cobaltstrike | 5c55e0bee233057766789deae731c7668bf0ffb43687c5e8c603d5206fadafac

Analysis

max time kernel
124s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-wa9k2aaa4w
SHA256 5c55e0bee233057766789deae731c7668bf0ffb43687c5e8c603d5206fadafac
MD5 08d474d351c6ca54deb133e54d279402
SHA1 371a416faff00809b94f1e8895dc86cea57537e1
SHA512 bfe043d80418c7d12969c300cfc293d4d15c77fc0eccbf7b57f190817e6b37e000d07aaa545cbdbda44e16e9d37de4f04f154dc70004ca59031fa5acc6cf539a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0009000000023595-4.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002359d-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002359f-25.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002359e-26.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a0-37.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a1-40.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a2-46.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a4-57.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a6-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a8-76.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a9-81.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235aa-87.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ab-92.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235af-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ae-109.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ad-104.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ac-99.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a7-74.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a5-65.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235a3-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002359c-13.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023595-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002359d-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002359f-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002359e-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a0-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a1-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a2-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a4-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a6-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a8-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a9-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235aa-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ab-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235af-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ae-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ad-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ac-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a7-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a5-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235a3-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002359c-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	UPX
behavioral2/files/0x0009000000023595-4.dat	UPX
behavioral2/memory/1336-6-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	UPX
behavioral2/files/0x000700000002359d-10.dat	UPX
behavioral2/files/0x000700000002359f-25.dat	UPX
behavioral2/files/0x000700000002359e-26.dat	UPX
behavioral2/memory/3056-30-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	UPX
behavioral2/memory/4480-35-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	UPX
behavioral2/files/0x00070000000235a0-37.dat	UPX
behavioral2/files/0x00070000000235a1-40.dat	UPX
behavioral2/files/0x00070000000235a2-46.dat	UPX
behavioral2/files/0x00070000000235a4-57.dat	UPX
behavioral2/files/0x00070000000235a6-64.dat	UPX
behavioral2/files/0x00070000000235a8-76.dat	UPX
behavioral2/files/0x00070000000235a9-81.dat	UPX
behavioral2/files/0x00070000000235aa-87.dat	UPX
behavioral2/files/0x00070000000235ab-92.dat	UPX
behavioral2/files/0x00070000000235af-111.dat	UPX
behavioral2/files/0x00070000000235ae-109.dat	UPX
behavioral2/files/0x00070000000235ad-104.dat	UPX
behavioral2/files/0x00070000000235ac-99.dat	UPX
behavioral2/files/0x00070000000235a7-74.dat	UPX
behavioral2/files/0x00070000000235a5-65.dat	UPX
behavioral2/files/0x00070000000235a3-55.dat	UPX
behavioral2/memory/2308-36-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	UPX
behavioral2/memory/1136-33-0x00007FF679600000-0x00007FF679954000-memory.dmp	UPX
behavioral2/files/0x000700000002359c-13.dat	UPX
behavioral2/memory/2328-12-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	UPX
behavioral2/memory/2548-114-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	UPX
behavioral2/memory/4896-113-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	UPX
behavioral2/memory/3400-115-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	UPX
behavioral2/memory/1332-116-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	UPX
behavioral2/memory/2000-117-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	UPX
behavioral2/memory/2844-118-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	UPX
behavioral2/memory/4648-119-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	UPX
behavioral2/memory/4936-121-0x00007FF602240000-0x00007FF602594000-memory.dmp	UPX
behavioral2/memory/4224-122-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	UPX
behavioral2/memory/1088-120-0x00007FF7E7C60000-0x00007FF7E7FB4000-memory.dmp	UPX
behavioral2/memory/4612-123-0x00007FF602730000-0x00007FF602A84000-memory.dmp	UPX
behavioral2/memory/4252-124-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	UPX
behavioral2/memory/3092-125-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	UPX
behavioral2/memory/960-126-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	UPX
behavioral2/memory/4436-127-0x00007FF68D160000-0x00007FF68D4B4000-memory.dmp	UPX
behavioral2/memory/1912-128-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	UPX
behavioral2/memory/1336-129-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	UPX
behavioral2/memory/2328-130-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	UPX
behavioral2/memory/1336-131-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	UPX
behavioral2/memory/2328-132-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	UPX
behavioral2/memory/3056-133-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	UPX
behavioral2/memory/4480-134-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	UPX
behavioral2/memory/4896-136-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	UPX
behavioral2/memory/2308-135-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	UPX
behavioral2/memory/2548-138-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	UPX
behavioral2/memory/1332-140-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	UPX
behavioral2/memory/3400-139-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	UPX
behavioral2/memory/1136-137-0x00007FF679600000-0x00007FF679954000-memory.dmp	UPX
behavioral2/memory/960-145-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	UPX
behavioral2/memory/4224-143-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	UPX
behavioral2/memory/3092-151-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	UPX
behavioral2/memory/4252-150-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	UPX
behavioral2/memory/2844-149-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	UPX
behavioral2/memory/2000-148-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	UPX
behavioral2/memory/4648-147-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	UPX
behavioral2/memory/4936-146-0x00007FF602240000-0x00007FF602594000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023595-4.dat	xmrig
behavioral2/memory/1336-6-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	xmrig
behavioral2/files/0x000700000002359d-10.dat	xmrig
behavioral2/files/0x000700000002359f-25.dat	xmrig
behavioral2/files/0x000700000002359e-26.dat	xmrig
behavioral2/memory/3056-30-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	xmrig
behavioral2/memory/4480-35-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235a0-37.dat	xmrig
behavioral2/files/0x00070000000235a1-40.dat	xmrig
behavioral2/files/0x00070000000235a2-46.dat	xmrig
behavioral2/files/0x00070000000235a4-57.dat	xmrig
behavioral2/files/0x00070000000235a6-64.dat	xmrig
behavioral2/files/0x00070000000235a8-76.dat	xmrig
behavioral2/files/0x00070000000235a9-81.dat	xmrig
behavioral2/files/0x00070000000235aa-87.dat	xmrig
behavioral2/files/0x00070000000235ab-92.dat	xmrig
behavioral2/files/0x00070000000235af-111.dat	xmrig
behavioral2/files/0x00070000000235ae-109.dat	xmrig
behavioral2/files/0x00070000000235ad-104.dat	xmrig
behavioral2/files/0x00070000000235ac-99.dat	xmrig
behavioral2/files/0x00070000000235a7-74.dat	xmrig
behavioral2/files/0x00070000000235a5-65.dat	xmrig
behavioral2/files/0x00070000000235a3-55.dat	xmrig
behavioral2/memory/2308-36-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	xmrig
behavioral2/memory/1136-33-0x00007FF679600000-0x00007FF679954000-memory.dmp	xmrig
behavioral2/files/0x000700000002359c-13.dat	xmrig
behavioral2/memory/2328-12-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	xmrig
behavioral2/memory/2548-114-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	xmrig
behavioral2/memory/4896-113-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	xmrig
behavioral2/memory/3400-115-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	xmrig
behavioral2/memory/1332-116-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	xmrig
behavioral2/memory/2000-117-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	xmrig
behavioral2/memory/2844-118-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	xmrig
behavioral2/memory/4648-119-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	xmrig
behavioral2/memory/4936-121-0x00007FF602240000-0x00007FF602594000-memory.dmp	xmrig
behavioral2/memory/4224-122-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	xmrig
behavioral2/memory/1088-120-0x00007FF7E7C60000-0x00007FF7E7FB4000-memory.dmp	xmrig
behavioral2/memory/4612-123-0x00007FF602730000-0x00007FF602A84000-memory.dmp	xmrig
behavioral2/memory/4252-124-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	xmrig
behavioral2/memory/3092-125-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	xmrig
behavioral2/memory/960-126-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	xmrig
behavioral2/memory/4436-127-0x00007FF68D160000-0x00007FF68D4B4000-memory.dmp	xmrig
behavioral2/memory/1912-128-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	xmrig
behavioral2/memory/1336-129-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	xmrig
behavioral2/memory/2328-130-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	xmrig
behavioral2/memory/1336-131-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	xmrig
behavioral2/memory/2328-132-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	xmrig
behavioral2/memory/3056-133-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	xmrig
behavioral2/memory/4480-134-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	xmrig
behavioral2/memory/4896-136-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	xmrig
behavioral2/memory/2308-135-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	xmrig
behavioral2/memory/2548-138-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	xmrig
behavioral2/memory/1332-140-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	xmrig
behavioral2/memory/3400-139-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	xmrig
behavioral2/memory/1136-137-0x00007FF679600000-0x00007FF679954000-memory.dmp	xmrig
behavioral2/memory/960-145-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	xmrig
behavioral2/memory/4224-143-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	xmrig
behavioral2/memory/3092-151-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	xmrig
behavioral2/memory/4252-150-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	xmrig
behavioral2/memory/2844-149-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	xmrig
behavioral2/memory/2000-148-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	xmrig
behavioral2/memory/4648-147-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	xmrig
behavioral2/memory/4936-146-0x00007FF602240000-0x00007FF602594000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1336	pMXiTJb.exe
2328	LTLmwin.exe
3056	mGSkOQT.exe
4480	XrIbcXR.exe
1136	rWtSlOE.exe
2308	lZDCuyW.exe
4896	snTmaCh.exe
2548	teigcii.exe
3400	WBogabM.exe
1332	vlWdhKl.exe
2000	ovozBtk.exe
2844	MqDLcbi.exe
4648	oLguAxC.exe
1088	rYwhBZs.exe
4936	BeJWbrb.exe
4224	rHOWdsc.exe
4612	MOjDXqf.exe
4252	zAgpMVQ.exe
3092	peETOjX.exe
960	IMUHWXc.exe
4436	tuzGVSo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	upx
behavioral2/files/0x0009000000023595-4.dat	upx
behavioral2/memory/1336-6-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	upx
behavioral2/files/0x000700000002359d-10.dat	upx
behavioral2/files/0x000700000002359f-25.dat	upx
behavioral2/files/0x000700000002359e-26.dat	upx
behavioral2/memory/3056-30-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	upx
behavioral2/memory/4480-35-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	upx
behavioral2/files/0x00070000000235a0-37.dat	upx
behavioral2/files/0x00070000000235a1-40.dat	upx
behavioral2/files/0x00070000000235a2-46.dat	upx
behavioral2/files/0x00070000000235a4-57.dat	upx
behavioral2/files/0x00070000000235a6-64.dat	upx
behavioral2/files/0x00070000000235a8-76.dat	upx
behavioral2/files/0x00070000000235a9-81.dat	upx
behavioral2/files/0x00070000000235aa-87.dat	upx
behavioral2/files/0x00070000000235ab-92.dat	upx
behavioral2/files/0x00070000000235af-111.dat	upx
behavioral2/files/0x00070000000235ae-109.dat	upx
behavioral2/files/0x00070000000235ad-104.dat	upx
behavioral2/files/0x00070000000235ac-99.dat	upx
behavioral2/files/0x00070000000235a7-74.dat	upx
behavioral2/files/0x00070000000235a5-65.dat	upx
behavioral2/files/0x00070000000235a3-55.dat	upx
behavioral2/memory/2308-36-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	upx
behavioral2/memory/1136-33-0x00007FF679600000-0x00007FF679954000-memory.dmp	upx
behavioral2/files/0x000700000002359c-13.dat	upx
behavioral2/memory/2328-12-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	upx
behavioral2/memory/2548-114-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	upx
behavioral2/memory/4896-113-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	upx
behavioral2/memory/3400-115-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	upx
behavioral2/memory/1332-116-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	upx
behavioral2/memory/2000-117-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	upx
behavioral2/memory/2844-118-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	upx
behavioral2/memory/4648-119-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	upx
behavioral2/memory/4936-121-0x00007FF602240000-0x00007FF602594000-memory.dmp	upx
behavioral2/memory/4224-122-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	upx
behavioral2/memory/1088-120-0x00007FF7E7C60000-0x00007FF7E7FB4000-memory.dmp	upx
behavioral2/memory/4612-123-0x00007FF602730000-0x00007FF602A84000-memory.dmp	upx
behavioral2/memory/4252-124-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	upx
behavioral2/memory/3092-125-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	upx
behavioral2/memory/960-126-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	upx
behavioral2/memory/4436-127-0x00007FF68D160000-0x00007FF68D4B4000-memory.dmp	upx
behavioral2/memory/1912-128-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp	upx
behavioral2/memory/1336-129-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	upx
behavioral2/memory/2328-130-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	upx
behavioral2/memory/1336-131-0x00007FF698ED0000-0x00007FF699224000-memory.dmp	upx
behavioral2/memory/2328-132-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp	upx
behavioral2/memory/3056-133-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp	upx
behavioral2/memory/4480-134-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp	upx
behavioral2/memory/4896-136-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp	upx
behavioral2/memory/2308-135-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp	upx
behavioral2/memory/2548-138-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp	upx
behavioral2/memory/1332-140-0x00007FF694C10000-0x00007FF694F64000-memory.dmp	upx
behavioral2/memory/3400-139-0x00007FF713170000-0x00007FF7134C4000-memory.dmp	upx
behavioral2/memory/1136-137-0x00007FF679600000-0x00007FF679954000-memory.dmp	upx
behavioral2/memory/960-145-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp	upx
behavioral2/memory/4224-143-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp	upx
behavioral2/memory/3092-151-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp	upx
behavioral2/memory/4252-150-0x00007FF7655F0000-0x00007FF765944000-memory.dmp	upx
behavioral2/memory/2844-149-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp	upx
behavioral2/memory/2000-148-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp	upx
behavioral2/memory/4648-147-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp	upx
behavioral2/memory/4936-146-0x00007FF602240000-0x00007FF602594000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\BeJWbrb.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MOjDXqf.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zAgpMVQ.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pMXiTJb.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\snTmaCh.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rYwhBZs.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oLguAxC.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IMUHWXc.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mGSkOQT.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\teigcii.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WBogabM.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MqDLcbi.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rHOWdsc.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\peETOjX.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lZDCuyW.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vlWdhKl.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ovozBtk.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tuzGVSo.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LTLmwin.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XrIbcXR.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rWtSlOE.exe	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1336	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	93
PID 1912 wrote to memory of 1336	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	93
PID 1912 wrote to memory of 2328	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	94
PID 1912 wrote to memory of 2328	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	94
PID 1912 wrote to memory of 3056	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	95
PID 1912 wrote to memory of 3056	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	95
PID 1912 wrote to memory of 4480	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	96
PID 1912 wrote to memory of 4480	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	96
PID 1912 wrote to memory of 1136	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	97
PID 1912 wrote to memory of 1136	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	97
PID 1912 wrote to memory of 2308	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	98
PID 1912 wrote to memory of 2308	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	98
PID 1912 wrote to memory of 4896	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	99
PID 1912 wrote to memory of 4896	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	99
PID 1912 wrote to memory of 2548	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	100
PID 1912 wrote to memory of 2548	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	100
PID 1912 wrote to memory of 3400	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	101
PID 1912 wrote to memory of 3400	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	101
PID 1912 wrote to memory of 1332	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	102
PID 1912 wrote to memory of 1332	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	102
PID 1912 wrote to memory of 2000	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	103
PID 1912 wrote to memory of 2000	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	103
PID 1912 wrote to memory of 2844	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	104
PID 1912 wrote to memory of 2844	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	104
PID 1912 wrote to memory of 4648	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	105
PID 1912 wrote to memory of 4648	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	105
PID 1912 wrote to memory of 1088	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	106
PID 1912 wrote to memory of 1088	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	106
PID 1912 wrote to memory of 4936	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	107
PID 1912 wrote to memory of 4936	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	107
PID 1912 wrote to memory of 4224	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	108
PID 1912 wrote to memory of 4224	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	108
PID 1912 wrote to memory of 4612	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	109
PID 1912 wrote to memory of 4612	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	109
PID 1912 wrote to memory of 4252	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	110
PID 1912 wrote to memory of 4252	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	110
PID 1912 wrote to memory of 3092	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	111
PID 1912 wrote to memory of 3092	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	111
PID 1912 wrote to memory of 960	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	112
PID 1912 wrote to memory of 960	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	112
PID 1912 wrote to memory of 4436	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	113
PID 1912 wrote to memory of 4436	1912	2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_08d474d351c6ca54deb133e54d279402_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\System\pMXiTJb.exe
  C:\Windows\System\pMXiTJb.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\LTLmwin.exe
  C:\Windows\System\LTLmwin.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\mGSkOQT.exe
  C:\Windows\System\mGSkOQT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\XrIbcXR.exe
  C:\Windows\System\XrIbcXR.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\rWtSlOE.exe
  C:\Windows\System\rWtSlOE.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\lZDCuyW.exe
  C:\Windows\System\lZDCuyW.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\snTmaCh.exe
  C:\Windows\System\snTmaCh.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\teigcii.exe
  C:\Windows\System\teigcii.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\WBogabM.exe
  C:\Windows\System\WBogabM.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\vlWdhKl.exe
  C:\Windows\System\vlWdhKl.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\ovozBtk.exe
  C:\Windows\System\ovozBtk.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\MqDLcbi.exe
  C:\Windows\System\MqDLcbi.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\oLguAxC.exe
  C:\Windows\System\oLguAxC.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\rYwhBZs.exe
  C:\Windows\System\rYwhBZs.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\BeJWbrb.exe
  C:\Windows\System\BeJWbrb.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\rHOWdsc.exe
  C:\Windows\System\rHOWdsc.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\MOjDXqf.exe
  C:\Windows\System\MOjDXqf.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\zAgpMVQ.exe
  C:\Windows\System\zAgpMVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\peETOjX.exe
  C:\Windows\System\peETOjX.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\IMUHWXc.exe
  C:\Windows\System\IMUHWXc.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\tuzGVSo.exe
  C:\Windows\System\tuzGVSo.exe
  2⤵
  - Executes dropped EXE
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
1⤵
PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BeJWbrb.exe

Path C:\Windows\System\BeJWbrb.exe
Size 5.9MB
SHA256 1eb68693c2b27405f4f57d6e3abfd3f631149a710d646b5a9041942d6eb9102a
MD5 e354ed55bb41855d44dc433f9814b54a
SHA1 63d21d0136ceea721a7dac48b4df5b9180fc5ab1
SHA512 8f066a332dffc6b34979f1131cd4e8b10817424c2a83df5c01c4a6538302ef39fd7b5d328d5f491443f54321c6db340dfd4c14097aa7846900333665c8ba6049
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMUHWXc.exe

Path C:\Windows\System\IMUHWXc.exe
Size 5.9MB
SHA256 3d0f5fec28cba59f38577b64db915295d8a0c72902a9e54fec1307a512be6167
MD5 ecf9303fdbc5f9277453b75cd0f24ce6
SHA1 eaef13c4466d10a22c2cc81c874746763df0678a
SHA512 a5e047c0e9ad133dcdc06cb0e86c67b7e0eae317d30a0e7ccf2a1dc6bf9e84402946cc6430111b3191897940d9a1c61fbbac092170bd42679ab8b7c8ed9c27a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTLmwin.exe

Path C:\Windows\System\LTLmwin.exe
Size 5.9MB
SHA256 6a164f0c721b1b63b640e9b70eb43b8f528f056b39c2be5395b2e521af7a1feb
MD5 2eee7ffe787e2deb3cf6e0daf87a39c7
SHA1 e6dc12cc2c770099a6fbc459001449a38993c335
SHA512 8bde0d821f8986994d9a8cb03400ca99265214878256116ea807da304e6157f0ebeffc267ad379c86d79d2d8e5958fe950537bbeaa9ebb2b8c2277b3f51476ee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

MOjDXqf.exe

Path C:\Windows\System\MOjDXqf.exe
Size 5.9MB
SHA256 64dce23ab4bfa3adaffc16a00be9343769cbba4d0f4162ee914f889305efc404
MD5 ee394babf011886b36bce35cf2c2a033
SHA1 4a9ef45d03cdea14b1a63e8c544f83d2fd610dc9
SHA512 f8afb50312aa4cdc995eeca52d642ac210b79b308e234dcfb2d749446c2e920f3f85cf5471e03ef1506f9fadb959c54be5426490d20b6f563950cd1ace7af37c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

MqDLcbi.exe

Path C:\Windows\System\MqDLcbi.exe
Size 5.9MB
SHA256 23e7d0186a9c4dedae3869da592cd692bd111e313f03474d8c05b09442f52fca
MD5 228e72cd05b75e3abecee4359e944dff
SHA1 0082dc53a429d6177d678bdc209b18e15af5c962
SHA512 0bdfb1c91e49c25fd726a388f44e1e834f0ebd9eb4c7a112f392982143b1c69c088aa36e111193eb3053a8a2fd2c910941409ba00cc688fdf573f1ae97f8d938
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

WBogabM.exe

Path C:\Windows\System\WBogabM.exe
Size 5.9MB
SHA256 40c45dff463df871442a513216c2cbaa9cea8aceb1d500b2c3ceaa96bd61735b
MD5 7ab885979e0ac610b517c4912ef429c8
SHA1 7fcf5b7c0b5830fde4ae92fb666bc83b97d87455
SHA512 d643ae1f86c905ac26258847fc97c858ed23952dbad025e7b373b71b06bc246baa6917048e389790651e8ce99b90ffeb0bc6bb84adddd89d3913898fb78c7200
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

XrIbcXR.exe

Path C:\Windows\System\XrIbcXR.exe
Size 5.9MB
SHA256 6a95c7127bd0df8fa6716d25df560da59e4ee68a9f97c92543b0eaa75a04c786
MD5 cff3065bd2b1c735d373fcc0ee0e0599
SHA1 7f7145b1484722094ccc44c59880a546409ea0c0
SHA512 ccf8b2bdb3b2eaf57b4983317f33b971ff3f918c4fd0a6ba9c4af7328a1d43dccdbb0804a1db59f99f53dd181e3581a5127710c00ba9f91612e26b0c0c885637
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

lZDCuyW.exe

Path C:\Windows\System\lZDCuyW.exe
Size 5.9MB
SHA256 e40fbea0622d2694027dd1ba24909dc002e31111469a34da3aa9dc859727fcdc
MD5 9f7e1fac919e8751798729724ae03cea
SHA1 7a0daeebb6157adbf5e0dc1ea5cfc3eb4210376f
SHA512 d4f4a479bac4e52f71c4f4f731a7826e436b52c59abdc9d1820a73679c92dd294f461cfe1844028b11d649645e0f539b1646bc85c8bfc3f9f1b57bd8dc7e211d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

mGSkOQT.exe

Path C:\Windows\System\mGSkOQT.exe
Size 5.9MB
SHA256 4b3d2b04abd769d26f6b121cd90e5557bf868e361d2f812197f1d4b87a852498
MD5 b2eb03bfe9f0c0b80c8d4ff242c307a7
SHA1 971d97a99b349ecc1f2bb70e98a75a084607b0de
SHA512 38be2fa506021d3d1a6b5d6f432397780e77fbf6db3d33d43530afeaddf0c4122b2c2c7cfff9a295e1dcb676caf453a1d6f9d078867ed3b67c4de6f9b46cf7f4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

oLguAxC.exe

Path C:\Windows\System\oLguAxC.exe
Size 5.9MB
SHA256 d10526464243f4d49439a7df833fddf8756bef131c3fd82d0513ceaf16998ba1
MD5 61c29ef88fb302306660dfe003b2412d
SHA1 5a9ae64b84dea0eff24c01d6c74e92292c673057
SHA512 f0599e6b6ab00f6b867c991888bd4e37e4b602a4667ae2cf76080bc133475ec3a7832af9afc4ce00dffbf3f4c51fbeb2dafa116c6417c30de30123457255d077
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ovozBtk.exe

Path C:\Windows\System\ovozBtk.exe
Size 5.9MB
SHA256 fdc5c1bdf6153a2f7fe7a04df478dfa78db8a684b1758e5badd74822ba321054
MD5 7778ea3db0d94fde8405287b1242c7a1
SHA1 fcc9c70f01e58a39278eb9cb6e846616ee3d416b
SHA512 eedca48d05b0f2dba26a602f09f39c23ceb91d5b9caa3364444780fed269dff2a7c9768183d2b6f43dae7c17e2c70d29198257ea5c1f8a542cd7228f6f4ff102
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

pMXiTJb.exe

Path C:\Windows\System\pMXiTJb.exe
Size 5.9MB
SHA256 9c35e26ab7916c4d1547d2fe06e1ae5cae096c0670a5c7b0b8a1e9d59d31e76f
MD5 7a551bdd7f3f09852181cbd6418b4986
SHA1 c51fcc11ac555663866ab39c975207f821a7cf7a
SHA512 bf83a53384da79a8ecd29417fc93b43ff979a1ea657d61425c5db8a38fe4f3e71b0349e689910caf0e3e8dfa3d4e57660a591144be8fb4fdd06bf85174d45855
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

peETOjX.exe

Path C:\Windows\System\peETOjX.exe
Size 5.9MB
SHA256 56190943271e8dbaa974ac5f84ee836fba6c96cff3a0a0d8ef738d5ce8c9e4d0
MD5 55e53624636620b27803662517f149fd
SHA1 c46fdaf40b8e091b9954b112b9a1cc34c32da4ad
SHA512 19cf472256343c1002b54f859482b200d0f137286fd6558e0c8cca04d0a7231a44d527aecb2faf345f29a17498bd3a2f11adb2a12e17a9d7dad3403c89ed03a3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

rHOWdsc.exe

Path C:\Windows\System\rHOWdsc.exe
Size 5.9MB
SHA256 84ad6a1c35e2f5eeef2e7aff55a4556c4e86b1d15c0c81c1f15e705b52d7995a
MD5 9d85a7c3305f8a1fb891d05cbdd9ce15
SHA1 692b19eb2c91b00b004c657bd958f5f1c7a0cf7c
SHA512 a3cb26ab8c84525fe7472f846534ac189ff483720286c3900dcd0d46cf08135a4e1b3e612f2a85234b170fbae69add6e1cc6777d425bdc859ebbcdecd0be52bb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

rWtSlOE.exe

Path C:\Windows\System\rWtSlOE.exe
Size 5.9MB
SHA256 3ab871ba477570cf96f2aeca881b1dea3e43d3b8cbee3e2644f3bf71e0bc1783
MD5 1685969007a181069c93311b637d4163
SHA1 34e26471c567554385fcd23f0aca80f4677a1f93
SHA512 502c86ff5974470df014b1f5e2ec1fb7e18269a49b3413ffe6ada83410158d4e490db1bc9da234c4824424596bc97d935691dc9a2b889286008ac8ac36cac543
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

rYwhBZs.exe

Path C:\Windows\System\rYwhBZs.exe
Size 5.9MB
SHA256 79c24644b546edf4d10cd1458a2dffed8a6c5ba12c39ed47a08e26edd350baee
MD5 c651755675841565da6877d34d15094d
SHA1 7e97ddee3f49de26aa7216efa80aeed31b1935f6
SHA512 2959d68e42f818de68a1bb65f7823801b0586174e553ca1cfde634326e5fe3026053e665ec89fc1a935feb1b5ffb1b7553b655b3a5891b9f1610d601dd5134ee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

snTmaCh.exe

Path C:\Windows\System\snTmaCh.exe
Size 5.9MB
SHA256 6201b697cca17121e193d6d60b3bb53efca5c26ebfe5aee4176be35cbdfd1307
MD5 bca5499465875ea86cc573bf7fb69734
SHA1 ca8f61309297c26159e9ec13ab7f42c66f62caa5
SHA512 00b04cef8d02d91fc0f7d2ba03ffe578faa7fb1ad360ea817daac3ae832dfa89f536b53021d3928cbd5e36982c664c1a7a89151dd79018e4518e8d29ee95238b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

teigcii.exe

Path C:\Windows\System\teigcii.exe
Size 5.9MB
SHA256 a0f28152258bdc2a1454df92929ceb6c6e91059a1f6590d83bd4a7199fe32081
MD5 3873bdf5eb33d80a8ecff453cccef714
SHA1 20b9d1b9ce6af9197437fd35ad7744e6f2820643
SHA512 1eeb575b73fb59b6812c628dcf55e4f2dfdcba7506c14b726c9fac3b6bb67f37d5285428a22ac15859dae10a1726839e6fb7b147ed8cab84ad478e86c3cdbd65
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

tuzGVSo.exe

Path C:\Windows\System\tuzGVSo.exe
Size 5.9MB
SHA256 9e0dbda108ec2ae8fb1b4c8aa878f513ab9e1dc97f69b3bab4cddd6b88a2331f
MD5 f878506fe8ddfcb479159d881c25db9d
SHA1 b7f5d280d8243517ede7349e706ced8f3020a2f3
SHA512 68a6cdf43075d7a8160781c1ec8ef96858d6c36f338abc09d6968262435e660e13322a13af571441c6f1afb72592e89f29323b030fb7c866b9231a8d3b560f33
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlWdhKl.exe

Path C:\Windows\System\vlWdhKl.exe
Size 5.9MB
SHA256 6776365d4fddb73275ce7b9f56d64a2bb114d555b0d34491bc6eb3dcd326dac1
MD5 4cbd371f851246909ea452c2bb5399de
SHA1 6e3a2146c32aca04876fa19b1b38f8014b6b1ec7
SHA512 87007758214ebde2cc73d855b8df9bc70884ad30c7080eb5a078071ee22bb5d0d28aeb53f33cf58ec6abd8ef6273fab79682d9b1306a783c2f3e7dfdf7f8aab0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

zAgpMVQ.exe

Path C:\Windows\System\zAgpMVQ.exe
Size 5.9MB
SHA256 0cad76d93b4b35b3fe809724e4a99742f8d757e5e0dd5ef070e65d707356b8a4
MD5 0cf864b1a42364661e295d694ba628d9
SHA1 a4ad62b209bcf2492d1f34152ee309135ce55a22
SHA512 3f1bb42b6540e1a8f021031f635b9e8b3c190565ac88e8cf33af7c06ca822327765c001b5a2102cf576cbd8cbf49cf476441f9aeb45d18a7d71a29b9f09d2620
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/960-145-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp

Download

memory/960-126-0x00007FF7A8F40000-0x00007FF7A9294000-memory.dmp

Download

memory/1088-120-0x00007FF7E7C60000-0x00007FF7E7FB4000-memory.dmp

Download

memory/1088-144-0x00007FF7E7C60000-0x00007FF7E7FB4000-memory.dmp

Download

memory/1136-33-0x00007FF679600000-0x00007FF679954000-memory.dmp

Download

memory/1136-137-0x00007FF679600000-0x00007FF679954000-memory.dmp

Download

memory/1332-140-0x00007FF694C10000-0x00007FF694F64000-memory.dmp

Download

memory/1332-116-0x00007FF694C10000-0x00007FF694F64000-memory.dmp

Download

memory/1336-6-0x00007FF698ED0000-0x00007FF699224000-memory.dmp

Download

memory/1336-131-0x00007FF698ED0000-0x00007FF699224000-memory.dmp

Download

memory/1336-129-0x00007FF698ED0000-0x00007FF699224000-memory.dmp

Download

memory/1912-1-0x000001A752EF0000-0x000001A752F00000-memory.dmp

Download

memory/1912-0-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp

Download

memory/1912-128-0x00007FF6A9C80000-0x00007FF6A9FD4000-memory.dmp

Download

memory/2000-117-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp

Download

memory/2000-148-0x00007FF65FCF0000-0x00007FF660044000-memory.dmp

Download

memory/2308-36-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp

Download

memory/2308-135-0x00007FF6B95E0000-0x00007FF6B9934000-memory.dmp

Download

memory/2328-132-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp

Download

memory/2328-130-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp

Download

memory/2328-12-0x00007FF7CBEB0000-0x00007FF7CC204000-memory.dmp

Download

memory/2548-114-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp

Download

memory/2548-138-0x00007FF72C780000-0x00007FF72CAD4000-memory.dmp

Download

memory/2844-118-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp

Download

memory/2844-149-0x00007FF61CB00000-0x00007FF61CE54000-memory.dmp

Download

memory/3056-30-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp

Download

memory/3056-133-0x00007FF7B7D60000-0x00007FF7B80B4000-memory.dmp

Download

memory/3092-125-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp

Download

memory/3092-151-0x00007FF678A50000-0x00007FF678DA4000-memory.dmp

Download

memory/3400-139-0x00007FF713170000-0x00007FF7134C4000-memory.dmp

Download

memory/3400-115-0x00007FF713170000-0x00007FF7134C4000-memory.dmp

Download

memory/4224-143-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp

Download

memory/4224-122-0x00007FF7C8270000-0x00007FF7C85C4000-memory.dmp

Download

memory/4252-150-0x00007FF7655F0000-0x00007FF765944000-memory.dmp

Download

memory/4252-124-0x00007FF7655F0000-0x00007FF765944000-memory.dmp

Download

memory/4436-141-0x00007FF68D160000-0x00007FF68D4B4000-memory.dmp

Download

memory/4436-127-0x00007FF68D160000-0x00007FF68D4B4000-memory.dmp

Download

memory/4480-134-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp

Download

memory/4480-35-0x00007FF69A450000-0x00007FF69A7A4000-memory.dmp

Download

memory/4612-142-0x00007FF602730000-0x00007FF602A84000-memory.dmp

Download

memory/4612-123-0x00007FF602730000-0x00007FF602A84000-memory.dmp

Download

memory/4648-119-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp

Download

memory/4648-147-0x00007FF6F7550000-0x00007FF6F78A4000-memory.dmp

Download

memory/4896-136-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp

Download

memory/4896-113-0x00007FF73E2D0000-0x00007FF73E624000-memory.dmp

Download

memory/4936-146-0x00007FF602240000-0x00007FF602594000-memory.dmp

Download

memory/4936-121-0x00007FF602240000-0x00007FF602594000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads