cobaltstrike | a09fca934447ed0d9adfb3dce7c09b977eea76b545693e59c8147cc02fdcf5bc

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-vn4fhaaa84
SHA256 a09fca934447ed0d9adfb3dce7c09b977eea76b545693e59c8147cc02fdcf5bc
MD5 dcb4230a34199612d912db956abdd48d
SHA1 972c8fbe012cbb142f860646b5cc7094de1425bd
SHA512 00f9b1f8dbe75109231d197c4b9f0704c13f849b59b95c9274b07ffa0938b4d1530a6ea1b9cf6484db3158a6431e089d438a40e80687af9630bedf3acb920b05
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000022f51-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-58.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-80.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-95.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-96.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-105.dat	cobalt_reflective_dll
behavioral2/files/0x0011000000021f87-111.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000022978-117.dat	cobalt_reflective_dll
behavioral2/files/0x0005000000022ac7-127.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000002337d-131.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022f51-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0011000000021f87-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000022978-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0005000000022ac7-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000002337d-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5104-0-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	UPX
behavioral2/files/0x0008000000022f51-5.dat	UPX
behavioral2/memory/2292-7-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	UPX
behavioral2/files/0x000700000002340f-12.dat	UPX
behavioral2/files/0x0007000000023410-10.dat	UPX
behavioral2/memory/3184-14-0x00007FF619910000-0x00007FF619C64000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-22.dat	UPX
behavioral2/memory/1636-25-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	UPX
behavioral2/memory/4876-26-0x00007FF671010000-0x00007FF671364000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-28.dat	UPX
behavioral2/memory/3956-30-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-35.dat	UPX
behavioral2/memory/3856-38-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-41.dat	UPX
behavioral2/memory/2088-42-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-47.dat	UPX
behavioral2/files/0x0007000000023416-53.dat	UPX
behavioral2/memory/2384-54-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	UPX
behavioral2/memory/1404-50-0x00007FF614170000-0x00007FF6144C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-58.dat	UPX
behavioral2/memory/4508-72-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-73.dat	UPX
behavioral2/files/0x0007000000023418-80.dat	UPX
behavioral2/memory/3888-82-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-95.dat	UPX
behavioral2/files/0x000700000002341d-96.dat	UPX
behavioral2/memory/3956-99-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	UPX
behavioral2/memory/1380-98-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-94.dat	UPX
behavioral2/memory/2072-93-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	UPX
behavioral2/memory/4140-91-0x00007FF770910000-0x00007FF770C64000-memory.dmp	UPX
behavioral2/memory/3184-86-0x00007FF619910000-0x00007FF619C64000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-78.dat	UPX
behavioral2/memory/3260-77-0x00007FF624F30000-0x00007FF625284000-memory.dmp	UPX
behavioral2/memory/2292-74-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	UPX
behavioral2/memory/2388-69-0x00007FF74FAF0000-0x00007FF74FE44000-memory.dmp	UPX
behavioral2/memory/5104-64-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-105.dat	UPX
behavioral2/memory/4816-110-0x00007FF7DD9E0000-0x00007FF7DDD34000-memory.dmp	UPX
behavioral2/files/0x0011000000021f87-111.dat	UPX
behavioral2/memory/4176-113-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	UPX
behavioral2/memory/2088-112-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	UPX
behavioral2/files/0x0004000000022978-117.dat	UPX
behavioral2/memory/2384-125-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	UPX
behavioral2/files/0x0005000000022ac7-127.dat	UPX
behavioral2/memory/4064-126-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	UPX
behavioral2/memory/4708-119-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	UPX
behavioral2/files/0x000c00000002337d-131.dat	UPX
behavioral2/memory/1220-134-0x00007FF6DAE10000-0x00007FF6DB164000-memory.dmp	UPX
behavioral2/memory/4508-133-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	UPX
behavioral2/memory/3260-135-0x00007FF624F30000-0x00007FF625284000-memory.dmp	UPX
behavioral2/memory/3888-136-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	UPX
behavioral2/memory/4140-137-0x00007FF770910000-0x00007FF770C64000-memory.dmp	UPX
behavioral2/memory/2072-138-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	UPX
behavioral2/memory/1380-139-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	UPX
behavioral2/memory/4176-140-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	UPX
behavioral2/memory/4708-141-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	UPX
behavioral2/memory/4064-142-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	UPX
behavioral2/memory/2292-143-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	UPX
behavioral2/memory/3184-144-0x00007FF619910000-0x00007FF619C64000-memory.dmp	UPX
behavioral2/memory/1636-145-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	UPX
behavioral2/memory/4876-146-0x00007FF671010000-0x00007FF671364000-memory.dmp	UPX
behavioral2/memory/3956-147-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	UPX
behavioral2/memory/3856-148-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5104-0-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/memory/2292-7-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-12.dat	xmrig
behavioral2/files/0x0007000000023410-10.dat	xmrig
behavioral2/memory/3184-14-0x00007FF619910000-0x00007FF619C64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-22.dat	xmrig
behavioral2/memory/1636-25-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	xmrig
behavioral2/memory/4876-26-0x00007FF671010000-0x00007FF671364000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-28.dat	xmrig
behavioral2/memory/3956-30-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-35.dat	xmrig
behavioral2/memory/3856-38-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-41.dat	xmrig
behavioral2/memory/2088-42-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-47.dat	xmrig
behavioral2/files/0x0007000000023416-53.dat	xmrig
behavioral2/memory/2384-54-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	xmrig
behavioral2/memory/1404-50-0x00007FF614170000-0x00007FF6144C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-58.dat	xmrig
behavioral2/memory/4508-72-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-73.dat	xmrig
behavioral2/files/0x0007000000023418-80.dat	xmrig
behavioral2/memory/3888-82-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-95.dat	xmrig
behavioral2/files/0x000700000002341d-96.dat	xmrig
behavioral2/memory/3956-99-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	xmrig
behavioral2/memory/1380-98-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-94.dat	xmrig
behavioral2/memory/2072-93-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	xmrig
behavioral2/memory/4140-91-0x00007FF770910000-0x00007FF770C64000-memory.dmp	xmrig
behavioral2/memory/3184-86-0x00007FF619910000-0x00007FF619C64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-78.dat	xmrig
behavioral2/memory/3260-77-0x00007FF624F30000-0x00007FF625284000-memory.dmp	xmrig
behavioral2/memory/2292-74-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	xmrig
behavioral2/memory/2388-69-0x00007FF74FAF0000-0x00007FF74FE44000-memory.dmp	xmrig
behavioral2/memory/5104-64-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-105.dat	xmrig
behavioral2/memory/4816-110-0x00007FF7DD9E0000-0x00007FF7DDD34000-memory.dmp	xmrig
behavioral2/files/0x0011000000021f87-111.dat	xmrig
behavioral2/memory/4176-113-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	xmrig
behavioral2/memory/2088-112-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	xmrig
behavioral2/files/0x0004000000022978-117.dat	xmrig
behavioral2/memory/2384-125-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	xmrig
behavioral2/files/0x0005000000022ac7-127.dat	xmrig
behavioral2/memory/4064-126-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	xmrig
behavioral2/memory/4708-119-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	xmrig
behavioral2/files/0x000c00000002337d-131.dat	xmrig
behavioral2/memory/1220-134-0x00007FF6DAE10000-0x00007FF6DB164000-memory.dmp	xmrig
behavioral2/memory/4508-133-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	xmrig
behavioral2/memory/3260-135-0x00007FF624F30000-0x00007FF625284000-memory.dmp	xmrig
behavioral2/memory/3888-136-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	xmrig
behavioral2/memory/4140-137-0x00007FF770910000-0x00007FF770C64000-memory.dmp	xmrig
behavioral2/memory/2072-138-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	xmrig
behavioral2/memory/1380-139-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	xmrig
behavioral2/memory/4176-140-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	xmrig
behavioral2/memory/4708-141-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	xmrig
behavioral2/memory/4064-142-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	xmrig
behavioral2/memory/2292-143-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	xmrig
behavioral2/memory/3184-144-0x00007FF619910000-0x00007FF619C64000-memory.dmp	xmrig
behavioral2/memory/1636-145-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	xmrig
behavioral2/memory/4876-146-0x00007FF671010000-0x00007FF671364000-memory.dmp	xmrig
behavioral2/memory/3956-147-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	xmrig
behavioral2/memory/3856-148-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2292	BpdIlWS.exe
3184	SHBpDsT.exe
1636	jiLeNRV.exe
4876	IvhpLsv.exe
3956	yarXqBo.exe
3856	ReNIctR.exe
2088	EkEAEat.exe
1404	xtEsFQk.exe
2384	HFpVRTm.exe
2388	ZQHyMPR.exe
3260	pHGdVcQ.exe
4508	FnvzmZW.exe
3888	HXDZKRa.exe
4140	kswGPrY.exe
2072	RnKMBxP.exe
1380	SgSyKvL.exe
4816	HuPKthf.exe
4176	RfTeOaB.exe
4708	ODSlFrK.exe
4064	rNJttqv.exe
1220	EwmWNpc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5104-0-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/memory/2292-7-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	upx
behavioral2/files/0x000700000002340f-12.dat	upx
behavioral2/files/0x0007000000023410-10.dat	upx
behavioral2/memory/3184-14-0x00007FF619910000-0x00007FF619C64000-memory.dmp	upx
behavioral2/files/0x0007000000023411-22.dat	upx
behavioral2/memory/1636-25-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	upx
behavioral2/memory/4876-26-0x00007FF671010000-0x00007FF671364000-memory.dmp	upx
behavioral2/files/0x0007000000023412-28.dat	upx
behavioral2/memory/3956-30-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	upx
behavioral2/files/0x0007000000023413-35.dat	upx
behavioral2/memory/3856-38-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	upx
behavioral2/files/0x0007000000023414-41.dat	upx
behavioral2/memory/2088-42-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	upx
behavioral2/files/0x0007000000023415-47.dat	upx
behavioral2/files/0x0007000000023416-53.dat	upx
behavioral2/memory/2384-54-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	upx
behavioral2/memory/1404-50-0x00007FF614170000-0x00007FF6144C4000-memory.dmp	upx
behavioral2/files/0x0007000000023417-58.dat	upx
behavioral2/memory/4508-72-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	upx
behavioral2/files/0x000700000002341a-73.dat	upx
behavioral2/files/0x0007000000023418-80.dat	upx
behavioral2/memory/3888-82-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	upx
behavioral2/files/0x000700000002341c-95.dat	upx
behavioral2/files/0x000700000002341d-96.dat	upx
behavioral2/memory/3956-99-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	upx
behavioral2/memory/1380-98-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	upx
behavioral2/files/0x000700000002341b-94.dat	upx
behavioral2/memory/2072-93-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	upx
behavioral2/memory/4140-91-0x00007FF770910000-0x00007FF770C64000-memory.dmp	upx
behavioral2/memory/3184-86-0x00007FF619910000-0x00007FF619C64000-memory.dmp	upx
behavioral2/files/0x0007000000023419-78.dat	upx
behavioral2/memory/3260-77-0x00007FF624F30000-0x00007FF625284000-memory.dmp	upx
behavioral2/memory/2292-74-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	upx
behavioral2/memory/2388-69-0x00007FF74FAF0000-0x00007FF74FE44000-memory.dmp	upx
behavioral2/memory/5104-64-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp	upx
behavioral2/files/0x000700000002341e-105.dat	upx
behavioral2/memory/4816-110-0x00007FF7DD9E0000-0x00007FF7DDD34000-memory.dmp	upx
behavioral2/files/0x0011000000021f87-111.dat	upx
behavioral2/memory/4176-113-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	upx
behavioral2/memory/2088-112-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp	upx
behavioral2/files/0x0004000000022978-117.dat	upx
behavioral2/memory/2384-125-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp	upx
behavioral2/files/0x0005000000022ac7-127.dat	upx
behavioral2/memory/4064-126-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	upx
behavioral2/memory/4708-119-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	upx
behavioral2/files/0x000c00000002337d-131.dat	upx
behavioral2/memory/1220-134-0x00007FF6DAE10000-0x00007FF6DB164000-memory.dmp	upx
behavioral2/memory/4508-133-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp	upx
behavioral2/memory/3260-135-0x00007FF624F30000-0x00007FF625284000-memory.dmp	upx
behavioral2/memory/3888-136-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp	upx
behavioral2/memory/4140-137-0x00007FF770910000-0x00007FF770C64000-memory.dmp	upx
behavioral2/memory/2072-138-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp	upx
behavioral2/memory/1380-139-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp	upx
behavioral2/memory/4176-140-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp	upx
behavioral2/memory/4708-141-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp	upx
behavioral2/memory/4064-142-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp	upx
behavioral2/memory/2292-143-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp	upx
behavioral2/memory/3184-144-0x00007FF619910000-0x00007FF619C64000-memory.dmp	upx
behavioral2/memory/1636-145-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp	upx
behavioral2/memory/4876-146-0x00007FF671010000-0x00007FF671364000-memory.dmp	upx
behavioral2/memory/3956-147-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp	upx
behavioral2/memory/3856-148-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\kswGPrY.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EwmWNpc.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SHBpDsT.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xtEsFQk.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ODSlFrK.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yarXqBo.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ReNIctR.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IvhpLsv.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EkEAEat.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HFpVRTm.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FnvzmZW.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HXDZKRa.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RfTeOaB.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BpdIlWS.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jiLeNRV.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rNJttqv.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SgSyKvL.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RnKMBxP.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HuPKthf.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZQHyMPR.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pHGdVcQ.exe	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2292	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	84
PID 5104 wrote to memory of 2292	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	84
PID 5104 wrote to memory of 3184	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	85
PID 5104 wrote to memory of 3184	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	85
PID 5104 wrote to memory of 1636	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	86
PID 5104 wrote to memory of 1636	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	86
PID 5104 wrote to memory of 4876	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	87
PID 5104 wrote to memory of 4876	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	87
PID 5104 wrote to memory of 3956	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	88
PID 5104 wrote to memory of 3956	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	88
PID 5104 wrote to memory of 3856	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	89
PID 5104 wrote to memory of 3856	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	89
PID 5104 wrote to memory of 2088	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	90
PID 5104 wrote to memory of 2088	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	90
PID 5104 wrote to memory of 1404	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	92
PID 5104 wrote to memory of 1404	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	92
PID 5104 wrote to memory of 2384	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	93
PID 5104 wrote to memory of 2384	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	93
PID 5104 wrote to memory of 2388	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	94
PID 5104 wrote to memory of 2388	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	94
PID 5104 wrote to memory of 3260	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	96
PID 5104 wrote to memory of 3260	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	96
PID 5104 wrote to memory of 4508	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	97
PID 5104 wrote to memory of 4508	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	97
PID 5104 wrote to memory of 3888	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	98
PID 5104 wrote to memory of 3888	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	98
PID 5104 wrote to memory of 4140	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	99
PID 5104 wrote to memory of 4140	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	99
PID 5104 wrote to memory of 1380	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	100
PID 5104 wrote to memory of 1380	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	100
PID 5104 wrote to memory of 2072	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	101
PID 5104 wrote to memory of 2072	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	101
PID 5104 wrote to memory of 4816	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	102
PID 5104 wrote to memory of 4816	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	102
PID 5104 wrote to memory of 4176	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	106
PID 5104 wrote to memory of 4176	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	106
PID 5104 wrote to memory of 4708	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	107
PID 5104 wrote to memory of 4708	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	107
PID 5104 wrote to memory of 4064	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	109
PID 5104 wrote to memory of 4064	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	109
PID 5104 wrote to memory of 1220	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	111
PID 5104 wrote to memory of 1220	5104	2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe	111

C:\Users\Admin\AppData\Local\Temp\2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_dcb4230a34199612d912db956abdd48d_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\System\BpdIlWS.exe
  C:\Windows\System\BpdIlWS.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\SHBpDsT.exe
  C:\Windows\System\SHBpDsT.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\jiLeNRV.exe
  C:\Windows\System\jiLeNRV.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\IvhpLsv.exe
  C:\Windows\System\IvhpLsv.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\yarXqBo.exe
  C:\Windows\System\yarXqBo.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\ReNIctR.exe
  C:\Windows\System\ReNIctR.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\EkEAEat.exe
  C:\Windows\System\EkEAEat.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\xtEsFQk.exe
  C:\Windows\System\xtEsFQk.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\HFpVRTm.exe
  C:\Windows\System\HFpVRTm.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ZQHyMPR.exe
  C:\Windows\System\ZQHyMPR.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\pHGdVcQ.exe
  C:\Windows\System\pHGdVcQ.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\FnvzmZW.exe
  C:\Windows\System\FnvzmZW.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\HXDZKRa.exe
  C:\Windows\System\HXDZKRa.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\kswGPrY.exe
  C:\Windows\System\kswGPrY.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\SgSyKvL.exe
  C:\Windows\System\SgSyKvL.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\RnKMBxP.exe
  C:\Windows\System\RnKMBxP.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\HuPKthf.exe
  C:\Windows\System\HuPKthf.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\RfTeOaB.exe
  C:\Windows\System\RfTeOaB.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\ODSlFrK.exe
  C:\Windows\System\ODSlFrK.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\rNJttqv.exe
  C:\Windows\System\rNJttqv.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\EwmWNpc.exe
  C:\Windows\System\EwmWNpc.exe
  2⤵
  - Executes dropped EXE
  PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BpdIlWS.exe

Path C:\Windows\System\BpdIlWS.exe
Size 5.9MB
SHA256 58daee94056043ca2759d85580fe82d242117a773706d1f1df3d6bdfc02666b9
MD5 8f6a7ac86f06960154e48f5e177c6a55
SHA1 ff95d64bafe9f38d40dd6254bc2a8ab59883279e
SHA512 3e1678f629490944ef6e83714a72f5f8dd4f81d5adcab68c9c0954da9716c94894340f5a2737ab51d1537943d73b38f76152e8287550d31a61d14f09a63839d3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

EkEAEat.exe

Path C:\Windows\System\EkEAEat.exe
Size 5.9MB
SHA256 86a4128057140310c4f710834070818ec31c9414ccee15dd731d24e00678daeb
MD5 1a10f2315f69600d8eaabda22fd403a3
SHA1 1bad39087fb571f74f913fd70d811052dfc469ef
SHA512 1db4ace24984ee0ecb9fd5c3e754b8b71b47a7a21f173eab01e00280bcd0b6a0d872be71eabda7e142227b577bcf4216a9de0a3c436a3b5a82931c58f655cfb8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

EwmWNpc.exe

Path C:\Windows\System\EwmWNpc.exe
Size 5.9MB
SHA256 ebf903e5b63cbf7d503363de5b9446f535ea73065cba1bc3a10f6b2aa59c0451
MD5 3078c2f366ee72ffd1546f85bcb0d083
SHA1 eb729bbd5ff3ab9d8acbf246255915be9ad1170b
SHA512 a61516c7d20753eeb61c01daf299cf4f0154ebba4cec3d602cefac0605d211bbc6e909f41384663ed8afd64c0f3bf47c689021751cc97aa873e72935ec7ac722
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

FnvzmZW.exe

Path C:\Windows\System\FnvzmZW.exe
Size 5.9MB
SHA256 0e72bf4d5d32063cc70b6e542608bbeb2256eaebd88239ad5dbe5dd65866d815
MD5 885ac89e9baa687282ba1eb8fa598fc8
SHA1 a39be646a6f4ae69936e2c77588573ec21427df1
SHA512 b0066d2f531d4a1753f8828d7d16a14cf107f28d2aaa883f888f56b1640487a328f126eec335b1d47b3f6435c43b89cfb7110f927d1acd87f729d0aaf2699611
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFpVRTm.exe

Path C:\Windows\System\HFpVRTm.exe
Size 5.9MB
SHA256 2720ed4582c534e796c8cc62c15c7b05fc320bfecb76aa10f21c046d7ccb354d
MD5 0aa701792f597b6c1c10575f3e6c740b
SHA1 ec5ebe0c8e369f903aa64b721c5a3d2df4eeccaa
SHA512 e3e36faa0f3d87c0d6e98e280725b02f8d9502e2a74f3a2265a1b77e735b25d31164bf7c88107bbf3103fe1a16601ece6bf456f2a683c7e11e9b2df230b92878
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

HXDZKRa.exe

Path C:\Windows\System\HXDZKRa.exe
Size 5.9MB
SHA256 8df38f2fe389cac88fe21eaaed054f3763c9c7e019425a93f804e89db60f900b
MD5 2bf0204f23edfd3b3685d4db3094c064
SHA1 2fd9df8f030cfa98a914bfebd8d04e23899fa27e
SHA512 5cd3bfd632a17cc6a47a806abaafd8f551b3f9c24f9661441aab2f26eb911d30d570ef29a5f7a5991371c98953c1ff98300edbc178908071b54612972cd91b8f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

HuPKthf.exe

Path C:\Windows\System\HuPKthf.exe
Size 5.9MB
SHA256 cf1f5eff33e71565a581b2194ebffd6603a852048ea8e9ad6237ff83a4c54b7c
MD5 d469877ab18e136e55e3c87d997a33bc
SHA1 9a640c4dc2ee351d43b67d563bfb4ea97b25b105
SHA512 91916822636c79c6f29e36f04b53aef14ca590f1156bb303eb1ec7b8498e2613ceb2affce65813aac0c04a2d998bd9f436a507983bdd927f07f2fa089703f68b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

IvhpLsv.exe

Path C:\Windows\System\IvhpLsv.exe
Size 5.9MB
SHA256 5903f02897682c1fe4e5dd7c1ba782b36f578e681e669c6adda34f0a0fd966ed
MD5 97dc7505412aa64e7f3e6b8414684019
SHA1 fb6dd04517084ecdcd605b92a00763c8a1566385
SHA512 992e86916c02e596e8c7edfb397e9d7b392e2a4871af19b4f079203caf32a1e35e97b537ac38700d9dd3e9de17b25cfcfc256f173c00b4022453595302874f9a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODSlFrK.exe

Path C:\Windows\System\ODSlFrK.exe
Size 5.9MB
SHA256 5dfbc738d1a2e486147a45f5f30357bda342720d071a979f1e6f3d1f9fbbb809
MD5 c30e52a6e5fa0eb40548dbd42d97e4eb
SHA1 83678a65cbb44fa7b1cd77179c50af7530457f67
SHA512 8d8c84169b05e7f093d9457abdc04a69a2acc3761aebe6149fb9c1357746afb250fac10e37ff286f3c690be9319f891a5e08ed8ff1a0612735e98a0ac7bd4ca0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReNIctR.exe

Path C:\Windows\System\ReNIctR.exe
Size 5.9MB
SHA256 84c7af10794d04b24719aaa3f80e6d38423ae6a8234fd786ffd65a41be34d457
MD5 569b269c61dd5da7560b7ce0b7619c92
SHA1 e1536de90aa4c34f1b2a309643e4aaae01cf6d4f
SHA512 40bb7dfe1f80b1811f6be1e69cfdb3edf2d729249fde5f46be2227b0694039887449cac40197af76ff02d3f1e6a4663caa33971ebad4e33b3537c3d0b3f426ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

RfTeOaB.exe

Path C:\Windows\System\RfTeOaB.exe
Size 5.9MB
SHA256 eba5963aa5be215d7750e2634c74c2468aa2397430d445559c3773733a0b4e28
MD5 de36c2cacff944ca0d243afd78b4582a
SHA1 e9eda7c4dc09b72bae36f514a12f97c671ccd678
SHA512 52e900963e19de1ba9d97a0566a59a01c4e86d436d4168e29db621d71c9fe00fb9fdc3ccf3a46510ec1edaa83ebe6739df320de14a0977c066ccb2bfd7f9f6ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

RnKMBxP.exe

Path C:\Windows\System\RnKMBxP.exe
Size 5.9MB
SHA256 aed6990d278c3eae86f2ed7be84710b14e0c71d77e43c825e8ce35b3282b6c3d
MD5 42b02aaf49ccbe7fb97dfdadc37365ba
SHA1 1c016e35145a85b553ccff634445dc18b30451b8
SHA512 8f956a45f0d9e90c5fac66504fd803f363ab389b52900a2155ccd2529bded78cc5755f7fe444aa6a1cd46826bde3f9d8b9154850477701ddcade4c60647f23f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHBpDsT.exe

Path C:\Windows\System\SHBpDsT.exe
Size 5.9MB
SHA256 168ae97a3eaafbd9b9749d2ae05046ad53f398f5488baaf081694d80b7291dcc
MD5 200db842ac6216b0ea2c9f16211837f6
SHA1 fdd5837fb2c55d3dfde87b5d2d0323177c88366a
SHA512 815a7bf6e3fb01f64f1c3c03e04e914f95d4b53b5a81821f6bf1ef8fa03facdc6a74b287c5d3d2cb61ce95860f924c290a8205717c16be517126b60b39ceb604
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgSyKvL.exe

Path C:\Windows\System\SgSyKvL.exe
Size 5.9MB
SHA256 e8632a3c1053ff507f90318c632f7d1a9e2f94a04b48f78cdcfed29c94f6bd54
MD5 10bcfb675a578a936d7937f7c6ee542d
SHA1 75dafeff18bfd69d3638ffd33d9335f7d66bbadf
SHA512 249f19884720602902815864d290d05854d1f7d93aa52e9eb0fac7a059a23253059c6ef9a8bb4c56a1b0a30db0282b19ec205e335c9d29971202682eed2ddf7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQHyMPR.exe

Path C:\Windows\System\ZQHyMPR.exe
Size 5.9MB
SHA256 318809eaa84f7caec5499ae2c4bcf32387b8b6d4e96e3e753d6885fdeb0f0271
MD5 37688faa72d84feb57ec28b5e1d7bd7e
SHA1 b102a0b4562a67d45e4f3ba74ac7ab9974aaa47b
SHA512 0b380381bf33edbff6f4e85ea0af8d7c9084077f01bf06a383e48cf1ab6be1ec0f427231c916fd95f2a539dfda1909171b6e6727ac8a0c973ea76c3ac9bd9a8f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

jiLeNRV.exe

Path C:\Windows\System\jiLeNRV.exe
Size 5.9MB
SHA256 e6af57f514dae907ff55d60ce468f231db8f82dbb341153de56e0554c899b7b9
MD5 bf79a61b266fd196acd20a1afbb2afa1
SHA1 caeb716a4e95b4249da0b84fe894a8878f9c4a20
SHA512 d37c0417098759069796fe608331c1b290312fa8fec86f83fee35db521eb9ac1f6ee524467a38f92db2654b57fcb6082f6fdceceee02af67e147f35ab5b6e62a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

kswGPrY.exe

Path C:\Windows\System\kswGPrY.exe
Size 5.9MB
SHA256 2ee543f9b069a02b44a672f32d063dae443ae77d1382f6ecf9d1016a85e349e3
MD5 7a7cf50bd1706482030d6086903cad41
SHA1 fd1b9000aa352ea70836d97c7b1a9277f35ebabc
SHA512 772cb2b8a360a97ca5a05599b028b9ac6ada4577013ce9aa77614171a0c3243be0dfe7392aeda9b5c89ae30f4bae6254448848d3cb38b3f6a27a18a89b99f2bc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHGdVcQ.exe

Path C:\Windows\System\pHGdVcQ.exe
Size 5.9MB
SHA256 b27edb74f6fdc2ddaf0ab349e73f29c6d972d5aac7e64c119a5328c9c5d1ab4b
MD5 c20760546402bdf70870324055792388
SHA1 d8972859a01e3f9071740ec79739b5f6d899bb45
SHA512 d1ea25aa72dfd92173c8ce3fcb914ea1caa07929c2f2bec2cc87c42860bd5884537ddd56baa84d0f7f213728909b9e143de9fe90de5db69dde38395ca8354867
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

rNJttqv.exe

Path C:\Windows\System\rNJttqv.exe
Size 5.9MB
SHA256 6615cbf5148c1e5a0f81da604d1428d23aa74bdf15f48449079da585916b644d
MD5 7a4cc78b65f18106a0605a0b6880fe9b
SHA1 2dd6c0e25ae638ffc83c730c3c41790997b2605c
SHA512 246bf7d6630b0c6b900021d33867d1a2d6b237dc2dcc2fb14d9e264985c1dc4df87f643ece25f632efb61dab1ce940870bbbbc924d6febbdafb1a52051d16e5f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

xtEsFQk.exe

Path C:\Windows\System\xtEsFQk.exe
Size 5.9MB
SHA256 9d383803842536c9b219c133ba8610d08881106db416b008a19a7794a8010a4e
MD5 475cbb6ba3cd5257258607e06ad2ceba
SHA1 6ad0da43aaa7fa8cb91230b220ae011c8097ca8a
SHA512 24ecf7180506da0f2cc3a7c7e72d7c29fd0950c967cd4246684cc48e8eae7a1418cc697b0e0a9565cb4c788686540fefd0c39f34d4d6a79a940fc6c7514b9b82
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

yarXqBo.exe

Path C:\Windows\System\yarXqBo.exe
Size 5.9MB
SHA256 59d2dc18960da61f805fb6793652502468cdd4395c92429f211cc9b5353c4401
MD5 9e4695cdde22e061ef21d1056429b2b5
SHA1 08587a4ca569f2209e3538addd485b59e903ef00
SHA512 9f2580341355e1ee5cac2eae48f21c84f7a3996d41c19d3d2386c4959b3ca0097c28c12a603e85c94ee5d24bec4168a0eff2424bf10c95227e25d034e6cb4455
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-134-0x00007FF6DAE10000-0x00007FF6DB164000-memory.dmp

Download

memory/1220-163-0x00007FF6DAE10000-0x00007FF6DB164000-memory.dmp

Download

memory/1380-139-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp

Download

memory/1380-98-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp

Download

memory/1380-156-0x00007FF6DC0C0000-0x00007FF6DC414000-memory.dmp

Download

memory/1404-50-0x00007FF614170000-0x00007FF6144C4000-memory.dmp

Download

memory/1404-150-0x00007FF614170000-0x00007FF6144C4000-memory.dmp

Download

memory/1636-145-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp

Download

memory/1636-25-0x00007FF76A7D0000-0x00007FF76AB24000-memory.dmp

Download

memory/2072-138-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp

Download

memory/2072-93-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp

Download

memory/2072-158-0x00007FF77C4F0000-0x00007FF77C844000-memory.dmp

Download

memory/2088-42-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp

Download

memory/2088-149-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp

Download

memory/2088-112-0x00007FF6E9FB0000-0x00007FF6EA304000-memory.dmp

Download

memory/2292-143-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp

Download

memory/2292-7-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp

Download

memory/2292-74-0x00007FF7627F0000-0x00007FF762B44000-memory.dmp

Download

memory/2384-125-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp

Download

memory/2384-54-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp

Download

memory/2384-151-0x00007FF7BDCE0000-0x00007FF7BE034000-memory.dmp

Download

memory/2388-69-0x00007FF74FAF0000-0x00007FF74FE44000-memory.dmp

Download

memory/2388-152-0x00007FF74FAF0000-0x00007FF74FE44000-memory.dmp

Download

memory/3184-86-0x00007FF619910000-0x00007FF619C64000-memory.dmp

Download

memory/3184-144-0x00007FF619910000-0x00007FF619C64000-memory.dmp

Download

memory/3184-14-0x00007FF619910000-0x00007FF619C64000-memory.dmp

Download

memory/3260-153-0x00007FF624F30000-0x00007FF625284000-memory.dmp

Download

memory/3260-77-0x00007FF624F30000-0x00007FF625284000-memory.dmp

Download

memory/3260-135-0x00007FF624F30000-0x00007FF625284000-memory.dmp

Download

memory/3856-148-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp

Download

memory/3856-38-0x00007FF6D9ED0000-0x00007FF6DA224000-memory.dmp

Download

memory/3888-82-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp

Download

memory/3888-136-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp

Download

memory/3888-154-0x00007FF6F2840000-0x00007FF6F2B94000-memory.dmp

Download

memory/3956-30-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp

Download

memory/3956-147-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp

Download

memory/3956-99-0x00007FF68FC90000-0x00007FF68FFE4000-memory.dmp

Download

memory/4064-142-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp

Download

memory/4064-162-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp

Download

memory/4064-126-0x00007FF7A8FC0000-0x00007FF7A9314000-memory.dmp

Download

memory/4140-91-0x00007FF770910000-0x00007FF770C64000-memory.dmp

Download

memory/4140-157-0x00007FF770910000-0x00007FF770C64000-memory.dmp

Download

memory/4140-137-0x00007FF770910000-0x00007FF770C64000-memory.dmp

Download

memory/4176-140-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp

Download

memory/4176-160-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp

Download

memory/4176-113-0x00007FF7FD8F0000-0x00007FF7FDC44000-memory.dmp

Download

memory/4508-72-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp

Download

memory/4508-155-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp

Download

memory/4508-133-0x00007FF71FDE0000-0x00007FF720134000-memory.dmp

Download

memory/4708-119-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp

Download

memory/4708-141-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp

Download

memory/4708-161-0x00007FF603AB0000-0x00007FF603E04000-memory.dmp

Download

memory/4816-159-0x00007FF7DD9E0000-0x00007FF7DDD34000-memory.dmp

Download

memory/4816-110-0x00007FF7DD9E0000-0x00007FF7DDD34000-memory.dmp

Download

memory/4876-26-0x00007FF671010000-0x00007FF671364000-memory.dmp

Download

memory/4876-146-0x00007FF671010000-0x00007FF671364000-memory.dmp

Download

memory/5104-0-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp

Download

memory/5104-64-0x00007FF6789F0000-0x00007FF678D44000-memory.dmp

Download

memory/5104-1-0x000001342B110000-0x000001342B120000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads