cobaltstrike | cff93e4acaddbb4f3669c3777edaec91dbbc12e8a6f67bfdda72aa7e1dc20964

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-zmkdfsef2t
SHA256 cff93e4acaddbb4f3669c3777edaec91dbbc12e8a6f67bfdda72aa7e1dc20964
MD5 8b3b912b1e971575c37428619c1047ab
SHA1 2817e717a1abc6a7b033b06280eb53c3fe61d990
SHA512 184b19594ffd69376fddb7f0072c22b98e9a400b2618b4f5147c5a4cbd084e913a086bebaa8d1ca22ba3ca0fc86bb6a18349d1ebc57a3d7875bac5ea7c7a0b66
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002327d-5.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233d3-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-9.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-22.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233d4-28.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-34.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dc-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dd-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233de-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233df-60.dat	cobalt_reflective_dll
behavioral2/files/0x000c0000000226ef-65.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023345-71.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023347-81.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023348-85.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e0-93.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e1-101.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e2-108.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e3-113.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e5-119.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e6-132.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e4-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002327d-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233d3-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233d4-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dc-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dd-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233de-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233df-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c0000000226ef-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023345-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023347-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023348-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e0-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e1-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e2-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e3-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e5-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e6-132.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e4-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2140-0-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	UPX
behavioral2/files/0x000600000002327d-5.dat	UPX
behavioral2/memory/536-6-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	UPX
behavioral2/files/0x00080000000233d3-11.dat	UPX
behavioral2/files/0x00070000000233d7-9.dat	UPX
behavioral2/memory/1156-13-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	UPX
behavioral2/memory/2364-20-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	UPX
behavioral2/files/0x00070000000233d9-22.dat	UPX
behavioral2/memory/936-25-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	UPX
behavioral2/files/0x00080000000233d4-28.dat	UPX
behavioral2/memory/4352-30-0x00007FF703530000-0x00007FF703884000-memory.dmp	UPX
behavioral2/files/0x00070000000233da-34.dat	UPX
behavioral2/memory/4240-38-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	UPX
behavioral2/files/0x00070000000233dc-41.dat	UPX
behavioral2/memory/3968-42-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	UPX
behavioral2/files/0x00070000000233dd-47.dat	UPX
behavioral2/files/0x00070000000233de-53.dat	UPX
behavioral2/memory/3012-48-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	UPX
behavioral2/memory/2084-56-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	UPX
behavioral2/files/0x00070000000233df-60.dat	UPX
behavioral2/files/0x000c0000000226ef-65.dat	UPX
behavioral2/memory/3752-66-0x00007FF76A4C0000-0x00007FF76A814000-memory.dmp	UPX
behavioral2/files/0x000a000000023345-71.dat	UPX
behavioral2/memory/1156-74-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	UPX
behavioral2/memory/2132-75-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	UPX
behavioral2/memory/4476-72-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	UPX
behavioral2/memory/536-67-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	UPX
behavioral2/memory/2140-62-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	UPX
behavioral2/files/0x000a000000023347-81.dat	UPX
behavioral2/memory/4184-83-0x00007FF78E600000-0x00007FF78E954000-memory.dmp	UPX
behavioral2/files/0x000a000000023348-85.dat	UPX
behavioral2/memory/3412-90-0x00007FF7635A0000-0x00007FF7638F4000-memory.dmp	UPX
behavioral2/files/0x00070000000233e0-93.dat	UPX
behavioral2/memory/936-89-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	UPX
behavioral2/memory/1064-96-0x00007FF75F310000-0x00007FF75F664000-memory.dmp	UPX
behavioral2/files/0x00070000000233e1-101.dat	UPX
behavioral2/memory/4352-95-0x00007FF703530000-0x00007FF703884000-memory.dmp	UPX
behavioral2/files/0x00070000000233e2-108.dat	UPX
behavioral2/files/0x00070000000233e3-113.dat	UPX
behavioral2/files/0x00070000000233e5-119.dat	UPX
behavioral2/memory/1500-122-0x00007FF7B6930000-0x00007FF7B6C84000-memory.dmp	UPX
behavioral2/memory/4784-124-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233e6-132.dat	UPX
behavioral2/files/0x00070000000233e4-128.dat	UPX
behavioral2/memory/3896-126-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	UPX
behavioral2/memory/1136-121-0x00007FF6E34A0000-0x00007FF6E37F4000-memory.dmp	UPX
behavioral2/memory/3968-120-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	UPX
behavioral2/memory/2612-104-0x00007FF795F90000-0x00007FF7962E4000-memory.dmp	UPX
behavioral2/memory/4240-103-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	UPX
behavioral2/memory/3588-135-0x00007FF69E340000-0x00007FF69E694000-memory.dmp	UPX
behavioral2/memory/3012-134-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	UPX
behavioral2/memory/4476-136-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	UPX
behavioral2/memory/2132-137-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	UPX
behavioral2/memory/4784-138-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	UPX
behavioral2/memory/3896-139-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	UPX
behavioral2/memory/536-140-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	UPX
behavioral2/memory/1156-141-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	UPX
behavioral2/memory/2364-142-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	UPX
behavioral2/memory/936-143-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	UPX
behavioral2/memory/4352-144-0x00007FF703530000-0x00007FF703884000-memory.dmp	UPX
behavioral2/memory/4240-145-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	UPX
behavioral2/memory/3968-146-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	UPX
behavioral2/memory/3012-147-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	UPX
behavioral2/memory/2084-148-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2140-0-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	xmrig
behavioral2/files/0x000600000002327d-5.dat	xmrig
behavioral2/memory/536-6-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	xmrig
behavioral2/files/0x00080000000233d3-11.dat	xmrig
behavioral2/files/0x00070000000233d7-9.dat	xmrig
behavioral2/memory/1156-13-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	xmrig
behavioral2/memory/2364-20-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d9-22.dat	xmrig
behavioral2/memory/936-25-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233d4-28.dat	xmrig
behavioral2/memory/4352-30-0x00007FF703530000-0x00007FF703884000-memory.dmp	xmrig
behavioral2/files/0x00070000000233da-34.dat	xmrig
behavioral2/memory/4240-38-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dc-41.dat	xmrig
behavioral2/memory/3968-42-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dd-47.dat	xmrig
behavioral2/files/0x00070000000233de-53.dat	xmrig
behavioral2/memory/3012-48-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	xmrig
behavioral2/memory/2084-56-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	xmrig
behavioral2/files/0x00070000000233df-60.dat	xmrig
behavioral2/files/0x000c0000000226ef-65.dat	xmrig
behavioral2/memory/3752-66-0x00007FF76A4C0000-0x00007FF76A814000-memory.dmp	xmrig
behavioral2/files/0x000a000000023345-71.dat	xmrig
behavioral2/memory/1156-74-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	xmrig
behavioral2/memory/2132-75-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	xmrig
behavioral2/memory/4476-72-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	xmrig
behavioral2/memory/536-67-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	xmrig
behavioral2/memory/2140-62-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	xmrig
behavioral2/files/0x000a000000023347-81.dat	xmrig
behavioral2/memory/4184-83-0x00007FF78E600000-0x00007FF78E954000-memory.dmp	xmrig
behavioral2/files/0x000a000000023348-85.dat	xmrig
behavioral2/memory/3412-90-0x00007FF7635A0000-0x00007FF7638F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e0-93.dat	xmrig
behavioral2/memory/936-89-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	xmrig
behavioral2/memory/1064-96-0x00007FF75F310000-0x00007FF75F664000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e1-101.dat	xmrig
behavioral2/memory/4352-95-0x00007FF703530000-0x00007FF703884000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e2-108.dat	xmrig
behavioral2/files/0x00070000000233e3-113.dat	xmrig
behavioral2/files/0x00070000000233e5-119.dat	xmrig
behavioral2/memory/1500-122-0x00007FF7B6930000-0x00007FF7B6C84000-memory.dmp	xmrig
behavioral2/memory/4784-124-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e6-132.dat	xmrig
behavioral2/files/0x00070000000233e4-128.dat	xmrig
behavioral2/memory/3896-126-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	xmrig
behavioral2/memory/1136-121-0x00007FF6E34A0000-0x00007FF6E37F4000-memory.dmp	xmrig
behavioral2/memory/3968-120-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	xmrig
behavioral2/memory/2612-104-0x00007FF795F90000-0x00007FF7962E4000-memory.dmp	xmrig
behavioral2/memory/4240-103-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	xmrig
behavioral2/memory/3588-135-0x00007FF69E340000-0x00007FF69E694000-memory.dmp	xmrig
behavioral2/memory/3012-134-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	xmrig
behavioral2/memory/4476-136-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	xmrig
behavioral2/memory/2132-137-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	xmrig
behavioral2/memory/4784-138-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	xmrig
behavioral2/memory/3896-139-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	xmrig
behavioral2/memory/536-140-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	xmrig
behavioral2/memory/1156-141-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	xmrig
behavioral2/memory/2364-142-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	xmrig
behavioral2/memory/936-143-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	xmrig
behavioral2/memory/4352-144-0x00007FF703530000-0x00007FF703884000-memory.dmp	xmrig
behavioral2/memory/4240-145-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	xmrig
behavioral2/memory/3968-146-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	xmrig
behavioral2/memory/3012-147-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	xmrig
behavioral2/memory/2084-148-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
536	YwKqZDx.exe
1156	LBZKGHX.exe
2364	RGeIMHc.exe
936	GEkJsUM.exe
4352	AsNEmnb.exe
4240	ZjGfjkl.exe
3968	AiLMpBO.exe
3012	DEDKWTJ.exe
2084	TvASajB.exe
3752	nocRfCI.exe
4476	jAQihIK.exe
2132	RHUAqkh.exe
4184	lxICilH.exe
3412	BcefYkr.exe
1064	odxDorB.exe
2612	ubokhsz.exe
1136	JKMzhoZ.exe
1500	qDTsVKN.exe
4784	bMhYsVZ.exe
3896	boayqjp.exe
3588	twvRBtQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2140-0-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	upx
behavioral2/files/0x000600000002327d-5.dat	upx
behavioral2/memory/536-6-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	upx
behavioral2/files/0x00080000000233d3-11.dat	upx
behavioral2/files/0x00070000000233d7-9.dat	upx
behavioral2/memory/1156-13-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	upx
behavioral2/memory/2364-20-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	upx
behavioral2/files/0x00070000000233d9-22.dat	upx
behavioral2/memory/936-25-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	upx
behavioral2/files/0x00080000000233d4-28.dat	upx
behavioral2/memory/4352-30-0x00007FF703530000-0x00007FF703884000-memory.dmp	upx
behavioral2/files/0x00070000000233da-34.dat	upx
behavioral2/memory/4240-38-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-41.dat	upx
behavioral2/memory/3968-42-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	upx
behavioral2/files/0x00070000000233dd-47.dat	upx
behavioral2/files/0x00070000000233de-53.dat	upx
behavioral2/memory/3012-48-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	upx
behavioral2/memory/2084-56-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	upx
behavioral2/files/0x00070000000233df-60.dat	upx
behavioral2/files/0x000c0000000226ef-65.dat	upx
behavioral2/memory/3752-66-0x00007FF76A4C0000-0x00007FF76A814000-memory.dmp	upx
behavioral2/files/0x000a000000023345-71.dat	upx
behavioral2/memory/1156-74-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	upx
behavioral2/memory/2132-75-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	upx
behavioral2/memory/4476-72-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	upx
behavioral2/memory/536-67-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	upx
behavioral2/memory/2140-62-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp	upx
behavioral2/files/0x000a000000023347-81.dat	upx
behavioral2/memory/4184-83-0x00007FF78E600000-0x00007FF78E954000-memory.dmp	upx
behavioral2/files/0x000a000000023348-85.dat	upx
behavioral2/memory/3412-90-0x00007FF7635A0000-0x00007FF7638F4000-memory.dmp	upx
behavioral2/files/0x00070000000233e0-93.dat	upx
behavioral2/memory/936-89-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	upx
behavioral2/memory/1064-96-0x00007FF75F310000-0x00007FF75F664000-memory.dmp	upx
behavioral2/files/0x00070000000233e1-101.dat	upx
behavioral2/memory/4352-95-0x00007FF703530000-0x00007FF703884000-memory.dmp	upx
behavioral2/files/0x00070000000233e2-108.dat	upx
behavioral2/files/0x00070000000233e3-113.dat	upx
behavioral2/files/0x00070000000233e5-119.dat	upx
behavioral2/memory/1500-122-0x00007FF7B6930000-0x00007FF7B6C84000-memory.dmp	upx
behavioral2/memory/4784-124-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	upx
behavioral2/files/0x00070000000233e6-132.dat	upx
behavioral2/files/0x00070000000233e4-128.dat	upx
behavioral2/memory/3896-126-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	upx
behavioral2/memory/1136-121-0x00007FF6E34A0000-0x00007FF6E37F4000-memory.dmp	upx
behavioral2/memory/3968-120-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	upx
behavioral2/memory/2612-104-0x00007FF795F90000-0x00007FF7962E4000-memory.dmp	upx
behavioral2/memory/4240-103-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	upx
behavioral2/memory/3588-135-0x00007FF69E340000-0x00007FF69E694000-memory.dmp	upx
behavioral2/memory/3012-134-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	upx
behavioral2/memory/4476-136-0x00007FF78C640000-0x00007FF78C994000-memory.dmp	upx
behavioral2/memory/2132-137-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp	upx
behavioral2/memory/4784-138-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp	upx
behavioral2/memory/3896-139-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp	upx
behavioral2/memory/536-140-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp	upx
behavioral2/memory/1156-141-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp	upx
behavioral2/memory/2364-142-0x00007FF707EE0000-0x00007FF708234000-memory.dmp	upx
behavioral2/memory/936-143-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp	upx
behavioral2/memory/4352-144-0x00007FF703530000-0x00007FF703884000-memory.dmp	upx
behavioral2/memory/4240-145-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp	upx
behavioral2/memory/3968-146-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp	upx
behavioral2/memory/3012-147-0x00007FF720CE0000-0x00007FF721034000-memory.dmp	upx
behavioral2/memory/2084-148-0x00007FF62C540000-0x00007FF62C894000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qDTsVKN.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\boayqjp.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LBZKGHX.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AsNEmnb.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TvASajB.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\odxDorB.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JKMzhoZ.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RGeIMHc.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GEkJsUM.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RHUAqkh.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bMhYsVZ.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AiLMpBO.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nocRfCI.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BcefYkr.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\twvRBtQ.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ubokhsz.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YwKqZDx.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZjGfjkl.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DEDKWTJ.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jAQihIK.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lxICilH.exe	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 536	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	82
PID 2140 wrote to memory of 536	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	82
PID 2140 wrote to memory of 1156	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	83
PID 2140 wrote to memory of 1156	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	83
PID 2140 wrote to memory of 2364	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	84
PID 2140 wrote to memory of 2364	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	84
PID 2140 wrote to memory of 936	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	86
PID 2140 wrote to memory of 936	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	86
PID 2140 wrote to memory of 4352	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	87
PID 2140 wrote to memory of 4352	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	87
PID 2140 wrote to memory of 4240	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	88
PID 2140 wrote to memory of 4240	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	88
PID 2140 wrote to memory of 3968	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	90
PID 2140 wrote to memory of 3968	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	90
PID 2140 wrote to memory of 3012	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	91
PID 2140 wrote to memory of 3012	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	91
PID 2140 wrote to memory of 2084	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	92
PID 2140 wrote to memory of 2084	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	92
PID 2140 wrote to memory of 3752	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	94
PID 2140 wrote to memory of 3752	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	94
PID 2140 wrote to memory of 4476	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	95
PID 2140 wrote to memory of 4476	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	95
PID 2140 wrote to memory of 2132	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	96
PID 2140 wrote to memory of 2132	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	96
PID 2140 wrote to memory of 4184	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	97
PID 2140 wrote to memory of 4184	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	97
PID 2140 wrote to memory of 3412	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	98
PID 2140 wrote to memory of 3412	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	98
PID 2140 wrote to memory of 1064	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	99
PID 2140 wrote to memory of 1064	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	99
PID 2140 wrote to memory of 2612	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	100
PID 2140 wrote to memory of 2612	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	100
PID 2140 wrote to memory of 1136	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	101
PID 2140 wrote to memory of 1136	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	101
PID 2140 wrote to memory of 1500	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	104
PID 2140 wrote to memory of 1500	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	104
PID 2140 wrote to memory of 4784	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	105
PID 2140 wrote to memory of 4784	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	105
PID 2140 wrote to memory of 3896	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	106
PID 2140 wrote to memory of 3896	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	106
PID 2140 wrote to memory of 3588	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	107
PID 2140 wrote to memory of 3588	2140	2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_8b3b912b1e971575c37428619c1047ab_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System\YwKqZDx.exe
  C:\Windows\System\YwKqZDx.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\LBZKGHX.exe
  C:\Windows\System\LBZKGHX.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\RGeIMHc.exe
  C:\Windows\System\RGeIMHc.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\GEkJsUM.exe
  C:\Windows\System\GEkJsUM.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\AsNEmnb.exe
  C:\Windows\System\AsNEmnb.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ZjGfjkl.exe
  C:\Windows\System\ZjGfjkl.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\AiLMpBO.exe
  C:\Windows\System\AiLMpBO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\DEDKWTJ.exe
  C:\Windows\System\DEDKWTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\TvASajB.exe
  C:\Windows\System\TvASajB.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\nocRfCI.exe
  C:\Windows\System\nocRfCI.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\jAQihIK.exe
  C:\Windows\System\jAQihIK.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\RHUAqkh.exe
  C:\Windows\System\RHUAqkh.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\lxICilH.exe
  C:\Windows\System\lxICilH.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\BcefYkr.exe
  C:\Windows\System\BcefYkr.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\odxDorB.exe
  C:\Windows\System\odxDorB.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ubokhsz.exe
  C:\Windows\System\ubokhsz.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\JKMzhoZ.exe
  C:\Windows\System\JKMzhoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\qDTsVKN.exe
  C:\Windows\System\qDTsVKN.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\bMhYsVZ.exe
  C:\Windows\System\bMhYsVZ.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\boayqjp.exe
  C:\Windows\System\boayqjp.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\twvRBtQ.exe
  C:\Windows\System\twvRBtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AiLMpBO.exe

Path C:\Windows\System\AiLMpBO.exe
Size 5.9MB
SHA256 c3e8085f0f8e992f48c948916b505c33549839d41f8977571415dfc1187ecf6e
MD5 e59bf79fb5156536a292375a21bfd182
SHA1 962722b72aac921c9592af9176b00530bc43a47c
SHA512 5aced7fb4c4d6cb7888304e83fce8868293e305515ef2d616a1839c9b81d5271e15b24e76575c93b96e816bcb64c2e801e08fa0a6e3d289a0e51b9e5e1405d75
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsNEmnb.exe

Path C:\Windows\System\AsNEmnb.exe
Size 5.9MB
SHA256 23970bcd43e5e53be23321f718022e5d5fe333e1435d9dc026c70db4f869bb25
MD5 45fdde5f980ae9a39b058b2716ed064f
SHA1 1e634a98df61c1b0d83114f938a8dca537bdc4c5
SHA512 d094c213d745f7b99df3df0eceb1b040220f426c6bd859404108fa86dca4bef8c6493b4dcf9d94bb01d7944f6cd4c904cc79db6db39336e404f67d8280c4740e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

BcefYkr.exe

Path C:\Windows\System\BcefYkr.exe
Size 5.9MB
SHA256 07cb423648fec135eab9f380bf5a987b23cb51d5a9265429f4e5578b8a5e1724
MD5 5c14695937aec1de959b0ff81ab2d42c
SHA1 ab1a127b9be9eaaadb284ed4aeb94a05329cd97c
SHA512 cacaf5158923bf329c54c0a18e89e455ecea110f6e13262e068ff02d9634364d5b9dd0468b811229f2331f4efaafb0109330effbdd12ae86ea0ec79b04914485
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEDKWTJ.exe

Path C:\Windows\System\DEDKWTJ.exe
Size 5.9MB
SHA256 609cd2429527d639c2dfd767eabe7e7db3d75a00569dc8ad2173b3509fd110e2
MD5 3a4ae5b69291bafcc2369ef8e01ad9a2
SHA1 c925dc7e1069c9fa3c6f63d06ca0617998d21417
SHA512 1ada2568e3e880a4895b9d026881b564dc3d72a1c26f93586a14b7a011b1eb1d6c4c1ae04a9f7433b999473a48137ce01c35ed779c4180805bee9d7a6b41f7f0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

GEkJsUM.exe

Path C:\Windows\System\GEkJsUM.exe
Size 5.9MB
SHA256 232e0a54ed52f617c80d27089a17d05d95def196d15328d96aa9a355c941f701
MD5 b95ce03a3db9546ee3e3370d63585f4d
SHA1 8d97746ff6b7bf76e40678bfce9cacba94dcbf48
SHA512 5309d969734227b2947992c238a520b082cb6773ad7c24486d89a573a40784af25fec5616a4dfc02ef73e87f3344f58befe3a9c263a23095978ad5e07ee757ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKMzhoZ.exe

Path C:\Windows\System\JKMzhoZ.exe
Size 5.9MB
SHA256 bb8bf5a51b41a01401cabde1e0b1a84f9c8f5476298759941f63d678599227bd
MD5 33d06b7a36f722029e0250bbff3a82f4
SHA1 684c8bfe3e5eabf9fec259efdc6d84390cf33732
SHA512 ef480139d9e23aea0b09cad69e53b694b73ac26c9f40620565fe2ea9201000481d6b1ab05c6456d1580dd1520fef5e60cdc5099eabb4052e99b1733cc1aab30f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

LBZKGHX.exe

Path C:\Windows\System\LBZKGHX.exe
Size 5.9MB
SHA256 6162e77b274486f4d98ff914cc197fe9202c61939524e952c47dfa97baa10c17
MD5 c794b7642659b6961acbeba566bbbc7f
SHA1 6b6cf6b0334983020cd3b9e74032dab830f79506
SHA512 3fcb3ea3baab5fab73aed594878eb311c24d901a703a12abfede54e2f148752ded94586bf01e3c20c7fcbd897ff28c480c7a32d3ebc02a34b5d4eb5819214ee6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

RGeIMHc.exe

Path C:\Windows\System\RGeIMHc.exe
Size 5.9MB
SHA256 f0d4b5762dc97b9c0f610b65fbabf5a25170e29a1c778681e8630d3a8bb7ddf7
MD5 106f9fa374e4b94a64c575c406169953
SHA1 1d67101b33533e19d1eec9bb9a97116ae6466470
SHA512 c3d35a1002e0db94e264ab647c57b9381e646d6ee26cf9282b6c3039a76c7f72493ef1111dbed87fe3092cab81c15329bd91bb17326c44e1ae6ecf4f279783f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

RHUAqkh.exe

Path C:\Windows\System\RHUAqkh.exe
Size 5.9MB
SHA256 6e37901fbcd253d30a414006f22f1328976946e0cca9a9bd22acb079589bcd95
MD5 d6e6cfa26d118a9fff1357016bc3dd15
SHA1 2246fcc2f849ecac4de78ac9c4f07d812e094238
SHA512 0635250bf72f74f4c40888d800574eeef64aa7cb1b7f16997a01783615740a26f5d1a722026bedab1c5e792c0ae8970a394293da2cbf6e1d1c8bb6ebec06c5ed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvASajB.exe

Path C:\Windows\System\TvASajB.exe
Size 5.9MB
SHA256 c41e95244729fabd6132d0b4a82cecc2eb6fc3780477409cec274f2c9d0c38aa
MD5 bec2dd35210b1921ec9bf183cf83d498
SHA1 9bb5a4a34f8e8b5b444eed41c81ef627a8523988
SHA512 c365eff8ce40035f9be2f9e873233cb82e0b3748efc869b5280532f40ec7b3da9c8b638426fe520a6ac2087e6f6ebeb9a3e8322a358c8af26ac689e067a8eeb9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

YwKqZDx.exe

Path C:\Windows\System\YwKqZDx.exe
Size 5.9MB
SHA256 3ebcedf692fc2b8b358fcbf8a65e808ff8cf9758a2c254af05959ca5695a3fa0
MD5 9c911948fd31614031fb5872024f07cd
SHA1 1835fbfd53bababa9312e440ffc3530d39252d6a
SHA512 a7c3422f2c22ae1eafa44de9dc42380b227fa272b3ec2119f1b8131808f0bf4589763086fdbfa6744e6ccada4583d5f506db2515ea730e899a29dce3ed607756
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZjGfjkl.exe

Path C:\Windows\System\ZjGfjkl.exe
Size 5.9MB
SHA256 467e099699b17e110d8f9c3af896c0a7d2f33810a44d5dfd25c37a0129199a93
MD5 2392c5eb1cf4c069a81b2137700cddd2
SHA1 101858e899f1e9383596d48fc51105fccda1d665
SHA512 d31d15813332e0c0306b39ffcd118df53471122e33279d5dfa3f5ebe36a6ac9867f430b928835195b74f20eee288f4a684825e9fdff09de8554ab43a201ec1f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

bMhYsVZ.exe

Path C:\Windows\System\bMhYsVZ.exe
Size 5.9MB
SHA256 9c5ba15bf0044b57575ac5ff4848f9f8d379b920f819023f3d7b0808776ebb13
MD5 0e5a028a6072d56502adcbb161c376b8
SHA1 6399a3605d81a58483ee97f90c0b09accc1ccbd2
SHA512 5efbaeebfbb42c8b19a22646d7ab43507e6bc566aee0115e43c38c4ae036bc3b4b0df81e1d57a3b9a80c373544754be3507e1ea0cc0696b3811c299ea38110e2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

boayqjp.exe

Path C:\Windows\System\boayqjp.exe
Size 5.9MB
SHA256 ce543c72a632c98273258ce2783cbccf61f269059cc05aa06f00ae05f3ec5fe1
MD5 2065efdf21027f8cf6f002ca3fb1c007
SHA1 69bdf16842e9a492b4d9d8471bc004234f723b0f
SHA512 3468ea67b15bc867d04061d5479c2e96cda45237be0d1fefc2ffa446a5af73e519aedfaf13e282bbcc7d4d2d0a184ae8746b1ade3edf1c03d0a88e577da29b9c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jAQihIK.exe

Path C:\Windows\System\jAQihIK.exe
Size 5.9MB
SHA256 0fc3e1354bbbeb18279378b26d2cd5da123b0356fc924c0c166f7940747f61bd
MD5 605bf99dbda694acc71d2f2d3f919fa3
SHA1 0e4cda56b7aa4461a9a1d3d949aff21b1698cc6b
SHA512 d79134f8a293b89212f2c0514829e217ca238cffb35e0714953364f1808b459d8034bdae4f78b743cabd6783985fbd7e4e33ea62b3ea134cc73409b90c652485
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxICilH.exe

Path C:\Windows\System\lxICilH.exe
Size 5.9MB
SHA256 3c087332b21a4fb50638437a0f9cec77ee86d4bce44d7bd72ca89a54d0443525
MD5 741a3c911aa74a0a060d020029ffe8e6
SHA1 a07659501cac1b9dd9d6a574be87097ce08ceb92
SHA512 daae702056a7ef9297b177cdaf2f356e0c83795e56cb5d103542609ebc36ba3b454b994f3eead164c3c0bdee365018ab288d2491b7589d8cfe7aed02770dbc55
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

nocRfCI.exe

Path C:\Windows\System\nocRfCI.exe
Size 5.9MB
SHA256 cb4498343ca60544bdf8970c8f743fe4f89faf0eae3719865e78e9390f671ab5
MD5 afb7a0bd84fb0424df4aca5475f38989
SHA1 c9af0eef1d1706120273ff96a755dbca1910cdf8
SHA512 5be2dff315bf12e3d4eacb84f1ac2a18eba112b614f363f43eed0d14da41fd8e110af7879cc80eceaf1a3f176375b8775f860a4d373f6099d99c8200be99e490
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

odxDorB.exe

Path C:\Windows\System\odxDorB.exe
Size 5.9MB
SHA256 a4c5bcb8d5520eef9690f54a40d3dbd2ea0f6dbd49df43be0cbcaf35bf5bd720
MD5 d594de2f0fbb824d187430457fad2225
SHA1 217a1870747aa5076abac8e969f886cbf0c2e298
SHA512 e0835a8e2b898aa9416ce9b48aafc97b3977193d438f2c999ba27fdde65698d8cabec20af9b27ac5be8750fc85c0a41244c70109e973b91ebdd0a12ba997cadf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

qDTsVKN.exe

Path C:\Windows\System\qDTsVKN.exe
Size 5.9MB
SHA256 8e19de3059078c1d2770a08bac9225f6595184d0a29bc5f1c83b01d51a47ad34
MD5 74aca886c457a71cd6760d724a20fb9f
SHA1 49ef45d665502945b219382e725194571a39562f
SHA512 01dba728d44eac85300e0b0d938a0f6c0ca228a3a5ee774c5f06a89a67922585780b2b4c6742493a5d544235072c603d19757fc713727d0838226bd34cdad54e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

twvRBtQ.exe

Path C:\Windows\System\twvRBtQ.exe
Size 5.9MB
SHA256 10ba5003911a60038051acbb233dbf93291f29afdfd74708543660522f2ca3cf
MD5 487b0f09c1e1ba35b154d43ffae66207
SHA1 7fafa2ac32641da96b1b8e0ecac54fe98691ce7f
SHA512 1c47f62082bb1d1646a7fbc1af13f0ffc02d1013c1eee521ead4a14a6b09f91e65f3027eabe81571bccfbc6c8ed9b0408f26bacbfd60c56a9ca6e5066e9eee2f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubokhsz.exe

Path C:\Windows\System\ubokhsz.exe
Size 5.9MB
SHA256 22b8e0f5ae19e4aa8b86daa3c0d07ebb5c2d685a1fbd1f2695a755b256425938
MD5 e0fc279816b236b4fa9ddef01ca977cd
SHA1 fadfbf5ab1077423c3c128b9b967cf7fc11b27db
SHA512 1952f7a040210ae8fd66143e062aa1c28e9ec0840b5c377446625e9696f6de81119fd30380584b16e92c67497924c8c2150acc1bb531d7562f043f07cdbb5c0d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-67-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp

Download

memory/536-6-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp

Download

memory/536-140-0x00007FF7E4820000-0x00007FF7E4B74000-memory.dmp

Download

memory/936-143-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp

Download

memory/936-89-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp

Download

memory/936-25-0x00007FF62FC50000-0x00007FF62FFA4000-memory.dmp

Download

memory/1064-154-0x00007FF75F310000-0x00007FF75F664000-memory.dmp

Download

memory/1064-96-0x00007FF75F310000-0x00007FF75F664000-memory.dmp

Download

memory/1136-156-0x00007FF6E34A0000-0x00007FF6E37F4000-memory.dmp

Download

memory/1136-121-0x00007FF6E34A0000-0x00007FF6E37F4000-memory.dmp

Download

memory/1156-141-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp

Download

memory/1156-74-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp

Download

memory/1156-13-0x00007FF791E50000-0x00007FF7921A4000-memory.dmp

Download

memory/1500-122-0x00007FF7B6930000-0x00007FF7B6C84000-memory.dmp

Download

memory/1500-157-0x00007FF7B6930000-0x00007FF7B6C84000-memory.dmp

Download

memory/2084-148-0x00007FF62C540000-0x00007FF62C894000-memory.dmp

Download

memory/2084-56-0x00007FF62C540000-0x00007FF62C894000-memory.dmp

Download

memory/2132-151-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp

Download

memory/2132-75-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp

Download

memory/2132-137-0x00007FF6A0310000-0x00007FF6A0664000-memory.dmp

Download

memory/2140-62-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp

Download

memory/2140-0-0x00007FF60DA30000-0x00007FF60DD84000-memory.dmp

Download

memory/2140-1-0x0000024E322F0000-0x0000024E32300000-memory.dmp

Download

memory/2364-142-0x00007FF707EE0000-0x00007FF708234000-memory.dmp

Download

memory/2364-20-0x00007FF707EE0000-0x00007FF708234000-memory.dmp

Download

memory/2612-104-0x00007FF795F90000-0x00007FF7962E4000-memory.dmp

Download

memory/2612-155-0x00007FF795F90000-0x00007FF7962E4000-memory.dmp

Download

memory/3012-147-0x00007FF720CE0000-0x00007FF721034000-memory.dmp

Download

memory/3012-134-0x00007FF720CE0000-0x00007FF721034000-memory.dmp

Download

memory/3012-48-0x00007FF720CE0000-0x00007FF721034000-memory.dmp

Download

memory/3412-90-0x00007FF7635A0000-0x00007FF7638F4000-memory.dmp

Download

memory/3412-153-0x00007FF7635A0000-0x00007FF7638F4000-memory.dmp

Download

memory/3588-158-0x00007FF69E340000-0x00007FF69E694000-memory.dmp

Download

memory/3588-135-0x00007FF69E340000-0x00007FF69E694000-memory.dmp

Download

memory/3752-149-0x00007FF76A4C0000-0x00007FF76A814000-memory.dmp

Download

memory/3752-66-0x00007FF76A4C0000-0x00007FF76A814000-memory.dmp

Download

memory/3896-126-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp

Download

memory/3896-139-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp

Download

memory/3896-159-0x00007FF66AC50000-0x00007FF66AFA4000-memory.dmp

Download

memory/3968-42-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp

Download

memory/3968-146-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp

Download

memory/3968-120-0x00007FF7CD210000-0x00007FF7CD564000-memory.dmp

Download

memory/4184-83-0x00007FF78E600000-0x00007FF78E954000-memory.dmp

Download

memory/4184-152-0x00007FF78E600000-0x00007FF78E954000-memory.dmp

Download

memory/4240-145-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp

Download

memory/4240-38-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp

Download

memory/4240-103-0x00007FF6684A0000-0x00007FF6687F4000-memory.dmp

Download

memory/4352-30-0x00007FF703530000-0x00007FF703884000-memory.dmp

Download

memory/4352-144-0x00007FF703530000-0x00007FF703884000-memory.dmp

Download

memory/4352-95-0x00007FF703530000-0x00007FF703884000-memory.dmp

Download

memory/4476-150-0x00007FF78C640000-0x00007FF78C994000-memory.dmp

Download

memory/4476-72-0x00007FF78C640000-0x00007FF78C994000-memory.dmp

Download

memory/4476-136-0x00007FF78C640000-0x00007FF78C994000-memory.dmp

Download

memory/4784-124-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp

Download

memory/4784-138-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp

Download

memory/4784-160-0x00007FF7E5360000-0x00007FF7E56B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads