Windows\System\EwEmeIp.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\XSbnaFj.exe
  C:\Windows\System\XSbnaFj.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vSXCwIW.exe
  C:\Windows\System\vSXCwIW.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\AroTPPi.exe
  C:\Windows\System\AroTPPi.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\YgaeyFS.exe
  C:\Windows\System\YgaeyFS.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\hqvGnfs.exe
  C:\Windows\System\hqvGnfs.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\KHwZxWf.exe
  C:\Windows\System\KHwZxWf.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\iTYJTUy.exe
  C:\Windows\System\iTYJTUy.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\QYZGCJL.exe
  C:\Windows\System\QYZGCJL.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\flsEawX.exe
  C:\Windows\System\flsEawX.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\srZdlbh.exe
  C:\Windows\System\srZdlbh.exe
  2⤵
  - Executes dropped EXE
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AroTPPi.exe

Path C:\Windows\System\AroTPPi.exe
Size 5.9MB
SHA256 f713128d09e5890120da1489b6b8b6eeaa5c255103e79af247c81c7504c0c981
MD5 d01532153e666a222cc6f5ce1f218e7f
SHA1 f7ad9ef78121e3d7548a1fabe0c836d11016c94c
SHA512 36a70808895a90dc516f730498623ea72652153fcd7ae9aff18d49697ecc335823eb3e2bc06769e8fce4a8e57609717828c17f195efaf768a73c3bf0c9ac4544
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

BWgWbJY.exe

Path C:\Windows\System\BWgWbJY.exe
Size 5.9MB
SHA256 f923943f3215955aa9e4b807ecf4823a507fe6c5250cc2e309f7b7605ada4de7
MD5 829dd416cb1f55e5158d934b7505c7b8
SHA1 a5d0afca948b902895e44597546175acc17df365
SHA512 2cc78c689d4334016fe4fa4be7d095b8de6bbeaf9c4c63bf55352915971911a83eefc6bee37b888265875d8184bbbed35b61e01561ec5d3035bedcfec90993d2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

EwEmeIp.exe

Path C:\Windows\System\EwEmeIp.exe
Size 5.9MB
SHA256 f0dccc7968bf4227e3aed8a626389a63a0155b225a85ad27637c28833c32e4f3
MD5 edc87f1b3c29965562e1257373828005
SHA1 f82f025638324f9a79c13742315f2f991a501b51
SHA512 9abdab2b29977fd82f78246f167a324c34b86a0aea8f927bb40c883ab4df110b9db00b01592aed0d38ef036d6457b914418cbded012b8039b86cf7d1f844a68c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHwZxWf.exe

Path C:\Windows\System\KHwZxWf.exe
Size 5.9MB
SHA256 a5ed9468a28509fd1cb51aeb4690105d76a6106fceeb873417d89ba3a35da653
MD5 8cc16c89ad9d53990658b03111bf52e4
SHA1 8b9b5e0c11f73ba5ef18a93dd58d4f8186132dde
SHA512 9f0620482e0111b28e7b4f229f5a75b0aea90de446ddf1e20a298fc9c7382abc5218adace35e5ff5c19a41b34dbb0433f5bfb3815860f4f93f854149f4967ab8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

NiiZceg.exe

Path C:\Windows\System\NiiZceg.exe
Size 5.9MB
SHA256 8d9e8040c6e12f2631aef6c413c338e8d725b2faaf691389f589ac1bf045a39b
MD5 ebdc1fd5168380d76a9db65966dbabbd
SHA1 ba9f18ec45507c61ac1fcb295c52a41f5c26ae85
SHA512 dfc056848da858b55a9df9751f81a6cd163db4bd6ed27375f310e8d6b1963abec951dbbbf40543ec061f6d09460d254ef6dff133fe4bb413c84a0ac92aaf6150
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYZGCJL.exe

Path C:\Windows\System\QYZGCJL.exe
Size 5.9MB
SHA256 736bf491e5656dc38e2894fbc20fc80fd39d448358f5a41a2bfef992f935310c
MD5 915206c2d481da371f18f4c7d5c2328c
SHA1 dfdfbaa7a53b7790c80aeaec1b8ef1c930c30106
SHA512 9bbe218ddef5a71412bde9125cece7ec6e0e340396e4a2932209eef3d81cc09231ea4f0a0fed99feb8920c8c95d40d7db5450cafa972347b4a9e90aa795a3081
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Socrbjh.exe

Path C:\Windows\System\Socrbjh.exe
Size 5.9MB
SHA256 af0cfc8cb1a0a880fd39a6a7b9210dd967be8c9772f1373f8cb6cc893ca43781
MD5 fc3e2ec74b6d13bba4f021bbe729b505
SHA1 539b043b027eb7cf08f47b991924abb73d535249
SHA512 40515e96f7f0b2443c5922d0984b7c3208dd600d04a2e5f715f5c052692b7cdfbff31448223d967b67981205e8ce1b2395efc4986d68bfad998f4a89b7224f5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

TawXTDe.exe

Path C:\Windows\System\TawXTDe.exe
Size 5.9MB
SHA256 6a2218aa3926a8a625f3c569e954c52f3e1a78f1c4002951002e81802afaf690
MD5 b05271006b1b5178fd39e55f47ff4b3b
SHA1 12c6a550164a184ae131b1dbc952e7c0dd836429
SHA512 db6c0834310e34961f7d622faf3985e2833bca40921b6133e06c005adc3850ee94cb087ab3abc4024b680ffe0d7de50847e1cde1878c6c0112e19420ef2bbfce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

UMwKnpn.exe

Path C:\Windows\System\UMwKnpn.exe
Size 5.9MB
SHA256 a56da95dce672d60e7db7120c0b34b96ab0200b05c79f9ed0ad2a31ad5d426aa
MD5 aeb39fe36a150f9992b7bdb249d2cfee
SHA1 ff55af3d62fb27408e7087b78c4d3caf94afd2a9
SHA512 a11791923bebc8666857bc2c592ceac1abcd763afd5db83b55b7b0606bab1b29375737a8bf62c30ebc79e75aa2edb3492e7908c42589f0df116372a7a8bcc60b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

XSbnaFj.exe

Path C:\Windows\System\XSbnaFj.exe
Size 5.9MB
SHA256 68619af4ee0ec7e41ca1c35c43cb81d99854c4a2634ab21cf1066fda9bf548d4
MD5 ab07e8301a454018ed745a6b702c7711
SHA1 e3baeab8ea96eee1a1009908b0e67ceec5c55794
SHA512 9b1675cc887ef2d67080f4279232783a94ccc49547aba19017fb8a1ed2ad1cc63a20dd99a038b86ae9dee5ffd694fc7b37b680720b3f2b7849ab2cf6aa3794ac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

YgaeyFS.exe

Path C:\Windows\System\YgaeyFS.exe
Size 5.9MB
SHA256 f67f8cc3b61c677398e78b36076221c4a2e13dd2d39eb94254c791c89166f129
MD5 87e2ecee179d9967a99be0f39ac3d939
SHA1 82b00e03be30898a0689d81e03110109e355b5fa
SHA512 1e03f103e48aaec9f596072466e2ef6f0142c4b3a7a84ef95d5f6beb2ab68a5a221d3e3140fb4565c37e2c8aa88d970366ee7266d1909a9335ea59f8e6d36c4c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

flsEawX.exe

Path C:\Windows\System\flsEawX.exe
Size 5.9MB
SHA256 ad19e4c79c17af395be9dfd397b13159b98e07a41d44d8040441a099913ee16b
MD5 f6e31270ac7ed7c7ae70a118c4f43562
SHA1 3e1da8a89ad9678f1c8dd3e535752eeaecbff8f2
SHA512 4476b29de001cb0335973e0de8925901c1447a412172e17c47528ccf654b80cb5c381d7d0699ba57b3068e390f94a653cc9703169d5c4b4dc1177da83f19b3a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqvGnfs.exe

Path C:\Windows\System\hqvGnfs.exe
Size 5.9MB
SHA256 1e3cf75ab5929aef587b0d459a1eff6930980f2db64f62f51334ff31ec75ec78
MD5 7ae42621229a2db447fc876fb43b03d4
SHA1 b9ad14e608cf9bc64ab9cbba16c4f6acc24953f2
SHA512 fb2c8cd84ad06ab27e14bc3886e07a10636a60ffd627662ea4040e32ed0334f79e0627c79626cf5206fc30d92dfc14764452eec7b3a733a3aa60c910631a4836
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

iKBtNNI.exe

Path C:\Windows\System\iKBtNNI.exe
Size 5.9MB
SHA256 a3e559226d79a32b9050f24ac5b4bbec471abacf619a0fe27a4482680d537ad0
MD5 dc1c38b84240872f143be89cefd4170f
SHA1 356abe82e9da6a49ec7621263f8da576d6249b6a
SHA512 469dca32e5781daa09f098e7e49fa70c021e4b8eeb5c283aa75c375cc2e9e9b060a41db2480e33225d72a9f92d66c831530df90035bff3f7ba884d709a20ec1c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

iTYJTUy.exe

Path C:\Windows\System\iTYJTUy.exe
Size 5.9MB
SHA256 16e308d40fb9572a0b35e5f687537b2f13d5738d4e6f205970ab992ca7d259b9
MD5 b3506b2bbf3075ee27782de9e419bc5e
SHA1 334383d839068e855d9b0eebbe932c7e1d15995b
SHA512 8498a5baaf4a18bcf436d251493af257f39decff159ba5f34fb5318023080c047894c7977e634b79b0a0381f8e13c31907f67397ab13be1a365720598728c343
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmNucrC.exe

Path C:\Windows\System\jmNucrC.exe
Size 5.9MB
SHA256 423b46068b31098061d73fa9928ad38c53893974c2b333aaa2934c40a82df822
MD5 4f3aec2b086422cddea9269d32127aae
SHA1 c67a61bd482424541be42c18910ccfc575d95815
SHA512 62c444daf5de154c6eff7c3af28bae9ec9ab569c6af08b5b51e53fbc2fd93b39a6814137cbdd98d147e84e78d72586f1bfe0ff9f142e6331de04def3abce01b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbNfZnc.exe

Path C:\Windows\System\rbNfZnc.exe
Size 5.9MB
SHA256 6b98a497452e4bd82121a34d1b118831ff622a8c14866b64afa7edffeb5c081d
MD5 8f62ce3a9dec1f9849d9dad730f6fd94
SHA1 ff9a6d6d780bcb3a5549a5378eb9739704b524a8
SHA512 731b5420520e1ff2af8ccc9a8881b296d4ced13cd95aae10c770194e77884c8b12b5c0c1ee3da37232a47ff3f17c4a6a6e78819862f731e10132cb6d741db5af
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

srZdlbh.exe

Path C:\Windows\System\srZdlbh.exe
Size 5.9MB
SHA256 1f82390cd01618c499061196f7e20cb29eafdc3effe2faa6dc79735c6790a60a
MD5 7c832af2279652acdb624c3a084eea27
SHA1 d74ad6c48ea1ff5703cd87d4cde3a4cb6056d395
SHA512 e8318aaed9cefcc1acd3b7d15b52a8e3407beda21255cd68b94e4566b42d626d5d28bd4f8a24adc9b87cd03b9740cc755f6025df074ab8229ba569a2d5617a2e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhjQSqo.exe

Path C:\Windows\System\uhjQSqo.exe
Size 5.9MB
SHA256 81e0d93247c4453eec3233935194fcfe950a89f4e31949526cb86adeb5b5c126
MD5 97fb13b92bebc9b9289c6d72f0be53bc
SHA1 e4e66a28075defff3a530bfb10e2c5643d8e1949
SHA512 a53a7debdc31abeb613b427ea79b87eef210f170d7fb4c87d2823cca32fa031c358681a6a7a4edd7e271927ff7388f11a195a283ef1bc9c51dc6ba8d2da5bcd9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

vSXCwIW.exe

Path C:\Windows\System\vSXCwIW.exe
Size 5.9MB
SHA256 b0ae1eb9df65051c6119392dca5787be71475b2a053aa1496cda54a747194d28
MD5 b09792614e0f37482deca88c7bb3a90c
SHA1 d64c83795ff2cf19b53e2174990f337e37bee895
SHA512 e67d1580bffefd25dfa4e21b00506caa0f40102e0b04a785dcb27a3edd00755a4268accd1a06a083881d3c5a36494ea0a71443078fdeaa31d7aa526a0221125b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

yGtvSIA.exe

Path C:\Windows\System\yGtvSIA.exe
Size 5.9MB
SHA256 16f6ab48ee5085693b6f960d4fc1550ea9b705da45f6309affa6d3d92b54ee23
MD5 9f95f66878c9260dcd65b36008054172
SHA1 f5b031121f4c1d045182fcc701afc001a886fd31
SHA512 92807e2bb18841c19ec4602fb1cc05c132c79803107f1ad3ba47c09e14c7773731646af23e5dd9dd6227c968484600460fbe762d11475b3531f43c0763446287
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-142-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp

Download

memory/436-113-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp

Download

memory/436-42-0x00007FF6E5340000-0x00007FF6E5694000-memory.dmp

Download

memory/748-147-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp

Download

memory/748-78-0x00007FF74ADD0000-0x00007FF74B124000-memory.dmp

Download

memory/1444-145-0x00007FF744010000-0x00007FF744364000-memory.dmp

Download

memory/1444-57-0x00007FF744010000-0x00007FF744364000-memory.dmp

Download

memory/1736-14-0x00007FF787530000-0x00007FF787884000-memory.dmp

Download

memory/1736-138-0x00007FF787530000-0x00007FF787884000-memory.dmp

Download

memory/1940-1-0x000001EFF3ED0000-0x000001EFF3EE0000-memory.dmp

Download

memory/1940-0-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp

Download

memory/1940-64-0x00007FF6CF620000-0x00007FF6CF974000-memory.dmp

Download

memory/2736-139-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp

Download

memory/2736-21-0x00007FF791AF0000-0x00007FF791E44000-memory.dmp

Download

memory/2768-130-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp

Download

memory/2768-84-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp

Download

memory/2768-148-0x00007FF79F930000-0x00007FF79FC84000-memory.dmp

Download

memory/2776-65-0x00007FF680D20000-0x00007FF681074000-memory.dmp

Download

memory/2776-146-0x00007FF680D20000-0x00007FF681074000-memory.dmp

Download

memory/2796-157-0x00007FF6643F0000-0x00007FF664744000-memory.dmp

Download

memory/2796-129-0x00007FF6643F0000-0x00007FF664744000-memory.dmp

Download

memory/3016-140-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp

Download

memory/3016-26-0x00007FF737D60000-0x00007FF7380B4000-memory.dmp

Download

memory/3376-150-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp

Download

memory/3376-98-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp

Download

memory/3376-134-0x00007FF74C940000-0x00007FF74CC94000-memory.dmp

Download

memory/3620-49-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp

Download

memory/3620-143-0x00007FF693D70000-0x00007FF6940C4000-memory.dmp

Download

memory/3656-104-0x00007FF751030000-0x00007FF751384000-memory.dmp

Download

memory/3656-152-0x00007FF751030000-0x00007FF751384000-memory.dmp

Download

memory/3796-137-0x00007FF68F120000-0x00007FF68F474000-memory.dmp

Download

memory/3796-9-0x00007FF68F120000-0x00007FF68F474000-memory.dmp

Download

memory/3968-125-0x00007FF7ECF50000-0x00007FF7ED2A4000-memory.dmp

Download

memory/3968-156-0x00007FF7ECF50000-0x00007FF7ED2A4000-memory.dmp

Download

memory/4436-136-0x00007FF671740000-0x00007FF671A94000-memory.dmp

Download

memory/4436-155-0x00007FF671740000-0x00007FF671A94000-memory.dmp

Download

memory/4436-114-0x00007FF671740000-0x00007FF671A94000-memory.dmp

Download

memory/4516-36-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp

Download

memory/4516-141-0x00007FF6A9820000-0x00007FF6A9B74000-memory.dmp

Download

memory/4628-153-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp

Download

memory/4628-89-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp

Download

memory/4628-131-0x00007FF7F24B0000-0x00007FF7F2804000-memory.dmp

Download

memory/4720-93-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp

Download

memory/4720-133-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp

Download

memory/4720-151-0x00007FF6D3290000-0x00007FF6D35E4000-memory.dmp

Download

memory/4784-112-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp

Download

memory/4784-154-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp

Download

memory/4784-135-0x00007FF7EFE60000-0x00007FF7F01B4000-memory.dmp

Download

memory/4852-149-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp

Download

memory/4852-85-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp

Download

memory/4852-132-0x00007FF7FDD80000-0x00007FF7FE0D4000-memory.dmp

Download

memory/5016-55-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp

Download

memory/5016-144-0x00007FF6D1CD0000-0x00007FF6D2024000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads