cobaltstrike | eb72e1c239ed108711f06b44e5ace8f500e34c5863b84bff35671e6fd0ddd026

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-293vesaf8w
SHA256 eb72e1c239ed108711f06b44e5ace8f500e34c5863b84bff35671e6fd0ddd026
MD5 a65f28954ce1a2fb1a49ada97a9a48f2
SHA1 a58816111a26bbd494ae1f029fd5608a2dc6b4ac
SHA512 e207a5704877e1604187f907ee994ba34d5d0eaa6af1e5ba57d47b92dc2d4f330c66fdddf84da26a3e4b15a6608c5714ca7c8214e919ff44cf42315d9b395b8b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233ce-6.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023404-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-17.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-28.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023400-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-49.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-61.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-66.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-75.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-121.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-102.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233ce-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023404-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023400-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4036-0-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	UPX
behavioral2/files/0x00090000000233ce-6.dat	UPX
behavioral2/files/0x0008000000023404-11.dat	UPX
behavioral2/files/0x0007000000023405-17.dat	UPX
behavioral2/memory/1048-20-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	UPX
behavioral2/files/0x0007000000023406-23.dat	UPX
behavioral2/memory/4940-13-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	UPX
behavioral2/memory/4116-10-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	UPX
behavioral2/memory/2452-26-0x00007FF709900000-0x00007FF709C54000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-28.dat	UPX
behavioral2/memory/3052-31-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	UPX
behavioral2/files/0x0009000000023400-36.dat	UPX
behavioral2/memory/4824-38-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-41.dat	UPX
behavioral2/files/0x000700000002340a-46.dat	UPX
behavioral2/files/0x000700000002340b-49.dat	UPX
behavioral2/memory/1772-58-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-61.dat	UPX
behavioral2/memory/1580-57-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	UPX
behavioral2/memory/1260-53-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	UPX
behavioral2/memory/3196-43-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-66.dat	UPX
behavioral2/memory/4404-73-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-75.dat	UPX
behavioral2/memory/1460-72-0x00007FF6EE340000-0x00007FF6EE694000-memory.dmp	UPX
behavioral2/memory/4116-69-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	UPX
behavioral2/memory/4036-68-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	UPX
behavioral2/files/0x000700000002340f-79.dat	UPX
behavioral2/files/0x0007000000023410-82.dat	UPX
behavioral2/memory/2936-91-0x00007FF6492A0000-0x00007FF6495F4000-memory.dmp	UPX
behavioral2/memory/3932-90-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-94.dat	UPX
behavioral2/files/0x0007000000023413-105.dat	UPX
behavioral2/files/0x0007000000023415-115.dat	UPX
behavioral2/files/0x0007000000023417-123.dat	UPX
behavioral2/files/0x0007000000023416-121.dat	UPX
behavioral2/files/0x0007000000023414-107.dat	UPX
behavioral2/files/0x0007000000023411-102.dat	UPX
behavioral2/memory/1484-99-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	UPX
behavioral2/memory/4940-84-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	UPX
behavioral2/memory/3532-125-0x00007FF758530000-0x00007FF758884000-memory.dmp	UPX
behavioral2/memory/4376-126-0x00007FF630AE0000-0x00007FF630E34000-memory.dmp	UPX
behavioral2/memory/4788-128-0x00007FF6FCA30000-0x00007FF6FCD84000-memory.dmp	UPX
behavioral2/memory/5112-127-0x00007FF621ED0000-0x00007FF622224000-memory.dmp	UPX
behavioral2/memory/3828-129-0x00007FF77F650000-0x00007FF77F9A4000-memory.dmp	UPX
behavioral2/memory/3052-130-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	UPX
behavioral2/memory/4660-131-0x00007FF6FC190000-0x00007FF6FC4E4000-memory.dmp	UPX
behavioral2/memory/4824-132-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	UPX
behavioral2/memory/1580-134-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	UPX
behavioral2/memory/3196-133-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	UPX
behavioral2/memory/1260-135-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	UPX
behavioral2/memory/1772-136-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	UPX
behavioral2/memory/4404-137-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	UPX
behavioral2/memory/3932-138-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	UPX
behavioral2/memory/1484-139-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	UPX
behavioral2/memory/4116-140-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	UPX
behavioral2/memory/4940-141-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	UPX
behavioral2/memory/1048-142-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	UPX
behavioral2/memory/2452-143-0x00007FF709900000-0x00007FF709C54000-memory.dmp	UPX
behavioral2/memory/3052-144-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	UPX
behavioral2/memory/4824-145-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	UPX
behavioral2/memory/3196-146-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	UPX
behavioral2/memory/1260-147-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	UPX
behavioral2/memory/1580-148-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4036-0-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ce-6.dat	xmrig
behavioral2/files/0x0008000000023404-11.dat	xmrig
behavioral2/files/0x0007000000023405-17.dat	xmrig
behavioral2/memory/1048-20-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-23.dat	xmrig
behavioral2/memory/4940-13-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	xmrig
behavioral2/memory/4116-10-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	xmrig
behavioral2/memory/2452-26-0x00007FF709900000-0x00007FF709C54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-28.dat	xmrig
behavioral2/memory/3052-31-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023400-36.dat	xmrig
behavioral2/memory/4824-38-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-41.dat	xmrig
behavioral2/files/0x000700000002340a-46.dat	xmrig
behavioral2/files/0x000700000002340b-49.dat	xmrig
behavioral2/memory/1772-58-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-61.dat	xmrig
behavioral2/memory/1580-57-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	xmrig
behavioral2/memory/1260-53-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	xmrig
behavioral2/memory/3196-43-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-66.dat	xmrig
behavioral2/memory/4404-73-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-75.dat	xmrig
behavioral2/memory/1460-72-0x00007FF6EE340000-0x00007FF6EE694000-memory.dmp	xmrig
behavioral2/memory/4116-69-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	xmrig
behavioral2/memory/4036-68-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-79.dat	xmrig
behavioral2/files/0x0007000000023410-82.dat	xmrig
behavioral2/memory/2936-91-0x00007FF6492A0000-0x00007FF6495F4000-memory.dmp	xmrig
behavioral2/memory/3932-90-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-94.dat	xmrig
behavioral2/files/0x0007000000023413-105.dat	xmrig
behavioral2/files/0x0007000000023415-115.dat	xmrig
behavioral2/files/0x0007000000023417-123.dat	xmrig
behavioral2/files/0x0007000000023416-121.dat	xmrig
behavioral2/files/0x0007000000023414-107.dat	xmrig
behavioral2/files/0x0007000000023411-102.dat	xmrig
behavioral2/memory/1484-99-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	xmrig
behavioral2/memory/4940-84-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	xmrig
behavioral2/memory/3532-125-0x00007FF758530000-0x00007FF758884000-memory.dmp	xmrig
behavioral2/memory/4376-126-0x00007FF630AE0000-0x00007FF630E34000-memory.dmp	xmrig
behavioral2/memory/4788-128-0x00007FF6FCA30000-0x00007FF6FCD84000-memory.dmp	xmrig
behavioral2/memory/5112-127-0x00007FF621ED0000-0x00007FF622224000-memory.dmp	xmrig
behavioral2/memory/3828-129-0x00007FF77F650000-0x00007FF77F9A4000-memory.dmp	xmrig
behavioral2/memory/3052-130-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	xmrig
behavioral2/memory/4660-131-0x00007FF6FC190000-0x00007FF6FC4E4000-memory.dmp	xmrig
behavioral2/memory/4824-132-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	xmrig
behavioral2/memory/1580-134-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	xmrig
behavioral2/memory/3196-133-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	xmrig
behavioral2/memory/1260-135-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	xmrig
behavioral2/memory/1772-136-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	xmrig
behavioral2/memory/4404-137-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	xmrig
behavioral2/memory/3932-138-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	xmrig
behavioral2/memory/1484-139-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	xmrig
behavioral2/memory/4116-140-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	xmrig
behavioral2/memory/4940-141-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	xmrig
behavioral2/memory/1048-142-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	xmrig
behavioral2/memory/2452-143-0x00007FF709900000-0x00007FF709C54000-memory.dmp	xmrig
behavioral2/memory/3052-144-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	xmrig
behavioral2/memory/4824-145-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	xmrig
behavioral2/memory/3196-146-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	xmrig
behavioral2/memory/1260-147-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	xmrig
behavioral2/memory/1580-148-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4116	gDIyWtB.exe
4940	ZvGHuVV.exe
1048	EBUCgCv.exe
2452	lRdrIqD.exe
3052	VuJxlpI.exe
4824	TQpvapl.exe
3196	CtEnXxl.exe
1260	TsPbkBh.exe
1580	DhnCUwM.exe
1772	bPwbzCn.exe
1460	bwLPQKx.exe
4404	LvWjdeU.exe
3932	TQTJQiV.exe
2936	hbQSclZ.exe
1484	sLCUXPA.exe
4788	cmMnBYJ.exe
3828	kqYDZTC.exe
4660	ciMTuZS.exe
3532	gvLlVlN.exe
4376	wLDmyLw.exe
5112	MwskaCd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4036-0-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	upx
behavioral2/files/0x00090000000233ce-6.dat	upx
behavioral2/files/0x0008000000023404-11.dat	upx
behavioral2/files/0x0007000000023405-17.dat	upx
behavioral2/memory/1048-20-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	upx
behavioral2/files/0x0007000000023406-23.dat	upx
behavioral2/memory/4940-13-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	upx
behavioral2/memory/4116-10-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	upx
behavioral2/memory/2452-26-0x00007FF709900000-0x00007FF709C54000-memory.dmp	upx
behavioral2/files/0x0007000000023407-28.dat	upx
behavioral2/memory/3052-31-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	upx
behavioral2/files/0x0009000000023400-36.dat	upx
behavioral2/memory/4824-38-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	upx
behavioral2/files/0x0007000000023408-41.dat	upx
behavioral2/files/0x000700000002340a-46.dat	upx
behavioral2/files/0x000700000002340b-49.dat	upx
behavioral2/memory/1772-58-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	upx
behavioral2/files/0x000700000002340c-61.dat	upx
behavioral2/memory/1580-57-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	upx
behavioral2/memory/1260-53-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	upx
behavioral2/memory/3196-43-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	upx
behavioral2/files/0x000700000002340d-66.dat	upx
behavioral2/memory/4404-73-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	upx
behavioral2/files/0x000700000002340e-75.dat	upx
behavioral2/memory/1460-72-0x00007FF6EE340000-0x00007FF6EE694000-memory.dmp	upx
behavioral2/memory/4116-69-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	upx
behavioral2/memory/4036-68-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp	upx
behavioral2/files/0x000700000002340f-79.dat	upx
behavioral2/files/0x0007000000023410-82.dat	upx
behavioral2/memory/2936-91-0x00007FF6492A0000-0x00007FF6495F4000-memory.dmp	upx
behavioral2/memory/3932-90-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-94.dat	upx
behavioral2/files/0x0007000000023413-105.dat	upx
behavioral2/files/0x0007000000023415-115.dat	upx
behavioral2/files/0x0007000000023417-123.dat	upx
behavioral2/files/0x0007000000023416-121.dat	upx
behavioral2/files/0x0007000000023414-107.dat	upx
behavioral2/files/0x0007000000023411-102.dat	upx
behavioral2/memory/1484-99-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	upx
behavioral2/memory/4940-84-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	upx
behavioral2/memory/3532-125-0x00007FF758530000-0x00007FF758884000-memory.dmp	upx
behavioral2/memory/4376-126-0x00007FF630AE0000-0x00007FF630E34000-memory.dmp	upx
behavioral2/memory/4788-128-0x00007FF6FCA30000-0x00007FF6FCD84000-memory.dmp	upx
behavioral2/memory/5112-127-0x00007FF621ED0000-0x00007FF622224000-memory.dmp	upx
behavioral2/memory/3828-129-0x00007FF77F650000-0x00007FF77F9A4000-memory.dmp	upx
behavioral2/memory/3052-130-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	upx
behavioral2/memory/4660-131-0x00007FF6FC190000-0x00007FF6FC4E4000-memory.dmp	upx
behavioral2/memory/4824-132-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	upx
behavioral2/memory/1580-134-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	upx
behavioral2/memory/3196-133-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	upx
behavioral2/memory/1260-135-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	upx
behavioral2/memory/1772-136-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp	upx
behavioral2/memory/4404-137-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp	upx
behavioral2/memory/3932-138-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp	upx
behavioral2/memory/1484-139-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp	upx
behavioral2/memory/4116-140-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp	upx
behavioral2/memory/4940-141-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp	upx
behavioral2/memory/1048-142-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	upx
behavioral2/memory/2452-143-0x00007FF709900000-0x00007FF709C54000-memory.dmp	upx
behavioral2/memory/3052-144-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp	upx
behavioral2/memory/4824-145-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp	upx
behavioral2/memory/3196-146-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp	upx
behavioral2/memory/1260-147-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp	upx
behavioral2/memory/1580-148-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\gDIyWtB.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZvGHuVV.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kqYDZTC.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gvLlVlN.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DhnCUwM.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bwLPQKx.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sLCUXPA.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ciMTuZS.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wLDmyLw.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MwskaCd.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EBUCgCv.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lRdrIqD.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TQpvapl.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CtEnXxl.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bPwbzCn.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cmMnBYJ.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VuJxlpI.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TsPbkBh.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LvWjdeU.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TQTJQiV.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hbQSclZ.exe	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4116	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	82
PID 4036 wrote to memory of 4116	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	82
PID 4036 wrote to memory of 4940	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	83
PID 4036 wrote to memory of 4940	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	83
PID 4036 wrote to memory of 1048	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	84
PID 4036 wrote to memory of 1048	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	84
PID 4036 wrote to memory of 2452	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	85
PID 4036 wrote to memory of 2452	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	85
PID 4036 wrote to memory of 3052	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	86
PID 4036 wrote to memory of 3052	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	86
PID 4036 wrote to memory of 4824	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	87
PID 4036 wrote to memory of 4824	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	87
PID 4036 wrote to memory of 3196	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	88
PID 4036 wrote to memory of 3196	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	88
PID 4036 wrote to memory of 1260	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	89
PID 4036 wrote to memory of 1260	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	89
PID 4036 wrote to memory of 1580	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	90
PID 4036 wrote to memory of 1580	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	90
PID 4036 wrote to memory of 1772	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	91
PID 4036 wrote to memory of 1772	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	91
PID 4036 wrote to memory of 1460	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	92
PID 4036 wrote to memory of 1460	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	92
PID 4036 wrote to memory of 4404	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	93
PID 4036 wrote to memory of 4404	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	93
PID 4036 wrote to memory of 3932	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	94
PID 4036 wrote to memory of 3932	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	94
PID 4036 wrote to memory of 2936	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	95
PID 4036 wrote to memory of 2936	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	95
PID 4036 wrote to memory of 1484	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	96
PID 4036 wrote to memory of 1484	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	96
PID 4036 wrote to memory of 4788	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	97
PID 4036 wrote to memory of 4788	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	97
PID 4036 wrote to memory of 4660	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	98
PID 4036 wrote to memory of 4660	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	98
PID 4036 wrote to memory of 3828	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	99
PID 4036 wrote to memory of 3828	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	99
PID 4036 wrote to memory of 3532	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	100
PID 4036 wrote to memory of 3532	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	100
PID 4036 wrote to memory of 4376	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	101
PID 4036 wrote to memory of 4376	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	101
PID 4036 wrote to memory of 5112	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	102
PID 4036 wrote to memory of 5112	4036	2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_a65f28954ce1a2fb1a49ada97a9a48f2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\System\gDIyWtB.exe
  C:\Windows\System\gDIyWtB.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\ZvGHuVV.exe
  C:\Windows\System\ZvGHuVV.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\EBUCgCv.exe
  C:\Windows\System\EBUCgCv.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\lRdrIqD.exe
  C:\Windows\System\lRdrIqD.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\VuJxlpI.exe
  C:\Windows\System\VuJxlpI.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\TQpvapl.exe
  C:\Windows\System\TQpvapl.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\CtEnXxl.exe
  C:\Windows\System\CtEnXxl.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\TsPbkBh.exe
  C:\Windows\System\TsPbkBh.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\DhnCUwM.exe
  C:\Windows\System\DhnCUwM.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\bPwbzCn.exe
  C:\Windows\System\bPwbzCn.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\bwLPQKx.exe
  C:\Windows\System\bwLPQKx.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\LvWjdeU.exe
  C:\Windows\System\LvWjdeU.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\TQTJQiV.exe
  C:\Windows\System\TQTJQiV.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\hbQSclZ.exe
  C:\Windows\System\hbQSclZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\sLCUXPA.exe
  C:\Windows\System\sLCUXPA.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\cmMnBYJ.exe
  C:\Windows\System\cmMnBYJ.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\ciMTuZS.exe
  C:\Windows\System\ciMTuZS.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\kqYDZTC.exe
  C:\Windows\System\kqYDZTC.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\gvLlVlN.exe
  C:\Windows\System\gvLlVlN.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\wLDmyLw.exe
  C:\Windows\System\wLDmyLw.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\MwskaCd.exe
  C:\Windows\System\MwskaCd.exe
  2⤵
  - Executes dropped EXE
  PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CtEnXxl.exe

Path C:\Windows\System\CtEnXxl.exe
Size 5.9MB
SHA256 19daab04605939b891d8560101b68f66d1cd4f81c8aad7bfa7b4f3d6d61e9801
MD5 2a2bc00a189025a609857973e3770d8d
SHA1 1e96c35b46ec6f2c623de7ec8e05fe6f221da9d1
SHA512 c4fcb22af1937dd714daff030e4ed0bc199643ca3b4fce22e22bbf0e1fde2b5dd52ece1f93114f93896992d74e83ea08f2394d71aec01337a3d3405a1f8fd70b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

DhnCUwM.exe

Path C:\Windows\System\DhnCUwM.exe
Size 5.9MB
SHA256 5cb5d2bb48ab345f6c2552dcf2673721647b99e921aa0f8eb802f6f4103c2336
MD5 79d6edafcc67b4746d073c3d856020c0
SHA1 6ce9aa2b6890c0a16b5db4f2334f2640fa1b6fac
SHA512 16d74552e840d99a5db271ce1384782ddde7e0967d09e8a2c809f9ac08eff1670daddd847b19f3e49902d44acab27b203fb65a3ced0374f799749e76feeac745
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBUCgCv.exe

Path C:\Windows\System\EBUCgCv.exe
Size 5.9MB
SHA256 6ab391e5fca402cc82e04214276ae0449dbad4e7dac04fc066f91cd55722107f
MD5 14b3a904dca6293299fdad23d9844206
SHA1 e4767c39903863e89a475c36ad1b7f6d28170f10
SHA512 99a5ec2e523f069a689959944f161a754b07a51bd0afa6a158812a1ba138b97979402bb6a88b2f94e06cf29a6c02e5a44d0ab151e765ae65c08ea180dcb7d3bf
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

LvWjdeU.exe

Path C:\Windows\System\LvWjdeU.exe
Size 5.9MB
SHA256 03bb82efb8845e236f7cdcc25589bdd3baa23a7c949ca290da1925fe79f80487
MD5 41a18e519d7439ad8ef973f108535a8b
SHA1 f05d2e131437b1ef9c9d33551fbfb3b44d28cc01
SHA512 59cd2789b54025fcdbf760c5e54b4903d8b5ecee665a7a43d65be36539652382d1891a92425a4e39d8c03de3d5edc8023e896a4759979ef273d842c901a5b2de
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

MwskaCd.exe

Path C:\Windows\System\MwskaCd.exe
Size 5.9MB
SHA256 b19b9bc5ae8c005053e462b3fca416cb8d05e3ccf7ac5eacd1b1fe58e56019b0
MD5 fc6cb4b69e4773733acfab16c57b6fd7
SHA1 b6f08889d6601718e1431b93bae2e30ad61fa1d2
SHA512 d0026a366c174664b6c6216e137a799ca76c86342294db88fa8c60eaf293ff2ad6794ea6d1739fd5ccb2d22755bfaecbe1a4e6c41cda99f3d1ec1ca38f2b3ea8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:T+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TQTJQiV.exe

Path C:\Windows\System\TQTJQiV.exe
Size 5.9MB
SHA256 a3a4764a939de2cab5451977f816d84f6c8a30e11f68a5c21c8c8a09437d4225
MD5 26b4922274681ee9018c6a529c8a76ab
SHA1 6a0fe4df0656ddb1d2b68b963f54fff3db0203b1
SHA512 be597697222a5a0a84c0c748c97edd5d5d2bd4f263a0d6c0e4a60dce70eff0d78f655504dbf7e80d5049dfc43f5be363322a93b9d219489759ff990067be23cf
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TQpvapl.exe

Path C:\Windows\System\TQpvapl.exe
Size 5.9MB
SHA256 8e458673a9b641dd0989e95a2559bb106ec4c8696b64041cdf65fddc5b471a38
MD5 7234bbd760ce2af9168fd0f3567c7d93
SHA1 c1ba41cebf667fd6475bbf91df1d4adf0079e10d
SHA512 830e85de0963e53715eda2064554b73b0bb9c35a4e6ac16875accc057b04017d8327ff418b3b4564d7021995b047811122ac4da7b170c791c7b19fc5c4305d0e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

TsPbkBh.exe

Path C:\Windows\System\TsPbkBh.exe
Size 5.9MB
SHA256 26e8a1a9a4f0b984099407d2bd2f0db2ab8337d36fb487f8430b9616e780e0f0
MD5 c67fd8a90eb2c362f34fce0e6be21ab7
SHA1 e25f8a0fa1f0708bfd8da89a036c625db70746af
SHA512 ef008ce99abd6e2073aa036724300239cd3bc850bb8bf85a2fe8d8a0e735e3db0492f2d5f04fdeb46b3cd7bd760116e1bc7b03de746e4779861e3e7145542c45
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

VuJxlpI.exe

Path C:\Windows\System\VuJxlpI.exe
Size 5.9MB
SHA256 c3b9877b188ef6d26160f84d5503335027630bdac0e81059e214b9a33b27c785
MD5 8070b576dd93504d3ba37994ecb895e3
SHA1 826f7f141422169d4610a3dd3410b6acf1cefed9
SHA512 a6bc5cde86819426255c388db73104cc9d816abe7c6b1240e28e385bad06b00621dac0b25f53187e17b64c5ac2cedf3e6e0635f9fbff6d21c4f794b4d40cc05c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:T+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvGHuVV.exe

Path C:\Windows\System\ZvGHuVV.exe
Size 5.9MB
SHA256 91901d548bd6a564352706a05b95f997be782800be6a5441a1b7792df9f40ab0
MD5 abad2e3410f0b186e34f9d2d927995fd
SHA1 6020d032c17295aee3dd4bc7b5491e1042801bd6
SHA512 e416f2c7450be72fab9228e944af6305ebf2ecbcd6206bb2de41ecc393d08839024202577078edeb847e4be7dee8a8b99e42674bceff5df44dbb27b3b192ced2
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

bPwbzCn.exe

Path C:\Windows\System\bPwbzCn.exe
Size 5.9MB
SHA256 1e32b8cd16324fb6765425e32e3532994353e850be7186c25ff24fa901817440
MD5 65778aabecc2ac8c599b196dfcfa1b19
SHA1 14016f44138bd33a102ac762750485cc5fb46b73
SHA512 db52b1812f03108a4dc05e0cd611d291b79a32b83d316780dd8ad2df5ffc20a94df85409550527b953c257ba88acebd92f9ecf620d5c170d0fcec3d1f2616c07
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

bwLPQKx.exe

Path C:\Windows\System\bwLPQKx.exe
Size 5.9MB
SHA256 2c51e23f896d652c3081fdbd561538f59be0fe02d8d033e11275f4c8cf22af4a
MD5 c88eb5e38b7e5fff27d44b891526424e
SHA1 4ef698c0e713be303f2a6e6374e7c88a5f827daf
SHA512 b086f58cd489c0bba863692da28cbd15d29ce13139d8b8066c669b68a8046ca601a30c93a01dd915c11cf1e974903c75a76cfb9c4ae44f18ea1becabdb271ec4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:T+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ciMTuZS.exe

Path C:\Windows\System\ciMTuZS.exe
Size 5.9MB
SHA256 a761365e724192bbfab8a9eb2cb4adc8e7834ff26b82b0d9394c5492104d4c90
MD5 abda51cbee453bf73ef9f064cadda716
SHA1 39a8948a60ecb894c2589d0394b28701f3820cc1
SHA512 947d1d26667d4f05f31835638b17e17d27573481917cabcf48771eda8564a00a5f09addf6e93da2cd0e12c9988fa5622abfcc9da0e284c5e632d198bcbdf30fc
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:T+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmMnBYJ.exe

Path C:\Windows\System\cmMnBYJ.exe
Size 5.9MB
SHA256 548f57481d75876e0b8f1dd7e78159f2c23f89ddbd73c946b7ca45929ec9f1a8
MD5 a8398e9534b2e1b7912d43c1106dfb58
SHA1 94e8cd52f01b2605316508fdd9703fad9f26be18
SHA512 7f93fdc82c168036dfd871c2d40f2a75e850e2b56d40f5fe51ad5c9e43b87b70f6fb59d906c3692e55e614d10710df60b0e95a1326309637d785fd08dd1b8ff1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDIyWtB.exe

Path C:\Windows\System\gDIyWtB.exe
Size 5.9MB
SHA256 3d00ef9d24f2cca6fdd451bf9aa02943e2032424718ad289794f6a123e3bf2de
MD5 0b77b6fdc522246787f06f358791e375
SHA1 a105cb9a1a61f56f08311465ee4f9ce506992854
SHA512 c5aee01b9c83efaf78a999ad080e9673cc2be067d2931820f88b9ff365f8dca9a39e0f52a694d285dd950b2a438c9358c31477257886498acf5ceb681c332da7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvLlVlN.exe

Path C:\Windows\System\gvLlVlN.exe
Size 5.9MB
SHA256 545642b32bd7f0a74a2109850a8a4fb50e3539b06fba7cb26150f24309508132
MD5 dcc1358d32c92161ceb5bde0ce23e8fa
SHA1 102c06d514d5ba10082a178831bf98c97e56845f
SHA512 fa5e256470c64211f051ed60cc86fc59f0ade0f6edda74296f16d34801777e53edadda0d5bf59d71a16653304502c76314700744cdd46acf37147136ae859358
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbQSclZ.exe

Path C:\Windows\System\hbQSclZ.exe
Size 5.9MB
SHA256 c5b3d6ac52394bab65bca54a43fd497c7b93cbaf2b15697f387198460038e311
MD5 a3f5c5236cde030a854ee2f1b5c90432
SHA1 e11a8d57308df411f6f2da227ec112abcbdcca4a
SHA512 81345a77b48f89a7539bca03b8a246da19e08a47494bde9753b6446efcffbab915a9f34861b1ef89857e0cd313bac224eb1a410039a793b9360f732f56bc597f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqYDZTC.exe

Path C:\Windows\System\kqYDZTC.exe
Size 5.9MB
SHA256 38770d099f1437601d3092f7d2fbca3389c87ff5dcfac32830a7e8f88b45fdc8
MD5 a4ff237b082d8593d887f3e8881399a0
SHA1 a65a25f20c93a60ffdab5adab17e93dce4f91e23
SHA512 d1e46f2d0b3cd12e87969b03add102e9ba18be15a0962c5dea383ba6fd1a61274d0622865ddec98f70579f2db4959d1792293815a591a7b524c5f9756f5f67fe
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

lRdrIqD.exe

Path C:\Windows\System\lRdrIqD.exe
Size 5.9MB
SHA256 f86f8915265841f30b8c2764037417348633c523019193a71a8caa035e76adcd
MD5 dfcb40960d6ad6daf8fa6f2452ddda63
SHA1 168659b93b3c47c1c99b5fc999e2248a3b8ac008
SHA512 66f24ddedb419a2474ace1a60dbcc09cdbcf380f5aef0e0b0a0e83fd68f15f1f8194ddea5960f8992ad9bc0b995ade7e18273014c2604796dd7ec18cc6f444c2
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

sLCUXPA.exe

Path C:\Windows\System\sLCUXPA.exe
Size 5.9MB
SHA256 b7e3d061cb2d91f0e33b5e60812950208fa087d43fdf9d62a5e02309340d5360
MD5 b46837003dad01020584de9d4c53c69e
SHA1 c9c965b0dd82a34ccc7698178959bd3e212fb75a
SHA512 867d9dd904666b0610cb3bc2fcf8def3fbe630fcb802dc717715d1389c17567e147517068db5fdaea96165a7511e4dc8bb55af7293fc3f9570e2fdf1f5a25657
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLDmyLw.exe

Path C:\Windows\System\wLDmyLw.exe
Size 5.9MB
SHA256 bfa5e7c1407566062ab55b53b5f437895d891a7f26c17a56ac7d1c1072db07a7
MD5 2d731ae237132cda0ab400a13403d03d
SHA1 e5fd74b80e9e6e976c210ab8eae1c8e66d3f6fef
SHA512 f82df8f63343524b3fbc230233d0b8f73ea8aa8c1d129db7b6df743532a3fe078ddbcde0f19ebb1c4208916bf148a75008a984088f6926863fa5228e1121abe1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:T+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-20-0x00007FF794A30000-0x00007FF794D84000-memory.dmp

Download

memory/1048-142-0x00007FF794A30000-0x00007FF794D84000-memory.dmp

Download

memory/1260-53-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp

Download

memory/1260-147-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp

Download

memory/1260-135-0x00007FF6C27E0000-0x00007FF6C2B34000-memory.dmp

Download

memory/1460-72-0x00007FF6EE340000-0x00007FF6EE694000-memory.dmp

Download

memory/1460-150-0x00007FF6EE340000-0x00007FF6EE694000-memory.dmp

Download

memory/1484-99-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp

Download

memory/1484-155-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp

Download

memory/1484-139-0x00007FF7ABD50000-0x00007FF7AC0A4000-memory.dmp

Download

memory/1580-148-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp

Download

memory/1580-134-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp

Download

memory/1580-57-0x00007FF6DDEF0000-0x00007FF6DE244000-memory.dmp

Download

memory/1772-149-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp

Download

memory/1772-58-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp

Download

memory/1772-136-0x00007FF6A7300000-0x00007FF6A7654000-memory.dmp

Download

memory/2452-143-0x00007FF709900000-0x00007FF709C54000-memory.dmp

Download

memory/2452-26-0x00007FF709900000-0x00007FF709C54000-memory.dmp

Download

memory/2936-91-0x00007FF6492A0000-0x00007FF6495F4000-memory.dmp

Download

memory/2936-152-0x00007FF6492A0000-0x00007FF6495F4000-memory.dmp

Download

memory/3052-144-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp

Download

memory/3052-130-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp

Download

memory/3052-31-0x00007FF718C90000-0x00007FF718FE4000-memory.dmp

Download

memory/3196-43-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp

Download

memory/3196-146-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp

Download

memory/3196-133-0x00007FF7C4520000-0x00007FF7C4874000-memory.dmp

Download

memory/3532-125-0x00007FF758530000-0x00007FF758884000-memory.dmp

Download

memory/3532-158-0x00007FF758530000-0x00007FF758884000-memory.dmp

Download

memory/3828-129-0x00007FF77F650000-0x00007FF77F9A4000-memory.dmp

Download

memory/3828-156-0x00007FF77F650000-0x00007FF77F9A4000-memory.dmp

Download

memory/3932-138-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp

Download

memory/3932-153-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp

Download

memory/3932-90-0x00007FF763B60000-0x00007FF763EB4000-memory.dmp

Download

memory/4036-0-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp

Download

memory/4036-1-0x000001DA40EA0000-0x000001DA40EB0000-memory.dmp

Download

memory/4036-68-0x00007FF78BD50000-0x00007FF78C0A4000-memory.dmp

Download

memory/4116-69-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp

Download

memory/4116-140-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp

Download

memory/4116-10-0x00007FF7CC110000-0x00007FF7CC464000-memory.dmp

Download

memory/4376-126-0x00007FF630AE0000-0x00007FF630E34000-memory.dmp

Download

memory/4376-160-0x00007FF630AE0000-0x00007FF630E34000-memory.dmp

Download

memory/4404-73-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp

Download

memory/4404-151-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp

Download

memory/4404-137-0x00007FF7AA2C0000-0x00007FF7AA614000-memory.dmp

Download

memory/4660-157-0x00007FF6FC190000-0x00007FF6FC4E4000-memory.dmp

Download

memory/4660-131-0x00007FF6FC190000-0x00007FF6FC4E4000-memory.dmp

Download

memory/4788-128-0x00007FF6FCA30000-0x00007FF6FCD84000-memory.dmp

Download

memory/4788-154-0x00007FF6FCA30000-0x00007FF6FCD84000-memory.dmp

Download

memory/4824-145-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp

Download

memory/4824-38-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp

Download

memory/4824-132-0x00007FF63D8E0000-0x00007FF63DC34000-memory.dmp

Download

memory/4940-13-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp

Download

memory/4940-141-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp

Download

memory/4940-84-0x00007FF6DD4E0000-0x00007FF6DD834000-memory.dmp

Download

memory/5112-127-0x00007FF621ED0000-0x00007FF622224000-memory.dmp

Download

memory/5112-159-0x00007FF621ED0000-0x00007FF622224000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads