cobaltstrike | eb26532e47ee05f0955aff17ec34aee4494813ac6e21f8ed23fb2cf13c0a5ce2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-18ntfaab27
SHA256 eb26532e47ee05f0955aff17ec34aee4494813ac6e21f8ed23fb2cf13c0a5ce2
MD5 add01ea871048abc10a13176b6787f10
SHA1 f55ed3bde96acd776b8f9e0d35fc6c20badd0dd3
SHA512 aa34afbe73e8e237c82eec53e1c1d8c69ef5c5ed8f49ade89c1f8a0dd4a48140ce28514be717202ee38f1f24ed432427e33239b363a0ee737fe63786b2b8ee93
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233e2-4.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f5-10.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f6-11.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000233e9-24.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-27.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-39.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-46.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-66.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-69.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-105.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233e2-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f5-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f6-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000233e9-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3420-0-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	UPX
behavioral2/files/0x00090000000233e2-4.dat	UPX
behavioral2/memory/436-6-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	UPX
behavioral2/files/0x00080000000233f5-10.dat	UPX
behavioral2/files/0x00080000000233f6-11.dat	UPX
behavioral2/memory/2356-14-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	UPX
behavioral2/memory/2324-18-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	UPX
behavioral2/files/0x00090000000233e9-24.dat	UPX
behavioral2/files/0x00070000000233f7-27.dat	UPX
behavioral2/memory/4108-37-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-39.dat	UPX
behavioral2/memory/4872-41-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f8-36.dat	UPX
behavioral2/memory/4344-30-0x00007FF779110000-0x00007FF779464000-memory.dmp	UPX
behavioral2/memory/516-26-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	UPX
behavioral2/files/0x00070000000233fa-46.dat	UPX
behavioral2/files/0x00070000000233fb-53.dat	UPX
behavioral2/memory/1968-52-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	UPX
behavioral2/memory/432-63-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fc-66.dat	UPX
behavioral2/files/0x00070000000233fd-69.dat	UPX
behavioral2/memory/1052-68-0x00007FF661530000-0x00007FF661884000-memory.dmp	UPX
behavioral2/memory/436-64-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	UPX
behavioral2/memory/3420-60-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	UPX
behavioral2/memory/4636-58-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fe-74.dat	UPX
behavioral2/files/0x0007000000023401-82.dat	UPX
behavioral2/files/0x0007000000023400-87.dat	UPX
behavioral2/memory/516-86-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	UPX
behavioral2/memory/1808-94-0x00007FF7A5A00000-0x00007FF7A5D54000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-96.dat	UPX
behavioral2/files/0x0007000000023404-107.dat	UPX
behavioral2/files/0x0007000000023406-114.dat	UPX
behavioral2/files/0x0007000000023407-118.dat	UPX
behavioral2/files/0x0007000000023408-123.dat	UPX
behavioral2/files/0x0007000000023405-109.dat	UPX
behavioral2/files/0x0007000000023402-105.dat	UPX
behavioral2/memory/1404-92-0x00007FF6E60A0000-0x00007FF6E63F4000-memory.dmp	UPX
behavioral2/memory/2324-83-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	UPX
behavioral2/memory/1352-78-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	UPX
behavioral2/memory/2380-125-0x00007FF6B3930000-0x00007FF6B3C84000-memory.dmp	UPX
behavioral2/memory/1064-127-0x00007FF6B1450000-0x00007FF6B17A4000-memory.dmp	UPX
behavioral2/memory/3384-126-0x00007FF6B8A50000-0x00007FF6B8DA4000-memory.dmp	UPX
behavioral2/memory/1548-128-0x00007FF6FB840000-0x00007FF6FBB94000-memory.dmp	UPX
behavioral2/memory/3496-130-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp	UPX
behavioral2/memory/4344-129-0x00007FF779110000-0x00007FF779464000-memory.dmp	UPX
behavioral2/memory/636-131-0x00007FF77F230000-0x00007FF77F584000-memory.dmp	UPX
behavioral2/memory/4784-132-0x00007FF707400000-0x00007FF707754000-memory.dmp	UPX
behavioral2/memory/4108-133-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	UPX
behavioral2/memory/4872-134-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	UPX
behavioral2/memory/432-135-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	UPX
behavioral2/memory/1052-136-0x00007FF661530000-0x00007FF661884000-memory.dmp	UPX
behavioral2/memory/436-137-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	UPX
behavioral2/memory/2356-138-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	UPX
behavioral2/memory/2324-139-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	UPX
behavioral2/memory/516-140-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	UPX
behavioral2/memory/4344-141-0x00007FF779110000-0x00007FF779464000-memory.dmp	UPX
behavioral2/memory/4108-142-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	UPX
behavioral2/memory/4872-143-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	UPX
behavioral2/memory/1968-144-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	UPX
behavioral2/memory/4636-145-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	UPX
behavioral2/memory/432-146-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	UPX
behavioral2/memory/1052-147-0x00007FF661530000-0x00007FF661884000-memory.dmp	UPX
behavioral2/memory/1352-148-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3420-0-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233e2-4.dat	xmrig
behavioral2/memory/436-6-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f5-10.dat	xmrig
behavioral2/files/0x00080000000233f6-11.dat	xmrig
behavioral2/memory/2356-14-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	xmrig
behavioral2/memory/2324-18-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	xmrig
behavioral2/files/0x00090000000233e9-24.dat	xmrig
behavioral2/files/0x00070000000233f7-27.dat	xmrig
behavioral2/memory/4108-37-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-39.dat	xmrig
behavioral2/memory/4872-41-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f8-36.dat	xmrig
behavioral2/memory/4344-30-0x00007FF779110000-0x00007FF779464000-memory.dmp	xmrig
behavioral2/memory/516-26-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-46.dat	xmrig
behavioral2/files/0x00070000000233fb-53.dat	xmrig
behavioral2/memory/1968-52-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	xmrig
behavioral2/memory/432-63-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-66.dat	xmrig
behavioral2/files/0x00070000000233fd-69.dat	xmrig
behavioral2/memory/1052-68-0x00007FF661530000-0x00007FF661884000-memory.dmp	xmrig
behavioral2/memory/436-64-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	xmrig
behavioral2/memory/3420-60-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	xmrig
behavioral2/memory/4636-58-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-74.dat	xmrig
behavioral2/files/0x0007000000023401-82.dat	xmrig
behavioral2/files/0x0007000000023400-87.dat	xmrig
behavioral2/memory/516-86-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	xmrig
behavioral2/memory/1808-94-0x00007FF7A5A00000-0x00007FF7A5D54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-96.dat	xmrig
behavioral2/files/0x0007000000023404-107.dat	xmrig
behavioral2/files/0x0007000000023406-114.dat	xmrig
behavioral2/files/0x0007000000023407-118.dat	xmrig
behavioral2/files/0x0007000000023408-123.dat	xmrig
behavioral2/files/0x0007000000023405-109.dat	xmrig
behavioral2/files/0x0007000000023402-105.dat	xmrig
behavioral2/memory/1404-92-0x00007FF6E60A0000-0x00007FF6E63F4000-memory.dmp	xmrig
behavioral2/memory/2324-83-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	xmrig
behavioral2/memory/1352-78-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	xmrig
behavioral2/memory/2380-125-0x00007FF6B3930000-0x00007FF6B3C84000-memory.dmp	xmrig
behavioral2/memory/1064-127-0x00007FF6B1450000-0x00007FF6B17A4000-memory.dmp	xmrig
behavioral2/memory/3384-126-0x00007FF6B8A50000-0x00007FF6B8DA4000-memory.dmp	xmrig
behavioral2/memory/1548-128-0x00007FF6FB840000-0x00007FF6FBB94000-memory.dmp	xmrig
behavioral2/memory/3496-130-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp	xmrig
behavioral2/memory/4344-129-0x00007FF779110000-0x00007FF779464000-memory.dmp	xmrig
behavioral2/memory/636-131-0x00007FF77F230000-0x00007FF77F584000-memory.dmp	xmrig
behavioral2/memory/4784-132-0x00007FF707400000-0x00007FF707754000-memory.dmp	xmrig
behavioral2/memory/4108-133-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	xmrig
behavioral2/memory/4872-134-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	xmrig
behavioral2/memory/432-135-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	xmrig
behavioral2/memory/1052-136-0x00007FF661530000-0x00007FF661884000-memory.dmp	xmrig
behavioral2/memory/436-137-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	xmrig
behavioral2/memory/2356-138-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	xmrig
behavioral2/memory/2324-139-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	xmrig
behavioral2/memory/516-140-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	xmrig
behavioral2/memory/4344-141-0x00007FF779110000-0x00007FF779464000-memory.dmp	xmrig
behavioral2/memory/4108-142-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	xmrig
behavioral2/memory/4872-143-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	xmrig
behavioral2/memory/1968-144-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	xmrig
behavioral2/memory/4636-145-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	xmrig
behavioral2/memory/432-146-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	xmrig
behavioral2/memory/1052-147-0x00007FF661530000-0x00007FF661884000-memory.dmp	xmrig
behavioral2/memory/1352-148-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
436	ensiZQx.exe
2356	iuTAVgp.exe
2324	WGJSgzL.exe
516	ijwCbWa.exe
4344	xgDwKYe.exe
4108	SnbpoSU.exe
4872	BITDaQD.exe
1968	Evquyic.exe
4636	GubrurO.exe
432	hBRITIi.exe
1052	WIUhocL.exe
1352	jDtpsTL.exe
1404	gBylwDU.exe
1808	UvngYUO.exe
3496	qRyxEjC.exe
636	Auszoqx.exe
2380	UgHZFGn.exe
4784	woUrdfK.exe
3384	DLaURQS.exe
1064	suPtSPS.exe
1548	bELyVFJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3420-0-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	upx
behavioral2/files/0x00090000000233e2-4.dat	upx
behavioral2/memory/436-6-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	upx
behavioral2/files/0x00080000000233f5-10.dat	upx
behavioral2/files/0x00080000000233f6-11.dat	upx
behavioral2/memory/2356-14-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	upx
behavioral2/memory/2324-18-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	upx
behavioral2/files/0x00090000000233e9-24.dat	upx
behavioral2/files/0x00070000000233f7-27.dat	upx
behavioral2/memory/4108-37-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-39.dat	upx
behavioral2/memory/4872-41-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-36.dat	upx
behavioral2/memory/4344-30-0x00007FF779110000-0x00007FF779464000-memory.dmp	upx
behavioral2/memory/516-26-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-46.dat	upx
behavioral2/files/0x00070000000233fb-53.dat	upx
behavioral2/memory/1968-52-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	upx
behavioral2/memory/432-63-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-66.dat	upx
behavioral2/files/0x00070000000233fd-69.dat	upx
behavioral2/memory/1052-68-0x00007FF661530000-0x00007FF661884000-memory.dmp	upx
behavioral2/memory/436-64-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	upx
behavioral2/memory/3420-60-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp	upx
behavioral2/memory/4636-58-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-74.dat	upx
behavioral2/files/0x0007000000023401-82.dat	upx
behavioral2/files/0x0007000000023400-87.dat	upx
behavioral2/memory/516-86-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	upx
behavioral2/memory/1808-94-0x00007FF7A5A00000-0x00007FF7A5D54000-memory.dmp	upx
behavioral2/files/0x0007000000023403-96.dat	upx
behavioral2/files/0x0007000000023404-107.dat	upx
behavioral2/files/0x0007000000023406-114.dat	upx
behavioral2/files/0x0007000000023407-118.dat	upx
behavioral2/files/0x0007000000023408-123.dat	upx
behavioral2/files/0x0007000000023405-109.dat	upx
behavioral2/files/0x0007000000023402-105.dat	upx
behavioral2/memory/1404-92-0x00007FF6E60A0000-0x00007FF6E63F4000-memory.dmp	upx
behavioral2/memory/2324-83-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	upx
behavioral2/memory/1352-78-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	upx
behavioral2/memory/2380-125-0x00007FF6B3930000-0x00007FF6B3C84000-memory.dmp	upx
behavioral2/memory/1064-127-0x00007FF6B1450000-0x00007FF6B17A4000-memory.dmp	upx
behavioral2/memory/3384-126-0x00007FF6B8A50000-0x00007FF6B8DA4000-memory.dmp	upx
behavioral2/memory/1548-128-0x00007FF6FB840000-0x00007FF6FBB94000-memory.dmp	upx
behavioral2/memory/3496-130-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp	upx
behavioral2/memory/4344-129-0x00007FF779110000-0x00007FF779464000-memory.dmp	upx
behavioral2/memory/636-131-0x00007FF77F230000-0x00007FF77F584000-memory.dmp	upx
behavioral2/memory/4784-132-0x00007FF707400000-0x00007FF707754000-memory.dmp	upx
behavioral2/memory/4108-133-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	upx
behavioral2/memory/4872-134-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	upx
behavioral2/memory/432-135-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	upx
behavioral2/memory/1052-136-0x00007FF661530000-0x00007FF661884000-memory.dmp	upx
behavioral2/memory/436-137-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp	upx
behavioral2/memory/2356-138-0x00007FF614590000-0x00007FF6148E4000-memory.dmp	upx
behavioral2/memory/2324-139-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp	upx
behavioral2/memory/516-140-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp	upx
behavioral2/memory/4344-141-0x00007FF779110000-0x00007FF779464000-memory.dmp	upx
behavioral2/memory/4108-142-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp	upx
behavioral2/memory/4872-143-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp	upx
behavioral2/memory/1968-144-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp	upx
behavioral2/memory/4636-145-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp	upx
behavioral2/memory/432-146-0x00007FF612570000-0x00007FF6128C4000-memory.dmp	upx
behavioral2/memory/1052-147-0x00007FF661530000-0x00007FF661884000-memory.dmp	upx
behavioral2/memory/1352-148-0x00007FF625CD0000-0x00007FF626024000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WGJSgzL.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qRyxEjC.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ijwCbWa.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jDtpsTL.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ensiZQx.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iuTAVgp.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xgDwKYe.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BITDaQD.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Evquyic.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GubrurO.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WIUhocL.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UvngYUO.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DLaURQS.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\suPtSPS.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bELyVFJ.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SnbpoSU.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hBRITIi.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gBylwDU.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Auszoqx.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UgHZFGn.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\woUrdfK.exe	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 436	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	83
PID 3420 wrote to memory of 436	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	83
PID 3420 wrote to memory of 2356	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	84
PID 3420 wrote to memory of 2356	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	84
PID 3420 wrote to memory of 2324	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	85
PID 3420 wrote to memory of 2324	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	85
PID 3420 wrote to memory of 516	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	86
PID 3420 wrote to memory of 516	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	86
PID 3420 wrote to memory of 4344	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	87
PID 3420 wrote to memory of 4344	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	87
PID 3420 wrote to memory of 4108	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	88
PID 3420 wrote to memory of 4108	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	88
PID 3420 wrote to memory of 4872	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	89
PID 3420 wrote to memory of 4872	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	89
PID 3420 wrote to memory of 1968	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	90
PID 3420 wrote to memory of 1968	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	90
PID 3420 wrote to memory of 4636	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	91
PID 3420 wrote to memory of 4636	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	91
PID 3420 wrote to memory of 432	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	92
PID 3420 wrote to memory of 432	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	92
PID 3420 wrote to memory of 1052	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	93
PID 3420 wrote to memory of 1052	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	93
PID 3420 wrote to memory of 1352	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	94
PID 3420 wrote to memory of 1352	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	94
PID 3420 wrote to memory of 1404	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	95
PID 3420 wrote to memory of 1404	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	95
PID 3420 wrote to memory of 1808	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	96
PID 3420 wrote to memory of 1808	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	96
PID 3420 wrote to memory of 3496	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	97
PID 3420 wrote to memory of 3496	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	97
PID 3420 wrote to memory of 636	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	99
PID 3420 wrote to memory of 636	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	99
PID 3420 wrote to memory of 2380	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	100
PID 3420 wrote to memory of 2380	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	100
PID 3420 wrote to memory of 4784	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	101
PID 3420 wrote to memory of 4784	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	101
PID 3420 wrote to memory of 3384	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	102
PID 3420 wrote to memory of 3384	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	102
PID 3420 wrote to memory of 1064	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	103
PID 3420 wrote to memory of 1064	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	103
PID 3420 wrote to memory of 1548	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	104
PID 3420 wrote to memory of 1548	3420	2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_add01ea871048abc10a13176b6787f10_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System\ensiZQx.exe
  C:\Windows\System\ensiZQx.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\iuTAVgp.exe
  C:\Windows\System\iuTAVgp.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\WGJSgzL.exe
  C:\Windows\System\WGJSgzL.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ijwCbWa.exe
  C:\Windows\System\ijwCbWa.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\xgDwKYe.exe
  C:\Windows\System\xgDwKYe.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\SnbpoSU.exe
  C:\Windows\System\SnbpoSU.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\BITDaQD.exe
  C:\Windows\System\BITDaQD.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\Evquyic.exe
  C:\Windows\System\Evquyic.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\GubrurO.exe
  C:\Windows\System\GubrurO.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\hBRITIi.exe
  C:\Windows\System\hBRITIi.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\WIUhocL.exe
  C:\Windows\System\WIUhocL.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\jDtpsTL.exe
  C:\Windows\System\jDtpsTL.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\gBylwDU.exe
  C:\Windows\System\gBylwDU.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\UvngYUO.exe
  C:\Windows\System\UvngYUO.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\qRyxEjC.exe
  C:\Windows\System\qRyxEjC.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\Auszoqx.exe
  C:\Windows\System\Auszoqx.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\UgHZFGn.exe
  C:\Windows\System\UgHZFGn.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\woUrdfK.exe
  C:\Windows\System\woUrdfK.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\DLaURQS.exe
  C:\Windows\System\DLaURQS.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\suPtSPS.exe
  C:\Windows\System\suPtSPS.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\bELyVFJ.exe
  C:\Windows\System\bELyVFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Auszoqx.exe

Path C:\Windows\System\Auszoqx.exe
Size 5.9MB
SHA256 470026a3befafbd7ea7daba1c6a730597498ed5276311f42f3d8a43af23b0795
MD5 9561dd5503161036868f2c938d174338
SHA1 470612521b4700ba55529d381c582bb8c32183e5
SHA512 37137fcf0872166627ee5756efdb8f995c9487cd00e8230bd4154835f41ce7fd8b79a26ad9d8ace4ed3d89ed84b17f42cf92de404219f714ca6ef81c032ee90c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

BITDaQD.exe

Path C:\Windows\System\BITDaQD.exe
Size 5.9MB
SHA256 dee267f5233f65f09ee23d65a3e4f320e21917846cdee45f64bcf3270cb53154
MD5 df8c2a1fefceec0a9e8dd2b1b64e97e2
SHA1 c39611ff2a7a428d155576c379b36aae01f41c6c
SHA512 a1cd572042a91ffb3b738a5971008139c0dca6dda565f8cae90d248fa4172c49ae317297034c6966e51d227fbf0f09a4b6c250bb693e472b8124bc4db6bcc91f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

DLaURQS.exe

Path C:\Windows\System\DLaURQS.exe
Size 5.9MB
SHA256 9c5b1d69d9da6af5dcdc6d05defa6ec47cf3c69ecf2e4c750efac82206dc316c
MD5 ede0a50a038621bf376d4f93fc61f21e
SHA1 c3b1863dfd65f4b8c21df3c6a00608bcfd4430f5
SHA512 349a0cb4aa718a5fbd7354150da73e10c701029d882677c21f1cf075707017673c9595022ce74ff456194634ec35b0b2e5cddd89b36fce64d4cc57fc1dd4c778
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Evquyic.exe

Path C:\Windows\System\Evquyic.exe
Size 5.9MB
SHA256 ee741d97d5a2d6f02336abe7e0a857985db6aad48d7904fcc3c38c05e7ff0948
MD5 4c8fe29752b99be7980c2a660f4228d6
SHA1 efd1356c0ff9d51d5e217f8df30c70567235a82f
SHA512 8b7784c4e0611a0564b6358ed31c2da36d09a92ca99eaf4a01f636796110d1cd16f797e2c5528b3333c7c7d3b36f2c87fca24782d8760c3db5516a41bb04a800
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

GubrurO.exe

Path C:\Windows\System\GubrurO.exe
Size 5.9MB
SHA256 6dd0826fd66f21b8e3364b810a6b3b835b0845b00e2e3b22fca2def1520346c9
MD5 d92d68799f4ee922c0b4f923d3dc015f
SHA1 a1b9bc8caad5b12b4a7604b5ce3a64f6f6bf7cbf
SHA512 2f29e59142d4a2097cbcd7b321c383c9dbcd416e655f33d9ebd792f5a70890116e17eca701f263c9dfdd55433b418a76fe87d64e054fb2709821a9da69eb5cf0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnbpoSU.exe

Path C:\Windows\System\SnbpoSU.exe
Size 5.9MB
SHA256 71be7ee3b04c7cee4cf9efc7dde048df869e91629459631491783146419306e7
MD5 29c26a5a5f8aaf26d4a22b5c94b9dde8
SHA1 b115be3f0a4a18a81e6b89321c748c37893197aa
SHA512 e721df1bf372ad5538ff7787baf89a00a02f6f70fb1dddb7f3b0ede40b2342bcdb25192235972a1b6c836f1e7a1b444adf6464d92f0070bfea444fcea09c0cdd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

UgHZFGn.exe

Path C:\Windows\System\UgHZFGn.exe
Size 5.9MB
SHA256 5f3d1cd435aa5bea51e7d909247b36071b4b661eb65bbca1295b3269be737a3a
MD5 753b1a8917e1a3ef1c66234f32fcd480
SHA1 0889af08cf21b19ff866ad32c7ae04a2ced0e9ec
SHA512 e9d6d1e80defda179f30b0d1472e6e91bc22634c7c147607640694e13215ed7c015331eac0f52b000540e5f7774db4b8dc040ac00b0260ff6e9e9c8c2db92747
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

UvngYUO.exe

Path C:\Windows\System\UvngYUO.exe
Size 5.9MB
SHA256 eee3eadd1ebb4e40c40c9328a53850e0551d28c1db72a8be24221a7523113ba5
MD5 1839cc980d859d4087e358f952076824
SHA1 ba163bc91a64b3b607ec7ef5fa96158b8f96bbe4
SHA512 a9acb6009d14ad5a0160ddaf7b876555fd93711bf7a3e67841b8db12b03b58703fd4a7f2547fcca9e6be7603aeb71847db9047b9be8c319e53aa517f9ca8e3e2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

WGJSgzL.exe

Path C:\Windows\System\WGJSgzL.exe
Size 5.9MB
SHA256 8c9162ae5f2b540010b98cb49876654f71b98357d266004b16f0c30379bedae9
MD5 55ae7edd05be0778237ea66942cd10ed
SHA1 4ae4f2c1d8f5618d08b1c9c68fe53438a3dd520c
SHA512 3da57467006fe89c64a40e39a5ef8fcb9f33253361da3fa79a4755c179b6b92af241b4a2588756d5da5599d638769df73e122f2e9942f627c98358f38e727019
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

WIUhocL.exe

Path C:\Windows\System\WIUhocL.exe
Size 5.9MB
SHA256 b103be2104138856a27492f1c953f46ace90dbd3eabaaa0da79052ef8f4fefdc
MD5 efca6979e3739e438a325cfa3d0197b7
SHA1 602a34ce14ca9f3c08e39fbef745970ad07557f1
SHA512 67446dea0733278519a3bd66bb519bdfc7e8812171e2cd60bc1ca5f76aa9501c5b0c4c7158ca372a84a2d536b78954984dbd2a5d4839bf247be4b010a9358c94
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

bELyVFJ.exe

Path C:\Windows\System\bELyVFJ.exe
Size 5.9MB
SHA256 4b59de9d55230599eec1fa5a3c1cec1b270072244c0e8dac0abc59ce8daa7fd3
MD5 316cc2fc6d49d64eb53d9f444826e131
SHA1 70cdcb60383b8535605d783ce2f2ff2e91eff94b
SHA512 b7abc46254679b9d64e5de7f8b96c1d6d97dd858af82b249b88a71c851cafa11a6bf008b285f6236f0019491df73e8a7750b68c2d450836d17b18e74182bcfb8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ensiZQx.exe

Path C:\Windows\System\ensiZQx.exe
Size 5.9MB
SHA256 b8533c7d45cf11ab1ff3cba40b1cb68668c22ea1538a08fc8fe358db64971616
MD5 ea28c857217afb0320a9dfd8ade3954b
SHA1 68a950340d556f41bbd0e765e4bd8aa4fde9cfc0
SHA512 75df49437a6648573b8ba3727d14d6670536dd4d4eb203433021307774871fd70271f1a95e0f16372a7e3a4c8c67bcd0f19ebd28bf1d50b03e3b4c81f5941d5e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

gBylwDU.exe

Path C:\Windows\System\gBylwDU.exe
Size 5.9MB
SHA256 d329a72666e7b06420183e5fb6fdb20c6a93b39384ae9fd8d092feb7d6fdeff4
MD5 af8838510da53407bc943cf4ce046b7f
SHA1 8cc47644c8e4ac456fea8078cf47b50392646c27
SHA512 d234c3b660e4f629b760bdd2760af080285729043d899c0dcafd25fb922e7a0f891afff27a8a6ff3f739e7b3a9452be27b7c8a349072bde065bd4cd848782bef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

hBRITIi.exe

Path C:\Windows\System\hBRITIi.exe
Size 5.9MB
SHA256 9ee40c29ab2bb7cde9dedca0c1869d1ebfb40ca2e10d45a5c55e47a27fe1100d
MD5 06382dcd28e76c70220dc616a78c4565
SHA1 190ec4e23f806ca7e4216af396d32d8399804237
SHA512 824421106533142f8c736524ae95fa425f96cf43dd4043fe339f8a7ca680ee6700048eae7343c0c04ee85f2b3deaec438700a429627ebcefce4025ae93803d44
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

ijwCbWa.exe

Path C:\Windows\System\ijwCbWa.exe
Size 5.9MB
SHA256 6be107eea6c064b784bb48e518340a48aeb6be1058d9e6b144fe72b1361b0e65
MD5 499313e8283a8ead045aeb596d5ef856
SHA1 822743b06ecef72593179967964337292a51d80d
SHA512 57c5b9099f2d53bebcc803f17cae79217eb4f6c5a48ac6f4ac382d8ea598705fca543ca94974952cae5c9d8456ba45ebd58d649a8755a76e2a74f9468b95669c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

iuTAVgp.exe

Path C:\Windows\System\iuTAVgp.exe
Size 5.9MB
SHA256 931ac92a2f4e291db5ac7e6c61b893cad3dc6ccbfc7e910c6e195ebb0a839661
MD5 9ad38e2d332e4ce2a29fe697d64112b7
SHA1 3c878bbf03c4e4f877dc1f9a2713aa3c6ca35977
SHA512 93d371be6aa3393ad3441298aef8f61ff31c714fd31b6987a3bd2c6bc4dd2a7f68db726dbc84360eb7ac221e74b2fe76ad6a90cd7c1205873c5ba16de1969cd0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

jDtpsTL.exe

Path C:\Windows\System\jDtpsTL.exe
Size 5.9MB
SHA256 1ce87f9923105c4104532b8bf083abf5161b47c3bceaec782c922959d0053995
MD5 a9be2273e18d7b6d927a70effa1235f0
SHA1 71b59dd3434a1cbe208a69852f05af04da1e7412
SHA512 d05a539354a7c8ec2c0444d7cd6151ca273583a45d7a262a49d60acdaff8ecb651cd1ea31e124d6423f219493c95e66e078f401ecdaf22ab00aac1a649af540e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

qRyxEjC.exe

Path C:\Windows\System\qRyxEjC.exe
Size 5.9MB
SHA256 06af4ce4f43b51997c49b85856ad74216f180d3571017962f3e479a610c87f95
MD5 4e87fc1c479bfa8107c94b76a3545490
SHA1 ab7e8fb39571bde2df722a782908cb3a5fb425ba
SHA512 52139454fca9d668ed37dba9cb6df16b598a3ae76f8d04963a616ad107215f5152e611594e4dd7676035513be6c2752bc45c21a11228ac6b8906334fa02bd69a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

suPtSPS.exe

Path C:\Windows\System\suPtSPS.exe
Size 5.9MB
SHA256 ba5dbce9ff3188e3bafe86f3b40a9539c0ce74bd38f742b76e4b818df1cfe48c
MD5 ba40df05c6761c4d3268fcccd755da38
SHA1 cf0797fa99824d8f065b97a874e2f91a98943a33
SHA512 d6ffb7442c788b1019ecddf8de9be9adf840f6f6632a011140c19b44861a34e9fb8ad6e13e6a98e4a232edb6cba172611a7af0308b3e696a84048d08ef438eb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

woUrdfK.exe

Path C:\Windows\System\woUrdfK.exe
Size 5.9MB
SHA256 fda9e7ae99aa563b3ae901727801d5a1409b37a339a208a5f81db0e7c9a7bf9f
MD5 2e5ee59427caec271c412c70de67d876
SHA1 23287fe3fc8c0c3eafcec4318030a07f52decea4
SHA512 c864dc1bcc8298f69adcb4c1f5174b47ac11c97540381d87195b132fc415d9b75ae261782980215b90bb187ea9b5874c9535d54ad2df8a2f74aeef9bdd88432e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

xgDwKYe.exe

Path C:\Windows\System\xgDwKYe.exe
Size 5.9MB
SHA256 3d84ec46f2a832a49be438d94d78f52727db3ca93ba9211320af9e07326fd8bc
MD5 1ba98e8b2d73afb786d74788b5f4f24c
SHA1 4ae7dd0a71caba263e16647fe19481553d373c30
SHA512 3f6d2b5c59b4760cd00ee15642e73bc575236e07357367ceb7c94c9d4841fad547dfd469c4910e2f961e2c43251f5a86daeac7eb79e9f4c536260a9bb6634138
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-63-0x00007FF612570000-0x00007FF6128C4000-memory.dmp

Download

memory/432-135-0x00007FF612570000-0x00007FF6128C4000-memory.dmp

Download

memory/432-146-0x00007FF612570000-0x00007FF6128C4000-memory.dmp

Download

memory/436-64-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp

Download

memory/436-137-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp

Download

memory/436-6-0x00007FF612D70000-0x00007FF6130C4000-memory.dmp

Download

memory/516-140-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp

Download

memory/516-26-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp

Download

memory/516-86-0x00007FF7B80E0000-0x00007FF7B8434000-memory.dmp

Download

memory/636-131-0x00007FF77F230000-0x00007FF77F584000-memory.dmp

Download

memory/636-151-0x00007FF77F230000-0x00007FF77F584000-memory.dmp

Download

memory/1052-68-0x00007FF661530000-0x00007FF661884000-memory.dmp

Download

memory/1052-147-0x00007FF661530000-0x00007FF661884000-memory.dmp

Download

memory/1052-136-0x00007FF661530000-0x00007FF661884000-memory.dmp

Download

memory/1064-157-0x00007FF6B1450000-0x00007FF6B17A4000-memory.dmp

Download

memory/1064-127-0x00007FF6B1450000-0x00007FF6B17A4000-memory.dmp

Download

memory/1352-148-0x00007FF625CD0000-0x00007FF626024000-memory.dmp

Download

memory/1352-78-0x00007FF625CD0000-0x00007FF626024000-memory.dmp

Download

memory/1404-149-0x00007FF6E60A0000-0x00007FF6E63F4000-memory.dmp

Download

memory/1404-92-0x00007FF6E60A0000-0x00007FF6E63F4000-memory.dmp

Download

memory/1548-155-0x00007FF6FB840000-0x00007FF6FBB94000-memory.dmp

Download

memory/1548-128-0x00007FF6FB840000-0x00007FF6FBB94000-memory.dmp

Download

memory/1808-150-0x00007FF7A5A00000-0x00007FF7A5D54000-memory.dmp

Download

memory/1808-94-0x00007FF7A5A00000-0x00007FF7A5D54000-memory.dmp

Download

memory/1968-52-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp

Download

memory/1968-144-0x00007FF644A70000-0x00007FF644DC4000-memory.dmp

Download

memory/2324-18-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp

Download

memory/2324-139-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp

Download

memory/2324-83-0x00007FF738BB0000-0x00007FF738F04000-memory.dmp

Download

memory/2356-138-0x00007FF614590000-0x00007FF6148E4000-memory.dmp

Download

memory/2356-14-0x00007FF614590000-0x00007FF6148E4000-memory.dmp

Download

memory/2380-125-0x00007FF6B3930000-0x00007FF6B3C84000-memory.dmp

Download

memory/2380-153-0x00007FF6B3930000-0x00007FF6B3C84000-memory.dmp

Download

memory/3384-156-0x00007FF6B8A50000-0x00007FF6B8DA4000-memory.dmp

Download

memory/3384-126-0x00007FF6B8A50000-0x00007FF6B8DA4000-memory.dmp

Download

memory/3420-1-0x000002842F640000-0x000002842F650000-memory.dmp

Download

memory/3420-60-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp

Download

memory/3420-0-0x00007FF66EB60000-0x00007FF66EEB4000-memory.dmp

Download

memory/3496-130-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp

Download

memory/3496-152-0x00007FF7CC810000-0x00007FF7CCB64000-memory.dmp

Download

memory/4108-142-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp

Download

memory/4108-37-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp

Download

memory/4108-133-0x00007FF649DD0000-0x00007FF64A124000-memory.dmp

Download

memory/4344-141-0x00007FF779110000-0x00007FF779464000-memory.dmp

Download

memory/4344-129-0x00007FF779110000-0x00007FF779464000-memory.dmp

Download

memory/4344-30-0x00007FF779110000-0x00007FF779464000-memory.dmp

Download

memory/4636-145-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp

Download

memory/4636-58-0x00007FF63A360000-0x00007FF63A6B4000-memory.dmp

Download

memory/4784-132-0x00007FF707400000-0x00007FF707754000-memory.dmp

Download

memory/4784-154-0x00007FF707400000-0x00007FF707754000-memory.dmp

Download

memory/4872-41-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp

Download

memory/4872-134-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp

Download

memory/4872-143-0x00007FF62FF60000-0x00007FF6302B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads