cobaltstrike | 0c341d8e891744e0df77ae307fa411631e0b1386515237fb510b4daaa0512072

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
Size 5.9MB
Sample240602-3n8dfsce66
SHA256 0c341d8e891744e0df77ae307fa411631e0b1386515237fb510b4daaa0512072
MD5 84085798bdd8d4531a8e4ff3aa3abd00
SHA1 6ef8290b39809bf2fceb0f1b74c3c0072d6e3e5b
SHA512 9d759ccd921d75819f3aef4d6385182cfd22ff23bf5cf60cafadca30fa29a590dbf8d440922caf0d1bb675936096ce3a04bc4573d3b18b289acb1800d0288d00
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002340b-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-13.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002340c-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-68.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-67.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-114.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-109.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-122.dat	cobalt_reflective_dll
behavioral2/files/0x000d0000000006c5-125.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/948-0-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp	xmrig
behavioral2/files/0x000900000002340b-5.dat	xmrig
behavioral2/memory/3028-7-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-10.dat	xmrig
behavioral2/files/0x0007000000023410-13.dat	xmrig
behavioral2/memory/1064-14-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp	xmrig
behavioral2/memory/5064-18-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	xmrig
behavioral2/files/0x000800000002340c-23.dat	xmrig
behavioral2/files/0x0007000000023412-28.dat	xmrig
behavioral2/memory/1028-26-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp	xmrig
behavioral2/memory/872-30-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-34.dat	xmrig
behavioral2/memory/1808-38-0x00007FF7604B0000-0x00007FF760804000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-42.dat	xmrig
behavioral2/files/0x0007000000023415-47.dat	xmrig
behavioral2/memory/2476-50-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp	xmrig
behavioral2/memory/3128-49-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	xmrig
behavioral2/memory/3828-57-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-53.dat	xmrig
behavioral2/memory/2668-65-0x00007FF770D20000-0x00007FF771074000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-60.dat	xmrig
behavioral2/files/0x0007000000023417-59.dat	xmrig
behavioral2/memory/5028-71-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp	xmrig
behavioral2/memory/948-70-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-68.dat	xmrig
behavioral2/files/0x0007000000023419-67.dat	xmrig
behavioral2/memory/1660-77-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp	xmrig
behavioral2/memory/3576-91-0x00007FF629120000-0x00007FF629474000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-98.dat	xmrig
behavioral2/files/0x000700000002341e-107.dat	xmrig
behavioral2/memory/852-111-0x00007FF6FDAB0000-0x00007FF6FDE04000-memory.dmp	xmrig
behavioral2/memory/3568-116-0x00007FF7E7340000-0x00007FF7E7694000-memory.dmp	xmrig
behavioral2/memory/1248-117-0x00007FF654210000-0x00007FF654564000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-114.dat	xmrig
behavioral2/memory/5040-113-0x00007FF78F460000-0x00007FF78F7B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-112.dat	xmrig
behavioral2/files/0x000700000002341f-109.dat	xmrig
behavioral2/files/0x000700000002341d-105.dat	xmrig
behavioral2/memory/60-102-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp	xmrig
behavioral2/memory/3608-101-0x00007FF697FE0000-0x00007FF698334000-memory.dmp	xmrig
behavioral2/memory/3028-97-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-122.dat	xmrig
behavioral2/files/0x000d0000000006c5-125.dat	xmrig
behavioral2/memory/5064-128-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	xmrig
behavioral2/memory/1368-130-0x00007FF61E5D0000-0x00007FF61E924000-memory.dmp	xmrig
behavioral2/memory/3992-129-0x00007FF733A80000-0x00007FF733DD4000-memory.dmp	xmrig
behavioral2/memory/872-131-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	xmrig
behavioral2/memory/3128-132-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	xmrig
behavioral2/memory/3828-133-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	xmrig
behavioral2/memory/2668-134-0x00007FF770D20000-0x00007FF771074000-memory.dmp	xmrig
behavioral2/memory/5028-135-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp	xmrig
behavioral2/memory/1660-136-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp	xmrig
behavioral2/memory/3576-137-0x00007FF629120000-0x00007FF629474000-memory.dmp	xmrig
behavioral2/memory/3608-138-0x00007FF697FE0000-0x00007FF698334000-memory.dmp	xmrig
behavioral2/memory/60-139-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp	xmrig
behavioral2/memory/3028-140-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	xmrig
behavioral2/memory/1064-141-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp	xmrig
behavioral2/memory/5064-142-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	xmrig
behavioral2/memory/1028-143-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp	xmrig
behavioral2/memory/872-144-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	xmrig
behavioral2/memory/1808-145-0x00007FF7604B0000-0x00007FF760804000-memory.dmp	xmrig
behavioral2/memory/3128-146-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	xmrig
behavioral2/memory/2476-147-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp	xmrig
behavioral2/memory/3828-148-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3028	EzljMSj.exe
1064	msDtucq.exe
5064	DLwwomq.exe
1028	ahLwTXx.exe
872	fmLWpdw.exe
1808	vDodQKS.exe
3128	bfNhqjN.exe
2476	hFAxIhi.exe
3828	nLPbeYt.exe
5028	mVDteIT.exe
2668	hpRvkZL.exe
3576	ognxFFc.exe
1660	fbRgAIX.exe
3568	DFqReSI.exe
3608	DxbCXFZ.exe
60	ZVYQnLJ.exe
852	NlGTJCI.exe
5040	GDFkNOw.exe
1248	StZstKj.exe
3992	qGYAUEA.exe
1368	uAmZVck.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/948-0-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp	upx
behavioral2/files/0x000900000002340b-5.dat	upx
behavioral2/memory/3028-7-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	upx
behavioral2/files/0x000700000002340f-10.dat	upx
behavioral2/files/0x0007000000023410-13.dat	upx
behavioral2/memory/1064-14-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp	upx
behavioral2/memory/5064-18-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	upx
behavioral2/files/0x000800000002340c-23.dat	upx
behavioral2/files/0x0007000000023412-28.dat	upx
behavioral2/memory/1028-26-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp	upx
behavioral2/memory/872-30-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	upx
behavioral2/files/0x0007000000023413-34.dat	upx
behavioral2/memory/1808-38-0x00007FF7604B0000-0x00007FF760804000-memory.dmp	upx
behavioral2/files/0x0007000000023414-42.dat	upx
behavioral2/files/0x0007000000023415-47.dat	upx
behavioral2/memory/2476-50-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp	upx
behavioral2/memory/3128-49-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	upx
behavioral2/memory/3828-57-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	upx
behavioral2/files/0x0007000000023416-53.dat	upx
behavioral2/memory/2668-65-0x00007FF770D20000-0x00007FF771074000-memory.dmp	upx
behavioral2/files/0x0007000000023418-60.dat	upx
behavioral2/files/0x0007000000023417-59.dat	upx
behavioral2/memory/5028-71-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp	upx
behavioral2/memory/948-70-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp	upx
behavioral2/files/0x000700000002341a-68.dat	upx
behavioral2/files/0x0007000000023419-67.dat	upx
behavioral2/memory/1660-77-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp	upx
behavioral2/memory/3576-91-0x00007FF629120000-0x00007FF629474000-memory.dmp	upx
behavioral2/files/0x000700000002341c-98.dat	upx
behavioral2/files/0x000700000002341e-107.dat	upx
behavioral2/memory/852-111-0x00007FF6FDAB0000-0x00007FF6FDE04000-memory.dmp	upx
behavioral2/memory/3568-116-0x00007FF7E7340000-0x00007FF7E7694000-memory.dmp	upx
behavioral2/memory/1248-117-0x00007FF654210000-0x00007FF654564000-memory.dmp	upx
behavioral2/files/0x0007000000023420-114.dat	upx
behavioral2/memory/5040-113-0x00007FF78F460000-0x00007FF78F7B4000-memory.dmp	upx
behavioral2/files/0x000700000002341b-112.dat	upx
behavioral2/files/0x000700000002341f-109.dat	upx
behavioral2/files/0x000700000002341d-105.dat	upx
behavioral2/memory/60-102-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp	upx
behavioral2/memory/3608-101-0x00007FF697FE0000-0x00007FF698334000-memory.dmp	upx
behavioral2/memory/3028-97-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	upx
behavioral2/files/0x0007000000023421-122.dat	upx
behavioral2/files/0x000d0000000006c5-125.dat	upx
behavioral2/memory/5064-128-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	upx
behavioral2/memory/1368-130-0x00007FF61E5D0000-0x00007FF61E924000-memory.dmp	upx
behavioral2/memory/3992-129-0x00007FF733A80000-0x00007FF733DD4000-memory.dmp	upx
behavioral2/memory/872-131-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	upx
behavioral2/memory/3128-132-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	upx
behavioral2/memory/3828-133-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	upx
behavioral2/memory/2668-134-0x00007FF770D20000-0x00007FF771074000-memory.dmp	upx
behavioral2/memory/5028-135-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp	upx
behavioral2/memory/1660-136-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp	upx
behavioral2/memory/3576-137-0x00007FF629120000-0x00007FF629474000-memory.dmp	upx
behavioral2/memory/3608-138-0x00007FF697FE0000-0x00007FF698334000-memory.dmp	upx
behavioral2/memory/60-139-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp	upx
behavioral2/memory/3028-140-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp	upx
behavioral2/memory/1064-141-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp	upx
behavioral2/memory/5064-142-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp	upx
behavioral2/memory/1028-143-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp	upx
behavioral2/memory/872-144-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp	upx
behavioral2/memory/1808-145-0x00007FF7604B0000-0x00007FF760804000-memory.dmp	upx
behavioral2/memory/3128-146-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp	upx
behavioral2/memory/2476-147-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp	upx
behavioral2/memory/3828-148-0x00007FF729980000-0x00007FF729CD4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\hFAxIhi.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\ZVYQnLJ.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\StZstKj.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\qGYAUEA.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\uAmZVck.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\DLwwomq.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\bfNhqjN.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\nLPbeYt.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\EzljMSj.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\ahLwTXx.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\vDodQKS.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\hpRvkZL.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\ognxFFc.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\GDFkNOw.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\msDtucq.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\fmLWpdw.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\DxbCXFZ.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\DFqReSI.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\NlGTJCI.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\mVDteIT.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
File created	C:\Windows\System\fbRgAIX.exe	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	85
PID 948 wrote to memory of 3028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	85
PID 948 wrote to memory of 1064	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	86
PID 948 wrote to memory of 1064	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	86
PID 948 wrote to memory of 5064	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	89
PID 948 wrote to memory of 5064	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	89
PID 948 wrote to memory of 1028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	90
PID 948 wrote to memory of 1028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	90
PID 948 wrote to memory of 872	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	91
PID 948 wrote to memory of 872	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	91
PID 948 wrote to memory of 1808	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	92
PID 948 wrote to memory of 1808	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	92
PID 948 wrote to memory of 3128	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	93
PID 948 wrote to memory of 3128	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	93
PID 948 wrote to memory of 2476	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	94
PID 948 wrote to memory of 2476	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	94
PID 948 wrote to memory of 3828	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	95
PID 948 wrote to memory of 3828	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	95
PID 948 wrote to memory of 5028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	96
PID 948 wrote to memory of 5028	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	96
PID 948 wrote to memory of 2668	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	97
PID 948 wrote to memory of 2668	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	97
PID 948 wrote to memory of 3576	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	98
PID 948 wrote to memory of 3576	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	98
PID 948 wrote to memory of 1660	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	99
PID 948 wrote to memory of 1660	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	99
PID 948 wrote to memory of 3608	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	100
PID 948 wrote to memory of 3608	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	100
PID 948 wrote to memory of 3568	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	101
PID 948 wrote to memory of 3568	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	101
PID 948 wrote to memory of 60	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	102
PID 948 wrote to memory of 60	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	102
PID 948 wrote to memory of 852	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	103
PID 948 wrote to memory of 852	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	103
PID 948 wrote to memory of 5040	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	104
PID 948 wrote to memory of 5040	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	104
PID 948 wrote to memory of 1248	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	105
PID 948 wrote to memory of 1248	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	105
PID 948 wrote to memory of 3992	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	106
PID 948 wrote to memory of 3992	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	106
PID 948 wrote to memory of 1368	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	109
PID 948 wrote to memory of 1368	948	84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe	109

C:\Users\Admin\AppData\Local\Temp\84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\84085798bdd8d4531a8e4ff3aa3abd00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\System\EzljMSj.exe
  C:\Windows\System\EzljMSj.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\msDtucq.exe
  C:\Windows\System\msDtucq.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\DLwwomq.exe
  C:\Windows\System\DLwwomq.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ahLwTXx.exe
  C:\Windows\System\ahLwTXx.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\fmLWpdw.exe
  C:\Windows\System\fmLWpdw.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\vDodQKS.exe
  C:\Windows\System\vDodQKS.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\bfNhqjN.exe
  C:\Windows\System\bfNhqjN.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\hFAxIhi.exe
  C:\Windows\System\hFAxIhi.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\nLPbeYt.exe
  C:\Windows\System\nLPbeYt.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\mVDteIT.exe
  C:\Windows\System\mVDteIT.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\hpRvkZL.exe
  C:\Windows\System\hpRvkZL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ognxFFc.exe
  C:\Windows\System\ognxFFc.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\fbRgAIX.exe
  C:\Windows\System\fbRgAIX.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\DxbCXFZ.exe
  C:\Windows\System\DxbCXFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\DFqReSI.exe
  C:\Windows\System\DFqReSI.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ZVYQnLJ.exe
  C:\Windows\System\ZVYQnLJ.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\NlGTJCI.exe
  C:\Windows\System\NlGTJCI.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\GDFkNOw.exe
  C:\Windows\System\GDFkNOw.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\StZstKj.exe
  C:\Windows\System\StZstKj.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\qGYAUEA.exe
  C:\Windows\System\qGYAUEA.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\uAmZVck.exe
  C:\Windows\System\uAmZVck.exe
  2⤵
  - Executes dropped EXE
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DFqReSI.exe

Path C:\Windows\System\DFqReSI.exe
Size 5.9MB
SHA256 47dd61488b027be5756f5f62f09e33495e91a00b32e7dfaa3785cccddf157ab4
MD5 a483a8a56ace1e803a5b7b4b1ca70d88
SHA1 4898626089da52d8a0ead8b12ecc594235049b1d
SHA512 4b762a7a8e3ffd4823c1d0393c039c2bd27134d61e31ff532c3f3a2b53687693ba000c2f55ede584e15fec39d7d4ae0d3af439069f51dcd8eed521d9e927b2cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

DLwwomq.exe

Path C:\Windows\System\DLwwomq.exe
Size 5.9MB
SHA256 bfb700fbc14e84116eeb4853306b2df1f41534aa47b71c17b74d88440c1ea5e7
MD5 113a3617000c745e89aeb0461dd6787b
SHA1 b5e07cd503a3e70e69cde1b0a55d58edbd2fc58e
SHA512 ac8dec04a69429850510d8d5a12947522d3c91b4479fa9cd7f978fc4de3a71b9f5cebee75e251a3964c9b99b95a64c449e020001779f3af78808db53229ec81e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

DxbCXFZ.exe

Path C:\Windows\System\DxbCXFZ.exe
Size 5.9MB
SHA256 87a6218ff84b50fffef7e6003e102cde1e4b5d7e72dbc175245a07804bd6dd63
MD5 4e6e74369e13667239b16b0aa9bbbcaf
SHA1 7582bd0539c0c20103c878fd8cbfceb4db234720
SHA512 029c67e24a77cc46bfb92b52693674bc1c4df29af02464368851708f030ea0613c6a9f5d29a2d7909bd5af221259d94bbae611979d04355c046ec3ed90cbfce8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

EzljMSj.exe

Path C:\Windows\System\EzljMSj.exe
Size 5.9MB
SHA256 aef9ad44b58c714140bf3d092904fe4c8cd13e4d1f3ccad8f20e92f5befa92ec
MD5 f966b62f3b73d5d557325b3ea03cb45f
SHA1 dd2ee45600150cbb016263b21bc5b291fcfbaab0
SHA512 2c7a09b7144a431733c930b5775f9d750fe53b725626507dde34de352d793686fa3247849c03d93de240872276532b3e62cfbe4cc80388064582aaf8c82d839b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

GDFkNOw.exe

Path C:\Windows\System\GDFkNOw.exe
Size 5.9MB
SHA256 5ecb5edcc8b96b8d4c72bbcf722d22489cfed870c1db2b6aab62da2bace47393
MD5 854be79f40d3d8455840b47fa4110cb7
SHA1 d4b6a2f735d4497545ed97e95f9536d456af486a
SHA512 a5e6d4d1f267ac9dfc507ee513e4ed5c739579c9398f2158b81379ee6897f965bd0af05cc47dc836eab064a7476ffe1107734ff1c06cb9db6853960325b7ef16
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

NlGTJCI.exe

Path C:\Windows\System\NlGTJCI.exe
Size 5.9MB
SHA256 12ad73cd961cef937d063490c8fa443195d78178e844e5abfc06533d61e27f47
MD5 da1ce833e0603c0a1215fd3aca59d6e0
SHA1 2731e8e63456bda470d871056ffac7fbcbc008f7
SHA512 bb7918382ad1a6fb764f8f02cf9e55d900c80c8f2f3e3bee1cd50dee3596c2d9fd3f0c812deec54203a34d790fade69bf92bef23cd3178ea8a2effc0b5113d20
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

StZstKj.exe

Path C:\Windows\System\StZstKj.exe
Size 5.9MB
SHA256 decd513ea8bcd096830bd5ab64073cc2885bb42a1a2835a00ff525825cd242a1
MD5 5d18b73ba720ee25442196028236d496
SHA1 bb5928ca5280842c9a44af326a0dc53dcc44c15c
SHA512 4494612e11b5675f276f6964646d619d823914c520f8678fb7db5856a7f6ce465b37a3aca4790631b3ee4f0e2dca3c4114c91c314f50c1eab5b298d03e997d8c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZVYQnLJ.exe

Path C:\Windows\System\ZVYQnLJ.exe
Size 5.9MB
SHA256 c72a4c935eff53e6d3b198a849f520319dcdee8eb34c60dabd2fd662ed67c1fb
MD5 03e30cd9bd1549c4891315cafec5a3ba
SHA1 964e825e769920f3f35bf6905cf172e5dc0a04ba
SHA512 7e8ad2b197f2d1cdb1f96754bacc9fbfcbe6b05aad7831d2337ebcfee4a2935b73042016565f7ee75be09867b790090e8d47d5dcf4539f1d0fba20dddb08a707
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahLwTXx.exe

Path C:\Windows\System\ahLwTXx.exe
Size 5.9MB
SHA256 66092ebb866905da2824eb578fe13644cf76f5588bfa241c8fb29a4694834ac1
MD5 9918ea6d3e5c0565742308d2f31c7e57
SHA1 86f0f415fabffd37fe810666f8fdd5a24a03299e
SHA512 1ace08bb4cd07b78924f5e737a7913109df5f35a1158ff258e9cb3456e80eb03f0df3c7a07ef401df60f315007f31a86d12516074df7a7fc10fa2d7e84c6d818
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bfNhqjN.exe

Path C:\Windows\System\bfNhqjN.exe
Size 5.9MB
SHA256 8dcb0b8f0e948ae1ac2c9b297ba133bf2721c93b430b13572249fa507aa12a7f
MD5 a89c83f7e34c6a183c91ab8560a95454
SHA1 74aaa215ae9efe327d9b61a35f63a69a974ef971
SHA512 72a95a10ff75d7c0902246b65cb4f515888968ff49eaf00e9679d3a532601c6c8156374c2ce6959b05089d98e21ab9dfa614509111bfac6212bc177f4cf71b72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbRgAIX.exe

Path C:\Windows\System\fbRgAIX.exe
Size 5.9MB
SHA256 eea1a9b32a0ecde6f0fe7059701fd28a9a0bee679664911e7315619b74e04801
MD5 0b9484f9bd037dc7393f46bf14025255
SHA1 2715eabfdba5568f1a840c5464588dd66aecb0b7
SHA512 1de96d0d16ebb2df4d61c4a20bc84318979082ebca662fd1f3907029e80f9edd3e7366815a5d344fbcfcb311e931fdcf1f65a8a925cc657cf9a1b53a4137b7eb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

fmLWpdw.exe

Path C:\Windows\System\fmLWpdw.exe
Size 5.9MB
SHA256 b3c9152b89ef2a8a9cd2cb9a6782cfc43a7520556db0198e5c5b7e25a60786b1
MD5 bcc1fc5810f996f2aaf469a69e5ea2e8
SHA1 80298b9f717ebd1c5dc40bf76841ff2ba394fe86
SHA512 18779de643bd1ca9f2effd5fa8b75cfd4600077b64339421ac01ff33cdf96843f97c319899504bf3ab90795a52ee491c9686e491e1e4c3d33bfb5cf75d573701
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

hFAxIhi.exe

Path C:\Windows\System\hFAxIhi.exe
Size 5.9MB
SHA256 52fb6bf20c06979c62cb90e40f2c19a0f01609bad5226744c543703f36b418b8
MD5 bef430f49fc303a301ac8f6293c51a3b
SHA1 94dd581336df5aed8ee4a2e38ba5b00e01aefb4e
SHA512 e7d4233b1f2c6cc037e2ba8dadd9dae85b822084305d666bcaf4c12d8963e4e324d7b19b13ae2f977a41876332fb33a4778d0de94cd0ee4eb1abdecf854b8d6f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpRvkZL.exe

Path C:\Windows\System\hpRvkZL.exe
Size 5.9MB
SHA256 eb88d11bbcec293ed7c319c0dd53193b62fb926b0a235c8bcec2ddc7a0e521f9
MD5 3836c6f1e09bdcf1535be389baaa2404
SHA1 06a23e1469e29831c13a5051f03a5a800aaa5cef
SHA512 428e37252e81ae6aa2b3db2edb70496445681709659492767fe964a7d07e4a30763c540d17ae30cbb0eb48f02fd85e53c9d8e50de871be40ea736fd1c64b9d3b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mVDteIT.exe

Path C:\Windows\System\mVDteIT.exe
Size 5.9MB
SHA256 589bd98d430ecbf2a92a13c3358bb07e8b97c3d41f992576c3e5dca46c57ba7c
MD5 f0e6f95d087ab1591f9040acc2af4d26
SHA1 375ce16af6c495d661d7e328e0ca088a9953f2c0
SHA512 8330d436bf10454ea165057394aab8b12ebe2335f0f06553e8ed2a43a26e470ef17f55c362b4d55fcc86aeb240b3df300c9cb72de42e496248fe693d892e3b46
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

msDtucq.exe

Path C:\Windows\System\msDtucq.exe
Size 5.9MB
SHA256 014a93802f12ab1593c2c542b68be8c7de50a26f9b27a161ac95d7923f887fde
MD5 8064d1a785aa0061924ed34ccc7a6666
SHA1 071eb2755c149b182ffad78ec34ba34d8871ab9a
SHA512 59617ec03c23066dea804f8ebcf208d44733f13b4febd378992f526026a35779d9421d4e30236c918a9d5bb27885a68181707bfa165e8370b8161981858568a0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLPbeYt.exe

Path C:\Windows\System\nLPbeYt.exe
Size 5.9MB
SHA256 e8dc33befae0477847040ecb30aff2668b01a80be42c8e26943c5154151c01e6
MD5 b5ecc141e806bba962416c13c4c54264
SHA1 f101e332be8f89496769202975dc350e390189eb
SHA512 c7c435c9af91f3cc398ded9d66cdac78e50c46e81c1289a9f6d751aa7e591e353019d08366bccc150f0c18c293d6135aeb64ea1080fe7cd91f572efc185c68be
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

ognxFFc.exe

Path C:\Windows\System\ognxFFc.exe
Size 5.9MB
SHA256 d019de37f2d571ee9f90edb62b739371ee82d641f8e2fd0fbdfa72c38c717b2b
MD5 3bb725e35fd63b58c949d28da8197d8b
SHA1 80fe44831d68fa2f75bbb2ad10b5fa1770cc84fe
SHA512 86b33368909e96bef224e2d42d68683b4e0ccd04933ac3fa72758fef78c3f1007302c1a19215b3583aa3dc8865fa05eb561ab30409e66551b75e93ddcd5d3ffd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

qGYAUEA.exe

Path C:\Windows\System\qGYAUEA.exe
Size 5.9MB
SHA256 4e94e669aec7d545bdd2daed08ff1b5958775b716db9db9a6bc1fd428bcc7f84
MD5 83d59916987f0a3fec8fc9b652386057
SHA1 556cd267991d6f1707a190f730f8788270ea7073
SHA512 19a518a244feec3ec923a38879fca9a8ab4ccb25582924443f866c162b41577d785c39a824eaeaab49b42a53afbb221e3ba7a587452e1967871bba9ae00df55d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

uAmZVck.exe

Path C:\Windows\System\uAmZVck.exe
Size 5.9MB
SHA256 61673d25d0ecab59dc4cb81ed30a3c22067e5b330286657114b64995e8d9d7b7
MD5 8668e260349313bf27d082ada4e8120f
SHA1 8c0775294d9b15aa6c45509ea96b24cd710d184d
SHA512 c9549d1c99a2555addbf06f0ed775c67fbdae38c66275da67c12e7e55ebca7c9eef50acd637cd4c0150a3d615933437756fc2e71932c675ad8128c442ec42e5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

vDodQKS.exe

Path C:\Windows\System\vDodQKS.exe
Size 5.9MB
SHA256 82f8c74a2131622d40ef0fd705982ed4d157773f4ad88a3eacb9833fc590f06a
MD5 3301ba0bec7d93e77acb69654d324166
SHA1 366fb26c2b9a7d4f6e45e35fc980baaf07772f29
SHA512 7cb9d80a2d33e9bdeca7a59e5908e31844b9f8d7c8dff0e81007538e4a95802f5c648a4a48e816df25e3e461fe1254656fac0c0aa4ee6478c7e48176ea5edfae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-153-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp

Download

memory/60-102-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp

Download

memory/60-139-0x00007FF7F5AB0000-0x00007FF7F5E04000-memory.dmp

Download

memory/852-111-0x00007FF6FDAB0000-0x00007FF6FDE04000-memory.dmp

Download

memory/852-156-0x00007FF6FDAB0000-0x00007FF6FDE04000-memory.dmp

Download

memory/872-30-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp

Download

memory/872-144-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp

Download

memory/872-131-0x00007FF62D5B0000-0x00007FF62D904000-memory.dmp

Download

memory/948-1-0x000002593D8A0000-0x000002593D8B0000-memory.dmp

Download

memory/948-70-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp

Download

memory/948-0-0x00007FF7C1C00000-0x00007FF7C1F54000-memory.dmp

Download

memory/1028-143-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp

Download

memory/1028-26-0x00007FF7B1690000-0x00007FF7B19E4000-memory.dmp

Download

memory/1064-14-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp

Download

memory/1064-141-0x00007FF7139B0000-0x00007FF713D04000-memory.dmp

Download

memory/1248-117-0x00007FF654210000-0x00007FF654564000-memory.dmp

Download

memory/1248-158-0x00007FF654210000-0x00007FF654564000-memory.dmp

Download

memory/1368-160-0x00007FF61E5D0000-0x00007FF61E924000-memory.dmp

Download

memory/1368-130-0x00007FF61E5D0000-0x00007FF61E924000-memory.dmp

Download

memory/1660-152-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp

Download

memory/1660-77-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp

Download

memory/1660-136-0x00007FF77C680000-0x00007FF77C9D4000-memory.dmp

Download

memory/1808-38-0x00007FF7604B0000-0x00007FF760804000-memory.dmp

Download

memory/1808-145-0x00007FF7604B0000-0x00007FF760804000-memory.dmp

Download

memory/2476-50-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp

Download

memory/2476-147-0x00007FF758E90000-0x00007FF7591E4000-memory.dmp

Download

memory/2668-65-0x00007FF770D20000-0x00007FF771074000-memory.dmp

Download

memory/2668-134-0x00007FF770D20000-0x00007FF771074000-memory.dmp

Download

memory/2668-150-0x00007FF770D20000-0x00007FF771074000-memory.dmp

Download

memory/3028-140-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp

Download

memory/3028-7-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp

Download

memory/3028-97-0x00007FF71B8B0000-0x00007FF71BC04000-memory.dmp

Download

memory/3128-49-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp

Download

memory/3128-132-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp

Download

memory/3128-146-0x00007FF7B6F90000-0x00007FF7B72E4000-memory.dmp

Download

memory/3568-154-0x00007FF7E7340000-0x00007FF7E7694000-memory.dmp

Download

memory/3568-116-0x00007FF7E7340000-0x00007FF7E7694000-memory.dmp

Download

memory/3576-151-0x00007FF629120000-0x00007FF629474000-memory.dmp

Download

memory/3576-137-0x00007FF629120000-0x00007FF629474000-memory.dmp

Download

memory/3576-91-0x00007FF629120000-0x00007FF629474000-memory.dmp

Download

memory/3608-138-0x00007FF697FE0000-0x00007FF698334000-memory.dmp

Download

memory/3608-101-0x00007FF697FE0000-0x00007FF698334000-memory.dmp

Download

memory/3608-157-0x00007FF697FE0000-0x00007FF698334000-memory.dmp

Download

memory/3828-133-0x00007FF729980000-0x00007FF729CD4000-memory.dmp

Download

memory/3828-148-0x00007FF729980000-0x00007FF729CD4000-memory.dmp

Download

memory/3828-57-0x00007FF729980000-0x00007FF729CD4000-memory.dmp

Download

memory/3992-129-0x00007FF733A80000-0x00007FF733DD4000-memory.dmp

Download

memory/3992-159-0x00007FF733A80000-0x00007FF733DD4000-memory.dmp

Download

memory/5028-149-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp

Download

memory/5028-71-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp

Download

memory/5028-135-0x00007FF67FB30000-0x00007FF67FE84000-memory.dmp

Download

memory/5040-155-0x00007FF78F460000-0x00007FF78F7B4000-memory.dmp

Download

memory/5040-113-0x00007FF78F460000-0x00007FF78F7B4000-memory.dmp

Download

memory/5064-142-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp

Download

memory/5064-18-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp

Download

memory/5064-128-0x00007FF7F1A30000-0x00007FF7F1D84000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads