cobaltstrike | 3a5ba851be9faf72646f766574d42c6101dcb2ef6dda1af2562e11e1574e7d5f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-118hwagg2z
SHA256 3a5ba851be9faf72646f766574d42c6101dcb2ef6dda1af2562e11e1574e7d5f
MD5 7acd6ab6cda85a414d23ec523c421921
SHA1 fc21e0937f6f2e521a6012ac02e7db1d8c329e84
SHA512 386c2b88efdd9f48c29b4d25a80ebd967002d8e0db3c7e472c019b6a51abc966eaa3d89e4b333e511fc0ffd0a41775bbcc45caf2bd81048716a998075cd46dbf
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUd:Q+u56utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000700000002327d-5.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023413-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-13.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-54.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023414-67.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-104.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023370-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-85.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023373-61.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-123.dat	cobalt_reflective_dll
behavioral2/files/0x0005000000022e32-129.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000700000002327d-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023413-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023414-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023370-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023373-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0005000000022e32-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2752-0-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	UPX
behavioral2/files/0x000700000002327d-5.dat	UPX
behavioral2/memory/712-8-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	UPX
behavioral2/files/0x0009000000023413-11.dat	UPX
behavioral2/files/0x0007000000023417-13.dat	UPX
behavioral2/memory/2668-14-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	UPX
behavioral2/memory/948-20-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-22.dat	UPX
behavioral2/files/0x000700000002341a-28.dat	UPX
behavioral2/files/0x000700000002341c-42.dat	UPX
behavioral2/files/0x000700000002341b-40.dat	UPX
behavioral2/files/0x000700000002341d-46.dat	UPX
behavioral2/memory/1968-44-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	UPX
behavioral2/memory/2992-38-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	UPX
behavioral2/memory/3552-32-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	UPX
behavioral2/memory/2292-26-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	UPX
behavioral2/memory/1672-51-0x00007FF707530000-0x00007FF707884000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-54.dat	UPX
behavioral2/memory/2908-63-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	UPX
behavioral2/files/0x0008000000023414-67.dat	UPX
behavioral2/memory/4444-73-0x00007FF70A8D0000-0x00007FF70AC24000-memory.dmp	UPX
behavioral2/memory/712-71-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-79.dat	UPX
behavioral2/memory/2956-84-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	UPX
behavioral2/memory/2944-88-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	UPX
behavioral2/memory/1892-93-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	UPX
behavioral2/memory/2076-100-0x00007FF731600000-0x00007FF731954000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-99.dat	UPX
behavioral2/files/0x0007000000023424-104.dat	UPX
behavioral2/files/0x0009000000023370-116.dat	UPX
behavioral2/memory/3956-118-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	UPX
behavioral2/memory/2832-117-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-112.dat	UPX
behavioral2/memory/1864-110-0x00007FF7B7E60000-0x00007FF7B81B4000-memory.dmp	UPX
behavioral2/memory/2992-109-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	UPX
behavioral2/files/0x0007000000023422-96.dat	UPX
behavioral2/files/0x0007000000023421-90.dat	UPX
behavioral2/memory/1740-81-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-85.dat	UPX
behavioral2/memory/2668-76-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	UPX
behavioral2/files/0x000b000000023373-61.dat	UPX
behavioral2/memory/2752-60-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	UPX
behavioral2/memory/1768-56-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-123.dat	UPX
behavioral2/files/0x0005000000022e32-129.dat	UPX
behavioral2/memory/2288-125-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	UPX
behavioral2/memory/2068-131-0x00007FF692970000-0x00007FF692CC4000-memory.dmp	UPX
behavioral2/memory/1740-132-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	UPX
behavioral2/memory/2956-133-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	UPX
behavioral2/memory/2944-134-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	UPX
behavioral2/memory/1892-135-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	UPX
behavioral2/memory/2076-136-0x00007FF731600000-0x00007FF731954000-memory.dmp	UPX
behavioral2/memory/3956-137-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	UPX
behavioral2/memory/2288-138-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	UPX
behavioral2/memory/712-139-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	UPX
behavioral2/memory/2668-140-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	UPX
behavioral2/memory/948-141-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	UPX
behavioral2/memory/2292-142-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	UPX
behavioral2/memory/3552-143-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	UPX
behavioral2/memory/2992-144-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	UPX
behavioral2/memory/1968-145-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	UPX
behavioral2/memory/1672-146-0x00007FF707530000-0x00007FF707884000-memory.dmp	UPX
behavioral2/memory/1768-147-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	UPX
behavioral2/memory/2908-148-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2752-0-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	xmrig
behavioral2/files/0x000700000002327d-5.dat	xmrig
behavioral2/memory/712-8-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	xmrig
behavioral2/files/0x0009000000023413-11.dat	xmrig
behavioral2/files/0x0007000000023417-13.dat	xmrig
behavioral2/memory/2668-14-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	xmrig
behavioral2/memory/948-20-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-22.dat	xmrig
behavioral2/files/0x000700000002341a-28.dat	xmrig
behavioral2/files/0x000700000002341c-42.dat	xmrig
behavioral2/files/0x000700000002341b-40.dat	xmrig
behavioral2/files/0x000700000002341d-46.dat	xmrig
behavioral2/memory/1968-44-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	xmrig
behavioral2/memory/2992-38-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	xmrig
behavioral2/memory/3552-32-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	xmrig
behavioral2/memory/2292-26-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	xmrig
behavioral2/memory/1672-51-0x00007FF707530000-0x00007FF707884000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-54.dat	xmrig
behavioral2/memory/2908-63-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023414-67.dat	xmrig
behavioral2/memory/4444-73-0x00007FF70A8D0000-0x00007FF70AC24000-memory.dmp	xmrig
behavioral2/memory/712-71-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-79.dat	xmrig
behavioral2/memory/2956-84-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	xmrig
behavioral2/memory/2944-88-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	xmrig
behavioral2/memory/1892-93-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	xmrig
behavioral2/memory/2076-100-0x00007FF731600000-0x00007FF731954000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-99.dat	xmrig
behavioral2/files/0x0007000000023424-104.dat	xmrig
behavioral2/files/0x0009000000023370-116.dat	xmrig
behavioral2/memory/3956-118-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	xmrig
behavioral2/memory/2832-117-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-112.dat	xmrig
behavioral2/memory/1864-110-0x00007FF7B7E60000-0x00007FF7B81B4000-memory.dmp	xmrig
behavioral2/memory/2992-109-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-96.dat	xmrig
behavioral2/files/0x0007000000023421-90.dat	xmrig
behavioral2/memory/1740-81-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-85.dat	xmrig
behavioral2/memory/2668-76-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	xmrig
behavioral2/files/0x000b000000023373-61.dat	xmrig
behavioral2/memory/2752-60-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	xmrig
behavioral2/memory/1768-56-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-123.dat	xmrig
behavioral2/files/0x0005000000022e32-129.dat	xmrig
behavioral2/memory/2288-125-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	xmrig
behavioral2/memory/2068-131-0x00007FF692970000-0x00007FF692CC4000-memory.dmp	xmrig
behavioral2/memory/1740-132-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	xmrig
behavioral2/memory/2956-133-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	xmrig
behavioral2/memory/2944-134-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	xmrig
behavioral2/memory/1892-135-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	xmrig
behavioral2/memory/2076-136-0x00007FF731600000-0x00007FF731954000-memory.dmp	xmrig
behavioral2/memory/3956-137-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	xmrig
behavioral2/memory/2288-138-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	xmrig
behavioral2/memory/712-139-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	xmrig
behavioral2/memory/2668-140-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	xmrig
behavioral2/memory/948-141-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	xmrig
behavioral2/memory/2292-142-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	xmrig
behavioral2/memory/3552-143-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	xmrig
behavioral2/memory/2992-144-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	xmrig
behavioral2/memory/1968-145-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	xmrig
behavioral2/memory/1672-146-0x00007FF707530000-0x00007FF707884000-memory.dmp	xmrig
behavioral2/memory/1768-147-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	xmrig
behavioral2/memory/2908-148-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
712	QVkslra.exe
2668	OqWyftJ.exe
948	nFSMKoI.exe
2292	GjEJVlr.exe
3552	svpsKhw.exe
2992	OfIJWTF.exe
1968	nPiwDjX.exe
1672	eVLBvor.exe
1768	xotbuRY.exe
2908	CFhmIit.exe
4444	ArikiMv.exe
1740	HSLUdpZ.exe
2944	RBgKDpq.exe
2956	sQhWrki.exe
1892	mtpMhlK.exe
2076	heQzPgY.exe
1864	FeBFjdM.exe
2832	TMIhhvR.exe
3956	BuTkIYk.exe
2288	uUqGWBv.exe
2068	EIxxHPL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2752-0-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	upx
behavioral2/files/0x000700000002327d-5.dat	upx
behavioral2/memory/712-8-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	upx
behavioral2/files/0x0009000000023413-11.dat	upx
behavioral2/files/0x0007000000023417-13.dat	upx
behavioral2/memory/2668-14-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	upx
behavioral2/memory/948-20-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	upx
behavioral2/files/0x0007000000023418-22.dat	upx
behavioral2/files/0x000700000002341a-28.dat	upx
behavioral2/files/0x000700000002341c-42.dat	upx
behavioral2/files/0x000700000002341b-40.dat	upx
behavioral2/files/0x000700000002341d-46.dat	upx
behavioral2/memory/1968-44-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	upx
behavioral2/memory/2992-38-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	upx
behavioral2/memory/3552-32-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	upx
behavioral2/memory/2292-26-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	upx
behavioral2/memory/1672-51-0x00007FF707530000-0x00007FF707884000-memory.dmp	upx
behavioral2/files/0x000700000002341e-54.dat	upx
behavioral2/memory/2908-63-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	upx
behavioral2/files/0x0008000000023414-67.dat	upx
behavioral2/memory/4444-73-0x00007FF70A8D0000-0x00007FF70AC24000-memory.dmp	upx
behavioral2/memory/712-71-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	upx
behavioral2/files/0x000700000002341f-79.dat	upx
behavioral2/memory/2956-84-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	upx
behavioral2/memory/2944-88-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	upx
behavioral2/memory/1892-93-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	upx
behavioral2/memory/2076-100-0x00007FF731600000-0x00007FF731954000-memory.dmp	upx
behavioral2/files/0x0007000000023423-99.dat	upx
behavioral2/files/0x0007000000023424-104.dat	upx
behavioral2/files/0x0009000000023370-116.dat	upx
behavioral2/memory/3956-118-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	upx
behavioral2/memory/2832-117-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp	upx
behavioral2/files/0x0007000000023425-112.dat	upx
behavioral2/memory/1864-110-0x00007FF7B7E60000-0x00007FF7B81B4000-memory.dmp	upx
behavioral2/memory/2992-109-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	upx
behavioral2/files/0x0007000000023422-96.dat	upx
behavioral2/files/0x0007000000023421-90.dat	upx
behavioral2/memory/1740-81-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	upx
behavioral2/files/0x0007000000023420-85.dat	upx
behavioral2/memory/2668-76-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	upx
behavioral2/files/0x000b000000023373-61.dat	upx
behavioral2/memory/2752-60-0x00007FF73A310000-0x00007FF73A664000-memory.dmp	upx
behavioral2/memory/1768-56-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	upx
behavioral2/files/0x0007000000023426-123.dat	upx
behavioral2/files/0x0005000000022e32-129.dat	upx
behavioral2/memory/2288-125-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	upx
behavioral2/memory/2068-131-0x00007FF692970000-0x00007FF692CC4000-memory.dmp	upx
behavioral2/memory/1740-132-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp	upx
behavioral2/memory/2956-133-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp	upx
behavioral2/memory/2944-134-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp	upx
behavioral2/memory/1892-135-0x00007FF791050000-0x00007FF7913A4000-memory.dmp	upx
behavioral2/memory/2076-136-0x00007FF731600000-0x00007FF731954000-memory.dmp	upx
behavioral2/memory/3956-137-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp	upx
behavioral2/memory/2288-138-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp	upx
behavioral2/memory/712-139-0x00007FF756B20000-0x00007FF756E74000-memory.dmp	upx
behavioral2/memory/2668-140-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp	upx
behavioral2/memory/948-141-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp	upx
behavioral2/memory/2292-142-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp	upx
behavioral2/memory/3552-143-0x00007FF6635B0000-0x00007FF663904000-memory.dmp	upx
behavioral2/memory/2992-144-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp	upx
behavioral2/memory/1968-145-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp	upx
behavioral2/memory/1672-146-0x00007FF707530000-0x00007FF707884000-memory.dmp	upx
behavioral2/memory/1768-147-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp	upx
behavioral2/memory/2908-148-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\CFhmIit.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HSLUdpZ.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mtpMhlK.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FeBFjdM.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EIxxHPL.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OqWyftJ.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nFSMKoI.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OfIJWTF.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nPiwDjX.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eVLBvor.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ArikiMv.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\heQzPgY.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GjEJVlr.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\svpsKhw.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sQhWrki.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TMIhhvR.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uUqGWBv.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QVkslra.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xotbuRY.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RBgKDpq.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BuTkIYk.exe	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 712	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	82
PID 2752 wrote to memory of 712	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	82
PID 2752 wrote to memory of 2668	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	83
PID 2752 wrote to memory of 2668	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	83
PID 2752 wrote to memory of 948	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	84
PID 2752 wrote to memory of 948	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	84
PID 2752 wrote to memory of 2292	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	85
PID 2752 wrote to memory of 2292	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	85
PID 2752 wrote to memory of 3552	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	86
PID 2752 wrote to memory of 3552	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	86
PID 2752 wrote to memory of 2992	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	87
PID 2752 wrote to memory of 2992	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	87
PID 2752 wrote to memory of 1968	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	88
PID 2752 wrote to memory of 1968	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	88
PID 2752 wrote to memory of 1672	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	89
PID 2752 wrote to memory of 1672	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	89
PID 2752 wrote to memory of 1768	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	93
PID 2752 wrote to memory of 1768	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	93
PID 2752 wrote to memory of 2908	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	94
PID 2752 wrote to memory of 2908	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	94
PID 2752 wrote to memory of 4444	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	95
PID 2752 wrote to memory of 4444	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	95
PID 2752 wrote to memory of 2944	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	96
PID 2752 wrote to memory of 2944	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	96
PID 2752 wrote to memory of 1740	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	97
PID 2752 wrote to memory of 1740	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	97
PID 2752 wrote to memory of 2956	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	98
PID 2752 wrote to memory of 2956	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	98
PID 2752 wrote to memory of 1892	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	99
PID 2752 wrote to memory of 1892	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	99
PID 2752 wrote to memory of 2076	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	100
PID 2752 wrote to memory of 2076	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	100
PID 2752 wrote to memory of 1864	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	101
PID 2752 wrote to memory of 1864	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	101
PID 2752 wrote to memory of 2832	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	102
PID 2752 wrote to memory of 2832	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	102
PID 2752 wrote to memory of 3956	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	103
PID 2752 wrote to memory of 3956	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	103
PID 2752 wrote to memory of 2288	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	104
PID 2752 wrote to memory of 2288	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	104
PID 2752 wrote to memory of 2068	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	105
PID 2752 wrote to memory of 2068	2752	2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_7acd6ab6cda85a414d23ec523c421921_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System\QVkslra.exe
  C:\Windows\System\QVkslra.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\OqWyftJ.exe
  C:\Windows\System\OqWyftJ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\nFSMKoI.exe
  C:\Windows\System\nFSMKoI.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\GjEJVlr.exe
  C:\Windows\System\GjEJVlr.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\svpsKhw.exe
  C:\Windows\System\svpsKhw.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\OfIJWTF.exe
  C:\Windows\System\OfIJWTF.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\nPiwDjX.exe
  C:\Windows\System\nPiwDjX.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\eVLBvor.exe
  C:\Windows\System\eVLBvor.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\xotbuRY.exe
  C:\Windows\System\xotbuRY.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\CFhmIit.exe
  C:\Windows\System\CFhmIit.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ArikiMv.exe
  C:\Windows\System\ArikiMv.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\RBgKDpq.exe
  C:\Windows\System\RBgKDpq.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\HSLUdpZ.exe
  C:\Windows\System\HSLUdpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\sQhWrki.exe
  C:\Windows\System\sQhWrki.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\mtpMhlK.exe
  C:\Windows\System\mtpMhlK.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\heQzPgY.exe
  C:\Windows\System\heQzPgY.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\FeBFjdM.exe
  C:\Windows\System\FeBFjdM.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\TMIhhvR.exe
  C:\Windows\System\TMIhhvR.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\BuTkIYk.exe
  C:\Windows\System\BuTkIYk.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\uUqGWBv.exe
  C:\Windows\System\uUqGWBv.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\EIxxHPL.exe
  C:\Windows\System\EIxxHPL.exe
  2⤵
  - Executes dropped EXE
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ArikiMv.exe

Path C:\Windows\System\ArikiMv.exe
Size 5.9MB
SHA256 a28c955549362fcac59d7a56693a4646946547b6a80650d6098d14166d5823bf
MD5 d0370648d01d564e19a8d5723d741b51
SHA1 75f6664157c9dbee3f57157d3443518936e2d6b3
SHA512 127036c719d44a49bc7d03c20f0528bfbff7c388e25bae7cc8210780a774630b6f0fcc5d87dccc1ae34f7d0d605ed20274289bbfa34b2bf6447b2dd7a250968d
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUO:Q+u56utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

BuTkIYk.exe

Path C:\Windows\System\BuTkIYk.exe
Size 5.9MB
SHA256 147f4f2ff379c1559a05bddeb7bbfde20b806760154ca79a2eb422524afed1a3
MD5 369287e91eb9d10b6f05b8885174b558
SHA1 b28e1505bbdaa1b2bdcd94205b5efb4e1011413f
SHA512 89f65ac90144f82e4968a3a9eb80bdd236df017e140688a56cc8af6cd887c10f741855339f141f9d59de5cc5588186c3d082d07b2e00f4ac630d53e8f95b8b78
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUW:Q+u56utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFhmIit.exe

Path C:\Windows\System\CFhmIit.exe
Size 5.9MB
SHA256 a347cf9faa4cfaee164ce7895ff2a34e94475d8f49ccd360746ec6da18e9f59d
MD5 44a73a1f7b92ac82d0ea7f018781fa2a
SHA1 2f9c0b43a7b44cb5cadc8d6b1b10f64aca84d07c
SHA512 482207c301a1e691ab0aba1626ba065a7a38fb0177bf9e81ca3071b7b910cc9bb4096d25425cacffbbd214615183c0474f6abf3c2ded518f6f45a3813ec37d97
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUf:Q+u56utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

EIxxHPL.exe

Path C:\Windows\System\EIxxHPL.exe
Size 5.9MB
SHA256 13a9e3b29cfb714515f000a3691b5013a69e2731f834ae70347cc631735b0a57
MD5 b2b341555d73d916afbcebdda81beda0
SHA1 04be7732579573656748fabd70f97f1d1c040b5b
SHA512 63bb12534b584752ff6dc406384fe6593b747d768075d606329874d9bc925dbaf8a095d3017edb8135793b62492d4baf262fd4c1dfd014e6ce201226d6fb6921
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUj:Q+u56utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

FeBFjdM.exe

Path C:\Windows\System\FeBFjdM.exe
Size 5.9MB
SHA256 1e841ef0d3c23cdedf5dc405267f17d4d325085a3f22148d22e98213aa420e41
MD5 489e9d685165434565381246269fa9f4
SHA1 973e60df37fbc7e650a7a48b85996812833d10ee
SHA512 18a73659db1bd783eaec23962e813eeadc5590790c64abe10b81fe4985f3a4111b71299cb1c082339b7597c3b35696da904cf714cb4215542810edc4ec79e876
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUF:Q+u56utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

GjEJVlr.exe

Path C:\Windows\System\GjEJVlr.exe
Size 5.9MB
SHA256 ccd9fb4b6d26da4028391dea9354454eff569d5db7ca4b51b89914d268edcf3a
MD5 824bbd533d524f5c4ed1ae840062e4dd
SHA1 d2f89e11a3537ca17d934cc065c46ac85d9207a6
SHA512 90738f3113b15b60666485e9b194759549f3761ee2768d9eccaf9c55072d4ea1fbc967e8c9ea34cb670e8572e465804844176dd7f3a0ec596068e688af45216d
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU7:Q+u56utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

HSLUdpZ.exe

Path C:\Windows\System\HSLUdpZ.exe
Size 5.9MB
SHA256 6393a4e8a039970c78bf34c571cefcff586cd1e2611e36782a1835e93b8c6fd1
MD5 358f226e45e695e6389601baa2297f0e
SHA1 f9bc20b4c6e50091a2a751f0913f1aee5940bc7f
SHA512 8c9117107545619b97fadfd2dbb65239478f44d8ea14140f13bd97ff08b2dd329ed3d09575483f066892e0ef853ad7eea040a2746ff5759b6bc7e6945d0201a5
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUS:Q+u56utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfIJWTF.exe

Path C:\Windows\System\OfIJWTF.exe
Size 5.9MB
SHA256 7df49d4905eeb0cba2d17da69087cd4885ce269df6e92229269d96d81cba36bf
MD5 4b5c16996e260862b30b4e8427402546
SHA1 899e6d432afeb00a34082d123f3d575d9792fa4d
SHA512 29990a2d57e2baa3123a4727a8914a25a433fefc8cd2fb6f68001ecf6cb560e612fbf74cec4b83e8d31cb1172b671cea44825a12a8fabd19adf921778aa90027
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUH:Q+u56utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OqWyftJ.exe

Path C:\Windows\System\OqWyftJ.exe
Size 5.9MB
SHA256 d14d7dc6745a3a921de87cd4997d5f308aba7fa2edcd6085e2c26e38c9b6903b
MD5 19c41781f93f18045c10027d65ee2bb8
SHA1 70e581556dfb0dc844cdf1315dc701b2ec0c80c5
SHA512 7d38c76a82f4d795b62be25146c965728c7e4ab54878b3547f7156813a0ded4c49a12449a0d8f43d2e01adba27e3e47ad14a29b88e51898aa32c5410389bd9b6
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUe:Q+u56utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

QVkslra.exe

Path C:\Windows\System\QVkslra.exe
Size 5.9MB
SHA256 4306c7d87cac8fd10f53a15e2f05d0a524c6cde310acb0c2426531b5f656a17f
MD5 05ac3c88959062299bd8162222d983a6
SHA1 cdc6603399c7080c00d096dfd21ae76ccc86be90
SHA512 bb2204d4170625a29590e720f520ad4c1b390b85c38bdb2e5f71802fd39896c79f910f98602e6f7e01293c7c60ed13f689280e8291ef0d28f32d60c0c9125635
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUH:Q+u56utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

RBgKDpq.exe

Path C:\Windows\System\RBgKDpq.exe
Size 5.9MB
SHA256 6c5ddb63515827b853e595ab61675d3c6531026a6a7066d1d00ab03282c61ecf
MD5 978ac43df044167a5c43d03572c44ed3
SHA1 26e163c99253ad3f209440e5b0a5e4463a079130
SHA512 9ddec12ed4aa3cb537d85c93d0caa2059b7ec07957d9ab0aa8a583f1f199c81ccaf45d2d6f19fb7db301f8e6fffa5bead4ff02e65ad23391e19c2cc09dfd6d94
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUz:Q+u56utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TMIhhvR.exe

Path C:\Windows\System\TMIhhvR.exe
Size 5.9MB
SHA256 a7c506f6b0d0d6ba0e86d560779512250ee107f2c0265f38e5199e3052d7d63f
MD5 a0863ac041430ea1c70c61d1545f9c4c
SHA1 eff71484aec6fbe98d504c48d5cd2a8e93e8e6e5
SHA512 fe99a61e2f49f12a07d4af3de686802a47097483f7caac0e06b0892abf0697cce1029acb489e435afcece3fd945df1931050fe79b98dbf920f6ced169c019c0f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUx:Q+u56utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

eVLBvor.exe

Path C:\Windows\System\eVLBvor.exe
Size 5.9MB
SHA256 5d87c71de048367428e2045df4b72cbb3054b41e52940342051f853d2a82000a
MD5 6cc6e67813a32f20d02d5fcb782c5096
SHA1 71a6fb30c97572a29456ab8689649d758161b602
SHA512 51213d23aa86dab17a0d9a64f2ea989e198a1a05330b1ed7dedde1481fd256a84cf10f3d7a788b3a5583afcd5f981846ae5f92c49b6dc96cd41f2e7001478eb1
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUI:Q+u56utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

heQzPgY.exe

Path C:\Windows\System\heQzPgY.exe
Size 5.9MB
SHA256 05b60e038f33577ab4118eae3e1d33efe4452bcf88575d7c88ab6008791e3c0f
MD5 1b0123746f4711feac563b6437b51964
SHA1 51543385c61780fb2967168d09781cd335639bc6
SHA512 8d1bf666b298e70183cebf791eb39057792ee953aa44f1fb208ce9a16a2763d0b7b2355f3aab43c4ca652fc24986d9a317b3d57876a2fb2ff63d4e1d3f63e4e5
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUU:Q+u56utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtpMhlK.exe

Path C:\Windows\System\mtpMhlK.exe
Size 5.9MB
SHA256 89975fa7efd417f1f743304dc21a5c7eb9b9ea8151464464a8fbfb2ea7302db5
MD5 b7e19037824d6012bfebe3a7f76901bd
SHA1 d55d8e0a265f405798e441659345e36d13db2a31
SHA512 e63ac8d1844f9c4db737b647728ae5cd663a9d245ad89f94ca9a412aec2396d1bee1a2dc18412fd59a6de517ae94d5b915d40d9d3ef380ad19d3ff6ac8cc4aa0
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUO:Q+u56utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

nFSMKoI.exe

Path C:\Windows\System\nFSMKoI.exe
Size 5.9MB
SHA256 01714de47fa5e91456eeb753bd2bef36d20e3f866df4947d723ce1ece3211fb0
MD5 443686ccaf40cab63e4cf5875f7c32fe
SHA1 f62d63cefda791bc7519e4c199820960968b57ca
SHA512 6d3b3e08aef83ea9f06c28a69c16da465bd60d52089250dbd77522e7be921ea8ccc7dae55ba0a4f61ebbfdeb7a48d10d7d133fef8411099c389fa35594d2da2c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU/:Q+u56utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPiwDjX.exe

Path C:\Windows\System\nPiwDjX.exe
Size 5.9MB
SHA256 e951292b427f6298b20918024549224bcc29136a9ae74b98523e85318137ad1b
MD5 fa4b294d490921d0ecd80ff18f23a738
SHA1 a1de11e1e5191df5a31f744049a0386e5dbe91c4
SHA512 cdec8faeb9d50c5cf5337ab2816dfedb22bfc5d4ae368c9ab84789654c2b69887d6c9a793894f3882bd4706cd726c739fddd2ffd5d60f88f7493979d6f8859c8
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUg:Q+u56utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

sQhWrki.exe

Path C:\Windows\System\sQhWrki.exe
Size 5.9MB
SHA256 b04aa77767ca6116ddfc76015e8d7bbeccfd252e7b874042177ebbd3a1fbed05
MD5 423aeb492eac0e8c5a6f29e6c929a093
SHA1 811e99a0649a9c0fcbccaf2cd3359870a01a1b06
SHA512 bdece6de34fbcb658927c0762222beac1f175f9653cb1759cdc3569df2fae74b973aa14ec26a5a636a722cfe00ace4666e3feb5432ce253ed852a8efbc701763
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUR:Q+u56utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

svpsKhw.exe

Path C:\Windows\System\svpsKhw.exe
Size 5.9MB
SHA256 e754133a509cb400e4baba0d1d9596ee58b1bffe047416f5bd0190d398a4feb9
MD5 853c034b03e07677e938efea8fd25850
SHA1 2d6659440cedc09db0323c6aae27aafd30debc97
SHA512 ed689804650568b0d6d3cafd53c0628235c9e4759abecaaeaee2b3dfdd46c7d20acb60622ab1c80f345ac02d2cce04c7d1f9de9efa20b723a12048475fc4129a
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUS:Q+u56utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

uUqGWBv.exe

Path C:\Windows\System\uUqGWBv.exe
Size 5.9MB
SHA256 13dc9f7377dc571a155fd77e8870d5427d9fbecf04a1d47a4097cde670d02d80
MD5 7df1fae051f74206fc271c61084faacf
SHA1 fa4e48157a2000286a9bf347643f406529c8369f
SHA512 2046666561c499b7741be947ee68fc55cec677bbdb3fe6280b9ecc03e50ad2993c04d2c403b2f21ffa41e7b892a7ac0aea575cbe85a93cca86c0198bd3050a15
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUf:Q+u56utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

xotbuRY.exe

Path C:\Windows\System\xotbuRY.exe
Size 5.9MB
SHA256 8e1fdb08b3f615c62a5f81f2ec1e2dbdf9be9414606db9c5a252f33e2fab01e1
MD5 a078e9739a06fb008fba8dd3871264b6
SHA1 c5ee34833f34735210891fdca54e7b4282bda587
SHA512 f4ea2a76b867b31c614f0d2fbf7592c2d6b124468d560611bf8f86b7dc31e1e8078baec9743d97d811d2eee267efc233c17e0c4a2143bfe6fb8f0b5ebcca8b2c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU9:Q+u56utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/712-71-0x00007FF756B20000-0x00007FF756E74000-memory.dmp

Download

memory/712-8-0x00007FF756B20000-0x00007FF756E74000-memory.dmp

Download

memory/712-139-0x00007FF756B20000-0x00007FF756E74000-memory.dmp

Download

memory/948-20-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp

Download

memory/948-141-0x00007FF7F4810000-0x00007FF7F4B64000-memory.dmp

Download

memory/1672-51-0x00007FF707530000-0x00007FF707884000-memory.dmp

Download

memory/1672-146-0x00007FF707530000-0x00007FF707884000-memory.dmp

Download

memory/1740-150-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp

Download

memory/1740-81-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp

Download

memory/1740-132-0x00007FF7E3BE0000-0x00007FF7E3F34000-memory.dmp

Download

memory/1768-147-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp

Download

memory/1768-56-0x00007FF7B4960000-0x00007FF7B4CB4000-memory.dmp

Download

memory/1864-110-0x00007FF7B7E60000-0x00007FF7B81B4000-memory.dmp

Download

memory/1864-155-0x00007FF7B7E60000-0x00007FF7B81B4000-memory.dmp

Download

memory/1892-93-0x00007FF791050000-0x00007FF7913A4000-memory.dmp

Download

memory/1892-135-0x00007FF791050000-0x00007FF7913A4000-memory.dmp

Download

memory/1892-153-0x00007FF791050000-0x00007FF7913A4000-memory.dmp

Download

memory/1968-44-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp

Download

memory/1968-145-0x00007FF741A90000-0x00007FF741DE4000-memory.dmp

Download

memory/2068-131-0x00007FF692970000-0x00007FF692CC4000-memory.dmp

Download

memory/2068-159-0x00007FF692970000-0x00007FF692CC4000-memory.dmp

Download

memory/2076-136-0x00007FF731600000-0x00007FF731954000-memory.dmp

Download

memory/2076-154-0x00007FF731600000-0x00007FF731954000-memory.dmp

Download

memory/2076-100-0x00007FF731600000-0x00007FF731954000-memory.dmp

Download

memory/2288-138-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp

Download

memory/2288-158-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp

Download

memory/2288-125-0x00007FF6C7030000-0x00007FF6C7384000-memory.dmp

Download

memory/2292-142-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp

Download

memory/2292-26-0x00007FF701E80000-0x00007FF7021D4000-memory.dmp

Download

memory/2668-140-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp

Download

memory/2668-76-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp

Download

memory/2668-14-0x00007FF74A560000-0x00007FF74A8B4000-memory.dmp

Download

memory/2752-60-0x00007FF73A310000-0x00007FF73A664000-memory.dmp

Download

memory/2752-1-0x000001BF22B20000-0x000001BF22B30000-memory.dmp

Download

memory/2752-0-0x00007FF73A310000-0x00007FF73A664000-memory.dmp

Download

memory/2832-156-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp

Download

memory/2832-117-0x00007FF79FFB0000-0x00007FF7A0304000-memory.dmp

Download

memory/2908-63-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp

Download

memory/2908-148-0x00007FF7ED080000-0x00007FF7ED3D4000-memory.dmp

Download

memory/2944-134-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp

Download

memory/2944-88-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp

Download

memory/2944-152-0x00007FF6BB000000-0x00007FF6BB354000-memory.dmp

Download

memory/2956-84-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp

Download

memory/2956-133-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp

Download

memory/2956-151-0x00007FF6E2110000-0x00007FF6E2464000-memory.dmp

Download

memory/2992-109-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp

Download

memory/2992-144-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp

Download

memory/2992-38-0x00007FF6A87E0000-0x00007FF6A8B34000-memory.dmp

Download

memory/3552-143-0x00007FF6635B0000-0x00007FF663904000-memory.dmp

Download

memory/3552-32-0x00007FF6635B0000-0x00007FF663904000-memory.dmp

Download

memory/3956-137-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp

Download

memory/3956-157-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp

Download

memory/3956-118-0x00007FF6CAFB0000-0x00007FF6CB304000-memory.dmp

Download

memory/4444-149-0x00007FF70A8D0000-0x00007FF70AC24000-memory.dmp

Download

memory/4444-73-0x00007FF70A8D0000-0x00007FF70AC24000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads