cobaltstrike | d297bc4d1c751c5e633393bda61b9de7f48c4c53788fb0c9ad4c2d3b79e70cf5

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-22gl8abe23
SHA256 d297bc4d1c751c5e633393bda61b9de7f48c4c53788fb0c9ad4c2d3b79e70cf5
MD5 3f33c8862acbe89454ec7e65b4f53b0f
SHA1 a4665831cc0ad4d75e53bbb7042ace98d03cde3e
SHA512 3cc09ce05ff7e247ec6def4a91d77f83d28eca20b270ee837eb44e55c1a250c15a69e4878eeaa257bac1ae1dd0b8f1c4f281b0d9383408c49a6714d42c738183
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233fa-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023403-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-72.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000022974-94.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000022ab6-104.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023364-118.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023366-123.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023363-114.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000022abf-111.dat	cobalt_reflective_dll
behavioral2/files/0x0011000000016964-97.dat	cobalt_reflective_dll
behavioral2/files/0x000400000002296c-90.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000000002c-87.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233fa-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023403-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000022974-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000022ab6-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023364-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023366-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023363-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000022abf-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0011000000016964-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000400000002296c-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000000002c-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2928-0-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	UPX
behavioral2/files/0x00090000000233fa-4.dat	UPX
behavioral2/memory/2648-8-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023406-11.dat	UPX
behavioral2/files/0x0007000000023407-10.dat	UPX
behavioral2/memory/3380-14-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	UPX
behavioral2/memory/3976-20-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	UPX
behavioral2/files/0x0008000000023403-24.dat	UPX
behavioral2/memory/6128-26-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-30.dat	UPX
behavioral2/memory/1224-32-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	UPX
behavioral2/files/0x0007000000023409-36.dat	UPX
behavioral2/files/0x000700000002340b-42.dat	UPX
behavioral2/memory/368-38-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-46.dat	UPX
behavioral2/files/0x000700000002340d-51.dat	UPX
behavioral2/memory/5712-52-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-59.dat	UPX
behavioral2/memory/1764-57-0x00007FF759940000-0x00007FF759C94000-memory.dmp	UPX
behavioral2/memory/1828-53-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	UPX
behavioral2/memory/4192-62-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	UPX
behavioral2/files/0x000700000002340f-64.dat	UPX
behavioral2/memory/1076-68-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-72.dat	UPX
behavioral2/memory/1824-81-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	UPX
behavioral2/files/0x0003000000022974-94.dat	UPX
behavioral2/memory/2292-99-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	UPX
behavioral2/files/0x0003000000022ab6-104.dat	UPX
behavioral2/files/0x0008000000023364-118.dat	UPX
behavioral2/files/0x0008000000023366-123.dat	UPX
behavioral2/files/0x0008000000023363-114.dat	UPX
behavioral2/files/0x0003000000022abf-111.dat	UPX
behavioral2/memory/4980-103-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	UPX
behavioral2/files/0x0011000000016964-97.dat	UPX
behavioral2/memory/5672-93-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	UPX
behavioral2/memory/5668-91-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	UPX
behavioral2/files/0x000400000002296c-90.dat	UPX
behavioral2/files/0x000c00000000002c-87.dat	UPX
behavioral2/memory/5020-75-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	UPX
behavioral2/memory/2928-74-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	UPX
behavioral2/memory/2192-126-0x00007FF709890000-0x00007FF709BE4000-memory.dmp	UPX
behavioral2/memory/564-128-0x00007FF7B5280000-0x00007FF7B55D4000-memory.dmp	UPX
behavioral2/memory/5044-127-0x00007FF7F02F0000-0x00007FF7F0644000-memory.dmp	UPX
behavioral2/memory/4548-125-0x00007FF742460000-0x00007FF7427B4000-memory.dmp	UPX
behavioral2/memory/1824-129-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	UPX
behavioral2/memory/5672-130-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	UPX
behavioral2/memory/5668-131-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	UPX
behavioral2/memory/4980-133-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	UPX
behavioral2/memory/2292-132-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	UPX
behavioral2/memory/2648-134-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	UPX
behavioral2/memory/3380-135-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	UPX
behavioral2/memory/3976-136-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	UPX
behavioral2/memory/6128-137-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	UPX
behavioral2/memory/1224-138-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	UPX
behavioral2/memory/368-139-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	UPX
behavioral2/memory/5712-140-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	UPX
behavioral2/memory/1828-141-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	UPX
behavioral2/memory/1764-142-0x00007FF759940000-0x00007FF759C94000-memory.dmp	UPX
behavioral2/memory/4192-143-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	UPX
behavioral2/memory/1076-144-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	UPX
behavioral2/memory/5020-145-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	UPX
behavioral2/memory/1824-146-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	UPX
behavioral2/memory/5668-147-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	UPX
behavioral2/memory/5672-148-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2928-0-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	xmrig
behavioral2/files/0x00090000000233fa-4.dat	xmrig
behavioral2/memory/2648-8-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-11.dat	xmrig
behavioral2/files/0x0007000000023407-10.dat	xmrig
behavioral2/memory/3380-14-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	xmrig
behavioral2/memory/3976-20-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	xmrig
behavioral2/files/0x0008000000023403-24.dat	xmrig
behavioral2/memory/6128-26-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-30.dat	xmrig
behavioral2/memory/1224-32-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-36.dat	xmrig
behavioral2/files/0x000700000002340b-42.dat	xmrig
behavioral2/memory/368-38-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-46.dat	xmrig
behavioral2/files/0x000700000002340d-51.dat	xmrig
behavioral2/memory/5712-52-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-59.dat	xmrig
behavioral2/memory/1764-57-0x00007FF759940000-0x00007FF759C94000-memory.dmp	xmrig
behavioral2/memory/1828-53-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	xmrig
behavioral2/memory/4192-62-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-64.dat	xmrig
behavioral2/memory/1076-68-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-72.dat	xmrig
behavioral2/memory/1824-81-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	xmrig
behavioral2/files/0x0003000000022974-94.dat	xmrig
behavioral2/memory/2292-99-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	xmrig
behavioral2/files/0x0003000000022ab6-104.dat	xmrig
behavioral2/files/0x0008000000023364-118.dat	xmrig
behavioral2/files/0x0008000000023366-123.dat	xmrig
behavioral2/files/0x0008000000023363-114.dat	xmrig
behavioral2/files/0x0003000000022abf-111.dat	xmrig
behavioral2/memory/4980-103-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	xmrig
behavioral2/files/0x0011000000016964-97.dat	xmrig
behavioral2/memory/5672-93-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	xmrig
behavioral2/memory/5668-91-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	xmrig
behavioral2/files/0x000400000002296c-90.dat	xmrig
behavioral2/files/0x000c00000000002c-87.dat	xmrig
behavioral2/memory/5020-75-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	xmrig
behavioral2/memory/2928-74-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	xmrig
behavioral2/memory/2192-126-0x00007FF709890000-0x00007FF709BE4000-memory.dmp	xmrig
behavioral2/memory/564-128-0x00007FF7B5280000-0x00007FF7B55D4000-memory.dmp	xmrig
behavioral2/memory/5044-127-0x00007FF7F02F0000-0x00007FF7F0644000-memory.dmp	xmrig
behavioral2/memory/4548-125-0x00007FF742460000-0x00007FF7427B4000-memory.dmp	xmrig
behavioral2/memory/1824-129-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	xmrig
behavioral2/memory/5672-130-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	xmrig
behavioral2/memory/5668-131-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	xmrig
behavioral2/memory/4980-133-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	xmrig
behavioral2/memory/2292-132-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	xmrig
behavioral2/memory/2648-134-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	xmrig
behavioral2/memory/3380-135-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	xmrig
behavioral2/memory/3976-136-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	xmrig
behavioral2/memory/6128-137-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	xmrig
behavioral2/memory/1224-138-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	xmrig
behavioral2/memory/368-139-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	xmrig
behavioral2/memory/5712-140-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	xmrig
behavioral2/memory/1828-141-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	xmrig
behavioral2/memory/1764-142-0x00007FF759940000-0x00007FF759C94000-memory.dmp	xmrig
behavioral2/memory/4192-143-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	xmrig
behavioral2/memory/1076-144-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	xmrig
behavioral2/memory/5020-145-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	xmrig
behavioral2/memory/1824-146-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	xmrig
behavioral2/memory/5668-147-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	xmrig
behavioral2/memory/5672-148-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2648	udddrTc.exe
3380	YnoRhmB.exe
3976	heycZAP.exe
6128	KMTClVY.exe
1224	jTrkMVc.exe
368	PbglRZM.exe
5712	kJziBpX.exe
1828	TYngpNj.exe
1764	wTskcvT.exe
4192	HaslVag.exe
1076	cwFBAZa.exe
5020	NeXzIxx.exe
1824	JhnclVG.exe
5668	JUcCzjQ.exe
5672	nShaMwc.exe
4980	QKjLuls.exe
2292	aMJVIzK.exe
5044	jkeMIXg.exe
564	GTPnUiA.exe
4548	IEtQpnc.exe
2192	ShrAfxU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2928-0-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	upx
behavioral2/files/0x00090000000233fa-4.dat	upx
behavioral2/memory/2648-8-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	upx
behavioral2/files/0x0007000000023406-11.dat	upx
behavioral2/files/0x0007000000023407-10.dat	upx
behavioral2/memory/3380-14-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	upx
behavioral2/memory/3976-20-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	upx
behavioral2/files/0x0008000000023403-24.dat	upx
behavioral2/memory/6128-26-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	upx
behavioral2/files/0x0007000000023408-30.dat	upx
behavioral2/memory/1224-32-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	upx
behavioral2/files/0x0007000000023409-36.dat	upx
behavioral2/files/0x000700000002340b-42.dat	upx
behavioral2/memory/368-38-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	upx
behavioral2/files/0x000700000002340c-46.dat	upx
behavioral2/files/0x000700000002340d-51.dat	upx
behavioral2/memory/5712-52-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	upx
behavioral2/files/0x000700000002340e-59.dat	upx
behavioral2/memory/1764-57-0x00007FF759940000-0x00007FF759C94000-memory.dmp	upx
behavioral2/memory/1828-53-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	upx
behavioral2/memory/4192-62-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	upx
behavioral2/files/0x000700000002340f-64.dat	upx
behavioral2/memory/1076-68-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	upx
behavioral2/files/0x0007000000023410-72.dat	upx
behavioral2/memory/1824-81-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	upx
behavioral2/files/0x0003000000022974-94.dat	upx
behavioral2/memory/2292-99-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	upx
behavioral2/files/0x0003000000022ab6-104.dat	upx
behavioral2/files/0x0008000000023364-118.dat	upx
behavioral2/files/0x0008000000023366-123.dat	upx
behavioral2/files/0x0008000000023363-114.dat	upx
behavioral2/files/0x0003000000022abf-111.dat	upx
behavioral2/memory/4980-103-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	upx
behavioral2/files/0x0011000000016964-97.dat	upx
behavioral2/memory/5672-93-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	upx
behavioral2/memory/5668-91-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	upx
behavioral2/files/0x000400000002296c-90.dat	upx
behavioral2/files/0x000c00000000002c-87.dat	upx
behavioral2/memory/5020-75-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	upx
behavioral2/memory/2928-74-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp	upx
behavioral2/memory/2192-126-0x00007FF709890000-0x00007FF709BE4000-memory.dmp	upx
behavioral2/memory/564-128-0x00007FF7B5280000-0x00007FF7B55D4000-memory.dmp	upx
behavioral2/memory/5044-127-0x00007FF7F02F0000-0x00007FF7F0644000-memory.dmp	upx
behavioral2/memory/4548-125-0x00007FF742460000-0x00007FF7427B4000-memory.dmp	upx
behavioral2/memory/1824-129-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	upx
behavioral2/memory/5672-130-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	upx
behavioral2/memory/5668-131-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	upx
behavioral2/memory/4980-133-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp	upx
behavioral2/memory/2292-132-0x00007FF63B140000-0x00007FF63B494000-memory.dmp	upx
behavioral2/memory/2648-134-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp	upx
behavioral2/memory/3380-135-0x00007FF759860000-0x00007FF759BB4000-memory.dmp	upx
behavioral2/memory/3976-136-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp	upx
behavioral2/memory/6128-137-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp	upx
behavioral2/memory/1224-138-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp	upx
behavioral2/memory/368-139-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp	upx
behavioral2/memory/5712-140-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp	upx
behavioral2/memory/1828-141-0x00007FF671880000-0x00007FF671BD4000-memory.dmp	upx
behavioral2/memory/1764-142-0x00007FF759940000-0x00007FF759C94000-memory.dmp	upx
behavioral2/memory/4192-143-0x00007FF75A630000-0x00007FF75A984000-memory.dmp	upx
behavioral2/memory/1076-144-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp	upx
behavioral2/memory/5020-145-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp	upx
behavioral2/memory/1824-146-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp	upx
behavioral2/memory/5668-147-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp	upx
behavioral2/memory/5672-148-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\cwFBAZa.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JhnclVG.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QKjLuls.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IEtQpnc.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ShrAfxU.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KMTClVY.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wTskcvT.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HaslVag.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jkeMIXg.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JUcCzjQ.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aMJVIzK.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GTPnUiA.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YnoRhmB.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PbglRZM.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kJziBpX.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NeXzIxx.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nShaMwc.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\udddrTc.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\heycZAP.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jTrkMVc.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TYngpNj.exe	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2648	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	85
PID 2928 wrote to memory of 2648	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	85
PID 2928 wrote to memory of 3380	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	86
PID 2928 wrote to memory of 3380	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	86
PID 2928 wrote to memory of 3976	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	87
PID 2928 wrote to memory of 3976	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	87
PID 2928 wrote to memory of 6128	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	88
PID 2928 wrote to memory of 6128	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	88
PID 2928 wrote to memory of 1224	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	89
PID 2928 wrote to memory of 1224	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	89
PID 2928 wrote to memory of 368	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	90
PID 2928 wrote to memory of 368	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	90
PID 2928 wrote to memory of 5712	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	91
PID 2928 wrote to memory of 5712	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	91
PID 2928 wrote to memory of 1828	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	92
PID 2928 wrote to memory of 1828	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	92
PID 2928 wrote to memory of 1764	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	93
PID 2928 wrote to memory of 1764	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	93
PID 2928 wrote to memory of 4192	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	94
PID 2928 wrote to memory of 4192	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	94
PID 2928 wrote to memory of 1076	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	96
PID 2928 wrote to memory of 1076	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	96
PID 2928 wrote to memory of 5020	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	98
PID 2928 wrote to memory of 5020	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	98
PID 2928 wrote to memory of 1824	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	101
PID 2928 wrote to memory of 1824	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	101
PID 2928 wrote to memory of 5668	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	102
PID 2928 wrote to memory of 5668	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	102
PID 2928 wrote to memory of 5672	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	103
PID 2928 wrote to memory of 5672	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	103
PID 2928 wrote to memory of 4980	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	104
PID 2928 wrote to memory of 4980	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	104
PID 2928 wrote to memory of 2292	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	105
PID 2928 wrote to memory of 2292	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	105
PID 2928 wrote to memory of 5044	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	107
PID 2928 wrote to memory of 5044	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	107
PID 2928 wrote to memory of 564	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	108
PID 2928 wrote to memory of 564	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	108
PID 2928 wrote to memory of 4548	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	109
PID 2928 wrote to memory of 4548	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	109
PID 2928 wrote to memory of 2192	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	110
PID 2928 wrote to memory of 2192	2928	2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_3f33c8862acbe89454ec7e65b4f53b0f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\System\udddrTc.exe
  C:\Windows\System\udddrTc.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\YnoRhmB.exe
  C:\Windows\System\YnoRhmB.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\heycZAP.exe
  C:\Windows\System\heycZAP.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\KMTClVY.exe
  C:\Windows\System\KMTClVY.exe
  2⤵
  - Executes dropped EXE
  PID:6128
- C:\Windows\System\jTrkMVc.exe
  C:\Windows\System\jTrkMVc.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\PbglRZM.exe
  C:\Windows\System\PbglRZM.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\kJziBpX.exe
  C:\Windows\System\kJziBpX.exe
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Windows\System\TYngpNj.exe
  C:\Windows\System\TYngpNj.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\wTskcvT.exe
  C:\Windows\System\wTskcvT.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\HaslVag.exe
  C:\Windows\System\HaslVag.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\cwFBAZa.exe
  C:\Windows\System\cwFBAZa.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\NeXzIxx.exe
  C:\Windows\System\NeXzIxx.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\JhnclVG.exe
  C:\Windows\System\JhnclVG.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\JUcCzjQ.exe
  C:\Windows\System\JUcCzjQ.exe
  2⤵
  - Executes dropped EXE
  PID:5668
- C:\Windows\System\nShaMwc.exe
  C:\Windows\System\nShaMwc.exe
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System\QKjLuls.exe
  C:\Windows\System\QKjLuls.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\aMJVIzK.exe
  C:\Windows\System\aMJVIzK.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\jkeMIXg.exe
  C:\Windows\System\jkeMIXg.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\GTPnUiA.exe
  C:\Windows\System\GTPnUiA.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\IEtQpnc.exe
  C:\Windows\System\IEtQpnc.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ShrAfxU.exe
  C:\Windows\System\ShrAfxU.exe
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GTPnUiA.exe

Path C:\Windows\System\GTPnUiA.exe
Size 5.9MB
SHA256 26f1622b53b8813c5e0f9ebdb90d802163e3c4d93a6ad9ff796a6001a83de243
MD5 52e73e41d7d66d42de9d3497259035a4
SHA1 16e34d0c6554abbef538c93f3048ad816bdf6a8c
SHA512 d45cbd13938ebcf57c61853a9538cda78d148ceca93ad1fbc6169fdf231232f0417bfe407f90f6a6184d838b32792e88e1f98f142c5e10999686793b4f1472af
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

HaslVag.exe

Path C:\Windows\System\HaslVag.exe
Size 5.9MB
SHA256 3bd7eb8d50803fe9a836d76399ac7f91bf1d6826aac7719c63175a5b635937ea
MD5 125208c65cf375998e18a1f3e4f3db89
SHA1 6813c3a7efc229b4b34b77be7dda049c9a0f1537
SHA512 01d6f0920e024f1d9f4ba625a07c9946147a1fbf37b06b8ac944f5efee2c570fbf19dd22b3fcfd772cd198a163a8523bc7b6a0137404c2c2f1179b4cce328dc7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

IEtQpnc.exe

Path C:\Windows\System\IEtQpnc.exe
Size 5.9MB
SHA256 3ac233c39defb143e57484c6e7963ab9d30e33a6dba347961282476f9de6e9ad
MD5 ea32e743c8c70a3ce31c578a6f059b22
SHA1 e31928b5433b8ff502605672675e320b45d773d2
SHA512 0293e1b0f0517424308651e59049ae236d8e72be923f479bf3eac42929c1ec97310d46491ffc4220aacfc9ac248b5f9477d2fd7004b43e7efa5f46225a060e74
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

JUcCzjQ.exe

Path C:\Windows\System\JUcCzjQ.exe
Size 5.9MB
SHA256 4fd2f6228eddb4409047b5cb0f6caaf5c837bcf38e356533a55b530362fc82cc
MD5 460de4e2fec77275f428b34936bb6b15
SHA1 41b4566fc056e26b9821466c2d957841cdb93f92
SHA512 979ac6e9a774c21a6f70ac0987cbdcee9096d222a393d0505a33ef611a8cec57520e275b3e627fc7c1ba8114bf66e47c1796da68de68200e9271960644496312
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

JhnclVG.exe

Path C:\Windows\System\JhnclVG.exe
Size 5.9MB
SHA256 5d1766103fb578d1ba349ffa9a36c58a9e1dd8fde79c3d988db82e3f7a074f09
MD5 cafe93b60bf32dc7deaf36a371b21648
SHA1 7a5619ed7b52eda2178ce615f7f1488679529e6c
SHA512 e42ef9a6db8dcf3a7daaf2e18a1e4a1571f95029e6c8ea028d229b6f1f9b0cb41df55b774ebf011322482552d90d3f17d471b2a4b6925b77772d97c2e4ae0efb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMTClVY.exe

Path C:\Windows\System\KMTClVY.exe
Size 5.9MB
SHA256 e542de710eb9927b738cdff528f6cc9f59f68013a06e26180477f7ae6a23ac97
MD5 199b02192b6ae810fbee2d1cb532f82a
SHA1 e75ffc3cd1c173d7cf5b047ad7560047edd5ef8b
SHA512 88a64d8b28967055a3c53b77a01beedcda65e1e72f9a95089feb516c7e68254bb23c7afcc131cc005a8960831bc037272ef9e8d63abfd45cfb085985f7f03e5a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

NeXzIxx.exe

Path C:\Windows\System\NeXzIxx.exe
Size 5.9MB
SHA256 30ba2a221a1119d82909427bee04bce4ecda65214f799d65280dad0935f239ef
MD5 09fcc4117e74a2d7e6c0245b303bd7a1
SHA1 52b0ea6ae03d2241d4fbc270c9cc984e15b1b99f
SHA512 83f9a006b26ae02c8cc7219ceb14f7fc30453c760932eb6db8013ed91af43766b2279e06d8adef1bd0e0d4d0dc71078c698d54daa5e6bc5a20445ddaa8997229
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

PbglRZM.exe

Path C:\Windows\System\PbglRZM.exe
Size 5.9MB
SHA256 419a9fab49e6700ec73d1c9c7bd3eb599a69e30b3f4b6a3dd67320a3e2d8ed60
MD5 e6769fd73181a9f65e6605d1f04c2163
SHA1 ad264a9fd8f2856e0220e6d9be55f2282466eaa9
SHA512 7faed359e20b1417b5b0031500762eb579c28f776c3ae6cec5763329c83ddd13e41e52f4abd0ed68a8e5fcf63bca54de75541ba82a87711b1d2adaec0778d7c5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

QKjLuls.exe

Path C:\Windows\System\QKjLuls.exe
Size 5.9MB
SHA256 7cd78bc3cfed41f6a2a8e9e40e42b39a29bda984a33606ceb2b95a6536b95659
MD5 41fb41fbe48f94e53847a5f31c0a81d6
SHA1 cc3baa93edb4eedbee9c762e035ed16a6c40897b
SHA512 cf3c59d2c621806778f015f25956b1412724d3c842af7b6981aa0fb11eba8fd97d778904e4dff5d9662da5a0418dc72c857216ee3855cc32e50424ae14468c01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShrAfxU.exe

Path C:\Windows\System\ShrAfxU.exe
Size 5.9MB
SHA256 34b57b6e89db804a1ee7ec95e54c2ee69bafd88a3bacfc431568cfb1565faf4a
MD5 91fdc3576eff2c227ecd9aab47305f5f
SHA1 918432dfbd68fac776783225e9be11a40a0686ab
SHA512 b453762d6dd737312b0077af4ac55c52415e69e891044e79a2f74475450a35be1e8b87a364bdf236f53313deb161186c33bff57df1b3a88af66d28e4952b014f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

TYngpNj.exe

Path C:\Windows\System\TYngpNj.exe
Size 5.9MB
SHA256 9d91996be489313931bea5ab4bf04982963a5a9ac7140d40878e5b4e1d37d5f7
MD5 c21c6788272f836a8eca5a4e4ad09d73
SHA1 2f53d7f3174983cf763dd6225166f5199f57e694
SHA512 cf6c9f564956bbc9b8d6a80593404fbeb82e274d0aaca043c201b798f039fe66f96dd321add4a2b0fc4ea313c7081c74d0e4523ccf0953e88be6b63e0bf657fc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

YnoRhmB.exe

Path C:\Windows\System\YnoRhmB.exe
Size 5.9MB
SHA256 1163ecc8bda092cf220d403e392a9f8c0359217c3f6d8f1238d1400f65a9adca
MD5 30c672a87ece66d1f5d3410290c61be0
SHA1 e136156ec4b11767dcafebcb17218906383f90cd
SHA512 678c3974bfe019f1aa9bcd6441c1c68ca3cafd995f273b3ed816c4698a27f7f4b8c5795e103ecee4247d620c19c9bbecb8e483cf64318c01a7d786f365026381
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

aMJVIzK.exe

Path C:\Windows\System\aMJVIzK.exe
Size 5.9MB
SHA256 77eefdd228c2dc5656d51767f0ac90ee80fa095f68210abe09f6f8d76b4cd3b6
MD5 5340b86ebb093f2ba316daeeebbad99e
SHA1 7812d418c14e8fadf5d37da4961c83ad9901e241
SHA512 a7f97824f8cfb8875076900e3484bcf20820b711da53dd13cc92130859b020338bb6ea4a5f9adc24f921c574961f10823fa0a9daa7f2f25f09bd82c0b98e64f6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

cwFBAZa.exe

Path C:\Windows\System\cwFBAZa.exe
Size 5.9MB
SHA256 0988742a927eaec710d1359f089deccb7096de2f3b2e5d5486038f27b815a78f
MD5 88dd72b4fd6ce8f0cb3fda0fc9f9a35a
SHA1 72c7c60771a5d339c3be88e3301035be1e6f1024
SHA512 bd623b1dc529f0d9c83a4d36491b339f44e2225c5080bea7aeab1daed29efd0990ef6cd28e9f8aa5a7ca95e2ba521cc75b4bf437c52ef15cd9c48ae064e336ec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

heycZAP.exe

Path C:\Windows\System\heycZAP.exe
Size 5.9MB
SHA256 465ae78170d33cf58e57e5c07b564f7f5d965507dab35f1150135c43dd3ec3f4
MD5 183ea7fbdb14bf445542fe240482914e
SHA1 7fce1a6fc2576c019c6a332577e0852a9df6d1a1
SHA512 d59956e15d03d5cad13d57b860070cb57edc901e6731843f5c4a9e05a7562ce172488ad4710cf479efd7b70d2352264b555deddfb4bae40d1660cc0a699cd2c3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTrkMVc.exe

Path C:\Windows\System\jTrkMVc.exe
Size 5.9MB
SHA256 7518fd42bc1d665f10ed1b6a2210b21cbbe43c9a15ecdfd68754d01dd8dbeadf
MD5 73d89f0d8729d01d4ec56e311a8e0e0e
SHA1 cf3eccc5887f22298f02deac1f990ccd5c6eb4fa
SHA512 33736fcc63ebee46e78237efc2134349ecc1901143af9c24726d26659ab76abca2ea21afdea14b3a503fcafc916b1b8022e13c44084743b523a077315983baa2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

jkeMIXg.exe

Path C:\Windows\System\jkeMIXg.exe
Size 5.9MB
SHA256 f34546faf874f9fd3a374551e97e62ff37b8a9a814063721254b13b774b3c80d
MD5 b29ff1b0cb8d60035a8a2eb8ea0ec71f
SHA1 b9873aa226bb18dcfb2ea62570092b4f11bcf8d6
SHA512 7428b7af5b090ac49482ef600a83d2b61473159a27b6a241185a40ac9a1393ad61d4ef79d4d172fb943a61f7619a0bbd86d6dfe31f57cfa57e3a0c36ea52b38c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

kJziBpX.exe

Path C:\Windows\System\kJziBpX.exe
Size 5.9MB
SHA256 195b86af0a0873ee441fe2f9e70681bcc04633f22b6ff52920e627968b2117ed
MD5 ec4ce32d46e095d8c4b518226ca7785f
SHA1 3cd8170a1a096073a990903d8570fb511cf85c78
SHA512 396265c4ab5b8c64524d5fdbb8b09d43b3d11667c1535c59caf07a6867b394696985383ccef16329695e0cb36a94484331ebb9217a2bea91d0f27e275ae98d1c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

nShaMwc.exe

Path C:\Windows\System\nShaMwc.exe
Size 5.9MB
SHA256 8eb7ca325ae3509bc03d2636c8ba94a7262a267b801de5c7a131b703a01a2176
MD5 24a70536172d3ba88597caa700c3e732
SHA1 a692f9b4d7332279f39abffe38ad9ef48dee8c1d
SHA512 f3299717b2c0d3e4e45ebb81e70c53b7faac7bdfea6216e9c00525b13712193b6014537374f54ae446ea38fac3e4fad0b9284a9608171ef37a38820cb067bc5b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

udddrTc.exe

Path C:\Windows\System\udddrTc.exe
Size 5.9MB
SHA256 0c680bb218a2d896e2f40ebf6415042b91fe8a8b4a812af3eb2f30d95e7a49b9
MD5 6c48e9749fd239c06804a64b16707b21
SHA1 699935b8d2edbe7cea7c313291c684757be27d3b
SHA512 291aafa33bb7c4953a155d38d2a11239f8c7e34dd35c0f670c21e083b7d2eedf58ad7e6b35cc688ac4c159be043bf5d74b1340ec328225d18192ce7357f0890c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

wTskcvT.exe

Path C:\Windows\System\wTskcvT.exe
Size 5.9MB
SHA256 8fdcdd0f30fc6de8586987d85fbb0a552bc5bdc69b3d5cc3f4a8acdcc6451f62
MD5 0ded64d8b0ec1004a68020cfc9926360
SHA1 ddf99d3db9fc516e106061f24b52c7224992e294
SHA512 76b6940b6a5f0ae0d1a1a1c0b599b669ce7302298756d18f94fc16cda9d281a8ac6929dabf74d11eb5dc91981c9f36f22ee9a323e2f7511898927111968ff6fe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-38-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp

Download

memory/368-139-0x00007FF7C3C70000-0x00007FF7C3FC4000-memory.dmp

Download

memory/564-154-0x00007FF7B5280000-0x00007FF7B55D4000-memory.dmp

Download

memory/564-128-0x00007FF7B5280000-0x00007FF7B55D4000-memory.dmp

Download

memory/1076-144-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp

Download

memory/1076-68-0x00007FF77AE30000-0x00007FF77B184000-memory.dmp

Download

memory/1224-32-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp

Download

memory/1224-138-0x00007FF6C0410000-0x00007FF6C0764000-memory.dmp

Download

memory/1764-57-0x00007FF759940000-0x00007FF759C94000-memory.dmp

Download

memory/1764-142-0x00007FF759940000-0x00007FF759C94000-memory.dmp

Download

memory/1824-81-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp

Download

memory/1824-146-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp

Download

memory/1824-129-0x00007FF7589D0000-0x00007FF758D24000-memory.dmp

Download

memory/1828-53-0x00007FF671880000-0x00007FF671BD4000-memory.dmp

Download

memory/1828-141-0x00007FF671880000-0x00007FF671BD4000-memory.dmp

Download

memory/2192-126-0x00007FF709890000-0x00007FF709BE4000-memory.dmp

Download

memory/2192-152-0x00007FF709890000-0x00007FF709BE4000-memory.dmp

Download

memory/2292-150-0x00007FF63B140000-0x00007FF63B494000-memory.dmp

Download

memory/2292-99-0x00007FF63B140000-0x00007FF63B494000-memory.dmp

Download

memory/2292-132-0x00007FF63B140000-0x00007FF63B494000-memory.dmp

Download

memory/2648-8-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp

Download

memory/2648-134-0x00007FF67C550000-0x00007FF67C8A4000-memory.dmp

Download

memory/2928-74-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp

Download

memory/2928-1-0x000001E319DE0000-0x000001E319DF0000-memory.dmp

Download

memory/2928-0-0x00007FF7A96D0000-0x00007FF7A9A24000-memory.dmp

Download

memory/3380-135-0x00007FF759860000-0x00007FF759BB4000-memory.dmp

Download

memory/3380-14-0x00007FF759860000-0x00007FF759BB4000-memory.dmp

Download

memory/3976-20-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp

Download

memory/3976-136-0x00007FF7FC610000-0x00007FF7FC964000-memory.dmp

Download

memory/4192-143-0x00007FF75A630000-0x00007FF75A984000-memory.dmp

Download

memory/4192-62-0x00007FF75A630000-0x00007FF75A984000-memory.dmp

Download

memory/4548-153-0x00007FF742460000-0x00007FF7427B4000-memory.dmp

Download

memory/4548-125-0x00007FF742460000-0x00007FF7427B4000-memory.dmp

Download

memory/4980-133-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp

Download

memory/4980-103-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp

Download

memory/4980-149-0x00007FF73C5F0000-0x00007FF73C944000-memory.dmp

Download

memory/5020-75-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp

Download

memory/5020-145-0x00007FF6A7D80000-0x00007FF6A80D4000-memory.dmp

Download

memory/5044-151-0x00007FF7F02F0000-0x00007FF7F0644000-memory.dmp

Download

memory/5044-127-0x00007FF7F02F0000-0x00007FF7F0644000-memory.dmp

Download

memory/5668-131-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp

Download

memory/5668-147-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp

Download

memory/5668-91-0x00007FF7D89E0000-0x00007FF7D8D34000-memory.dmp

Download

memory/5672-148-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp

Download

memory/5672-93-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp

Download

memory/5672-130-0x00007FF7E26D0000-0x00007FF7E2A24000-memory.dmp

Download

memory/5712-140-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp

Download

memory/5712-52-0x00007FF69EBF0000-0x00007FF69EF44000-memory.dmp

Download

memory/6128-137-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp

Download

memory/6128-26-0x00007FF757FA0000-0x00007FF7582F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads