cobaltstrike | ca68ad0c74673b8ff792cae8538ec07d5361a7b7b6081b0f0f20a10626ff0934

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
Size 5.9MB
Sample240602-3tkjksbe9x
SHA256 ca68ad0c74673b8ff792cae8538ec07d5361a7b7b6081b0f0f20a10626ff0934
MD5 856df76a2790e7b4926c69dc9a1afe60
SHA1 b84335517e0d452467063a02ed38b327f5bac9ba
SHA512 6fefd1753a2490b6406e617ea01e1d58d44b006d0b05c65ff2b400ae138ef94d1022e886a16f79297ff39af4f8636863b1f23d0b95938512bec85e7d6deccbed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023252-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023255-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023256-11.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023259-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325a-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325b-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325c-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325d-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325e-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023260-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023261-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023262-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023263-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023264-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023265-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023266-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023268-103.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-119.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-130.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1972-0-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp	xmrig
behavioral2/files/0x0008000000023252-4.dat	xmrig
behavioral2/memory/532-8-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	xmrig
behavioral2/files/0x0008000000023255-10.dat	xmrig
behavioral2/memory/648-14-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	xmrig
behavioral2/files/0x0008000000023256-11.dat	xmrig
behavioral2/memory/2376-20-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp	xmrig
behavioral2/files/0x0009000000023259-22.dat	xmrig
behavioral2/memory/1480-26-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp	xmrig
behavioral2/files/0x000700000002325a-28.dat	xmrig
behavioral2/memory/1860-32-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	xmrig
behavioral2/files/0x000700000002325b-34.dat	xmrig
behavioral2/memory/2196-38-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	xmrig
behavioral2/files/0x000700000002325c-42.dat	xmrig
behavioral2/memory/3932-44-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	xmrig
behavioral2/files/0x000700000002325d-47.dat	xmrig
behavioral2/memory/412-50-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325e-52.dat	xmrig
behavioral2/memory/1764-56-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023260-59.dat	xmrig
behavioral2/memory/1972-61-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp	xmrig
behavioral2/memory/3504-63-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023261-66.dat	xmrig
behavioral2/memory/532-69-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	xmrig
behavioral2/memory/1796-70-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023262-72.dat	xmrig
behavioral2/memory/648-75-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	xmrig
behavioral2/memory/2128-77-0x00007FF7332F0000-0x00007FF733644000-memory.dmp	xmrig
behavioral2/files/0x0007000000023263-80.dat	xmrig
behavioral2/memory/2168-81-0x00007FF725360000-0x00007FF7256B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-87.dat	xmrig
behavioral2/files/0x0007000000023265-91.dat	xmrig
behavioral2/files/0x0007000000023266-97.dat	xmrig
behavioral2/memory/1624-101-0x00007FF6390A0000-0x00007FF6393F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023268-103.dat	xmrig
behavioral2/memory/2804-104-0x00007FF702DC0000-0x00007FF703114000-memory.dmp	xmrig
behavioral2/memory/5080-107-0x00007FF718D00000-0x00007FF719054000-memory.dmp	xmrig
behavioral2/memory/2196-111-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	xmrig
behavioral2/memory/2936-114-0x00007FF69CD20000-0x00007FF69D074000-memory.dmp	xmrig
behavioral2/files/0x000700000002326a-119.dat	xmrig
behavioral2/files/0x000700000002326b-124.dat	xmrig
behavioral2/memory/2808-122-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp	xmrig
behavioral2/memory/3900-126-0x00007FF674700000-0x00007FF674A54000-memory.dmp	xmrig
behavioral2/memory/1764-125-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	xmrig
behavioral2/memory/3932-118-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-112.dat	xmrig
behavioral2/files/0x000700000002326c-130.dat	xmrig
behavioral2/memory/2256-106-0x00007FF659310000-0x00007FF659664000-memory.dmp	xmrig
behavioral2/memory/1240-133-0x00007FF7CA450000-0x00007FF7CA7A4000-memory.dmp	xmrig
behavioral2/memory/2168-134-0x00007FF725360000-0x00007FF7256B4000-memory.dmp	xmrig
behavioral2/memory/2808-135-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp	xmrig
behavioral2/memory/532-136-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	xmrig
behavioral2/memory/648-137-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	xmrig
behavioral2/memory/2376-138-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp	xmrig
behavioral2/memory/3900-139-0x00007FF674700000-0x00007FF674A54000-memory.dmp	xmrig
behavioral2/memory/1480-140-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp	xmrig
behavioral2/memory/1860-141-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	xmrig
behavioral2/memory/2196-142-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	xmrig
behavioral2/memory/3932-143-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	xmrig
behavioral2/memory/412-144-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp	xmrig
behavioral2/memory/1764-145-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	xmrig
behavioral2/memory/3504-146-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp	xmrig
behavioral2/memory/1796-147-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp	xmrig
behavioral2/memory/2128-148-0x00007FF7332F0000-0x00007FF733644000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
532	EDMqpTs.exe
648	NayCEBJ.exe
2376	qylRFDB.exe
1480	QfXSLfT.exe
1860	FmQEooX.exe
2196	UzeATLo.exe
3932	VBEgjVz.exe
412	PjylCwR.exe
1764	OiKeKoV.exe
3504	oyDJGCH.exe
1796	gabVocp.exe
2128	vtAkWAw.exe
2168	lnYPmjo.exe
1624	kWdFBpg.exe
2804	OhAqsOL.exe
2256	QOvJTkm.exe
5080	MtIQVaG.exe
2936	MlDdTht.exe
2808	kdIYEvD.exe
3900	Smmnoug.exe
1240	vSxevfI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1972-0-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp	upx
behavioral2/files/0x0008000000023252-4.dat	upx
behavioral2/memory/532-8-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	upx
behavioral2/files/0x0008000000023255-10.dat	upx
behavioral2/memory/648-14-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	upx
behavioral2/files/0x0008000000023256-11.dat	upx
behavioral2/memory/2376-20-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp	upx
behavioral2/files/0x0009000000023259-22.dat	upx
behavioral2/memory/1480-26-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp	upx
behavioral2/files/0x000700000002325a-28.dat	upx
behavioral2/memory/1860-32-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	upx
behavioral2/files/0x000700000002325b-34.dat	upx
behavioral2/memory/2196-38-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	upx
behavioral2/files/0x000700000002325c-42.dat	upx
behavioral2/memory/3932-44-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	upx
behavioral2/files/0x000700000002325d-47.dat	upx
behavioral2/memory/412-50-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp	upx
behavioral2/files/0x000700000002325e-52.dat	upx
behavioral2/memory/1764-56-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	upx
behavioral2/files/0x0007000000023260-59.dat	upx
behavioral2/memory/1972-61-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp	upx
behavioral2/memory/3504-63-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp	upx
behavioral2/files/0x0007000000023261-66.dat	upx
behavioral2/memory/532-69-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	upx
behavioral2/memory/1796-70-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp	upx
behavioral2/files/0x0007000000023262-72.dat	upx
behavioral2/memory/648-75-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	upx
behavioral2/memory/2128-77-0x00007FF7332F0000-0x00007FF733644000-memory.dmp	upx
behavioral2/files/0x0007000000023263-80.dat	upx
behavioral2/memory/2168-81-0x00007FF725360000-0x00007FF7256B4000-memory.dmp	upx
behavioral2/files/0x0007000000023264-87.dat	upx
behavioral2/files/0x0007000000023265-91.dat	upx
behavioral2/files/0x0007000000023266-97.dat	upx
behavioral2/memory/1624-101-0x00007FF6390A0000-0x00007FF6393F4000-memory.dmp	upx
behavioral2/files/0x0007000000023268-103.dat	upx
behavioral2/memory/2804-104-0x00007FF702DC0000-0x00007FF703114000-memory.dmp	upx
behavioral2/memory/5080-107-0x00007FF718D00000-0x00007FF719054000-memory.dmp	upx
behavioral2/memory/2196-111-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	upx
behavioral2/memory/2936-114-0x00007FF69CD20000-0x00007FF69D074000-memory.dmp	upx
behavioral2/files/0x000700000002326a-119.dat	upx
behavioral2/files/0x000700000002326b-124.dat	upx
behavioral2/memory/2808-122-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp	upx
behavioral2/memory/3900-126-0x00007FF674700000-0x00007FF674A54000-memory.dmp	upx
behavioral2/memory/1764-125-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	upx
behavioral2/memory/3932-118-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	upx
behavioral2/files/0x0007000000023269-112.dat	upx
behavioral2/files/0x000700000002326c-130.dat	upx
behavioral2/memory/2256-106-0x00007FF659310000-0x00007FF659664000-memory.dmp	upx
behavioral2/memory/1240-133-0x00007FF7CA450000-0x00007FF7CA7A4000-memory.dmp	upx
behavioral2/memory/2168-134-0x00007FF725360000-0x00007FF7256B4000-memory.dmp	upx
behavioral2/memory/2808-135-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp	upx
behavioral2/memory/532-136-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp	upx
behavioral2/memory/648-137-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp	upx
behavioral2/memory/2376-138-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp	upx
behavioral2/memory/3900-139-0x00007FF674700000-0x00007FF674A54000-memory.dmp	upx
behavioral2/memory/1480-140-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp	upx
behavioral2/memory/1860-141-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp	upx
behavioral2/memory/2196-142-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp	upx
behavioral2/memory/3932-143-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	upx
behavioral2/memory/412-144-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp	upx
behavioral2/memory/1764-145-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp	upx
behavioral2/memory/3504-146-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp	upx
behavioral2/memory/1796-147-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp	upx
behavioral2/memory/2128-148-0x00007FF7332F0000-0x00007FF733644000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\vtAkWAw.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\MtIQVaG.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\Smmnoug.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\vSxevfI.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\VBEgjVz.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\PjylCwR.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\OiKeKoV.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\UzeATLo.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\QOvJTkm.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\QfXSLfT.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\gabVocp.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\kWdFBpg.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\EDMqpTs.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\NayCEBJ.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\qylRFDB.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\OhAqsOL.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\MlDdTht.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\kdIYEvD.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\FmQEooX.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\oyDJGCH.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
File created	C:\Windows\System\lnYPmjo.exe	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 532	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	91
PID 1972 wrote to memory of 532	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	91
PID 1972 wrote to memory of 648	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	92
PID 1972 wrote to memory of 648	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	92
PID 1972 wrote to memory of 2376	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	93
PID 1972 wrote to memory of 2376	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	93
PID 1972 wrote to memory of 1480	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	94
PID 1972 wrote to memory of 1480	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	94
PID 1972 wrote to memory of 1860	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	95
PID 1972 wrote to memory of 1860	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	95
PID 1972 wrote to memory of 2196	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	96
PID 1972 wrote to memory of 2196	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	96
PID 1972 wrote to memory of 3932	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	97
PID 1972 wrote to memory of 3932	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	97
PID 1972 wrote to memory of 412	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	98
PID 1972 wrote to memory of 412	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	98
PID 1972 wrote to memory of 1764	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	99
PID 1972 wrote to memory of 1764	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	99
PID 1972 wrote to memory of 3504	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	100
PID 1972 wrote to memory of 3504	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	100
PID 1972 wrote to memory of 1796	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	101
PID 1972 wrote to memory of 1796	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	101
PID 1972 wrote to memory of 2128	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	102
PID 1972 wrote to memory of 2128	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	102
PID 1972 wrote to memory of 2168	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	103
PID 1972 wrote to memory of 2168	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	103
PID 1972 wrote to memory of 1624	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	104
PID 1972 wrote to memory of 1624	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	104
PID 1972 wrote to memory of 2804	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	105
PID 1972 wrote to memory of 2804	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	105
PID 1972 wrote to memory of 2256	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	106
PID 1972 wrote to memory of 2256	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	106
PID 1972 wrote to memory of 5080	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	107
PID 1972 wrote to memory of 5080	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	107
PID 1972 wrote to memory of 2936	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	108
PID 1972 wrote to memory of 2936	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	108
PID 1972 wrote to memory of 2808	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	109
PID 1972 wrote to memory of 2808	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	109
PID 1972 wrote to memory of 3900	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	110
PID 1972 wrote to memory of 3900	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	110
PID 1972 wrote to memory of 1240	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	111
PID 1972 wrote to memory of 1240	1972	856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe	111

C:\Users\Admin\AppData\Local\Temp\856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\856df76a2790e7b4926c69dc9a1afe60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System\EDMqpTs.exe
  C:\Windows\System\EDMqpTs.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\NayCEBJ.exe
  C:\Windows\System\NayCEBJ.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\qylRFDB.exe
  C:\Windows\System\qylRFDB.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\QfXSLfT.exe
  C:\Windows\System\QfXSLfT.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\FmQEooX.exe
  C:\Windows\System\FmQEooX.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\UzeATLo.exe
  C:\Windows\System\UzeATLo.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\VBEgjVz.exe
  C:\Windows\System\VBEgjVz.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\PjylCwR.exe
  C:\Windows\System\PjylCwR.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\OiKeKoV.exe
  C:\Windows\System\OiKeKoV.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\oyDJGCH.exe
  C:\Windows\System\oyDJGCH.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\gabVocp.exe
  C:\Windows\System\gabVocp.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\vtAkWAw.exe
  C:\Windows\System\vtAkWAw.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\lnYPmjo.exe
  C:\Windows\System\lnYPmjo.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\kWdFBpg.exe
  C:\Windows\System\kWdFBpg.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OhAqsOL.exe
  C:\Windows\System\OhAqsOL.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\QOvJTkm.exe
  C:\Windows\System\QOvJTkm.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\MtIQVaG.exe
  C:\Windows\System\MtIQVaG.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\MlDdTht.exe
  C:\Windows\System\MlDdTht.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\kdIYEvD.exe
  C:\Windows\System\kdIYEvD.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\Smmnoug.exe
  C:\Windows\System\Smmnoug.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\vSxevfI.exe
  C:\Windows\System\vSxevfI.exe
  2⤵
  - Executes dropped EXE
  PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EDMqpTs.exe

Path C:\Windows\System\EDMqpTs.exe
Size 5.9MB
SHA256 b848bc8c8f92deaca51b1e552b7140e127dd43731c652106f1dd20d190907250
MD5 68fc342187c8ec0f0cc1206c92f1482f
SHA1 3ef8032498142377890471a2b3c1a59655477bde
SHA512 f067b9f6c26316b94f14eb7821e88df2cb5d2fdc7386024b33acab4b2baa567faa3e15ce5591e666fac9a4228c0800255853ea3234a28ec25c08d60aae7148e9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

FmQEooX.exe

Path C:\Windows\System\FmQEooX.exe
Size 5.9MB
SHA256 73d1de6420c7dbd2f658ab63375d1f7211e8bd512df672db532a3ab5911265c8
MD5 623a41dc92322884f4b64663dd19c573
SHA1 037a9e5911107a6136a2d8cdc4c5709bcabe58a1
SHA512 9abdabef6e78e6e485382c93991c1d0bd0946abe0302f047965222b7e21fd3923106c691b57113002e9d22565cd807df8201b8dcae567485102735ad8aef427d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlDdTht.exe

Path C:\Windows\System\MlDdTht.exe
Size 5.9MB
SHA256 f4bc478303850aa7ec1118a15994f8f3789112f0030bf039605d60d3e7d51336
MD5 169e12dbac185faf42620792853936cf
SHA1 7ab371e16cd83a22236fe57dc04a4d08ee5c167e
SHA512 f886e753a3620ddee50570877ed0a84127252c5f1ffc501218d21ddb929f06a67c7054d4ce594ef91caf81ac3ed62ce61491c67eb8a2c3bc3998f751c83a28df
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

MtIQVaG.exe

Path C:\Windows\System\MtIQVaG.exe
Size 5.9MB
SHA256 b367262da40a59e37cada64951bea991dbdd9eabd6852e78f1312becd66d173e
MD5 30b111a5e49394e28ef8fdcaad4e78c2
SHA1 2451743361cfb25c213cb35389201cd006954604
SHA512 217c569753ea52ed3060fd1447a023fcb3a0ac62f7c6d8c11f2b82b268b0af39bd3c9b435b7590332aa924304d75a8bc6f3fe04e60109c6b46fa3d1a1fd771c3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

NayCEBJ.exe

Path C:\Windows\System\NayCEBJ.exe
Size 5.9MB
SHA256 d774152f1e2af235f1bd2eb16bb9e63e1c1957c712230809d2f427cd06a9af15
MD5 241ddcc3fedff39536281e7e9ce0788c
SHA1 757a4a14e8f039d1d1b5b889a59e8b71f5f2765d
SHA512 80cf9d1f0bcae9c27bb3e42bf57e34f38928b9ac71e7bf78985d7319182dac91ce9ffa29a1542ded5203bf2945bfa862f903a7e43681cf4525bd50b9c6994da2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

OhAqsOL.exe

Path C:\Windows\System\OhAqsOL.exe
Size 5.9MB
SHA256 32443f18a2746d86204a2a2fb431e75111a5b53c52f21306efef43b363047fcc
MD5 f25b20b1814d9561c24bc94d405c7dce
SHA1 c6a59e9c524e7f88d6409528bbeef6d3caf8b38f
SHA512 feea7a1ac946593cd19f3f4f4bdf9b9e67982cb65ac8cbe9fb382370ea561a096b85718b3e557b7b094aeb261a2b56b694deaa0926150b739c77e4b76b831582
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

OiKeKoV.exe

Path C:\Windows\System\OiKeKoV.exe
Size 5.9MB
SHA256 e88b7a8a3974235e4ec39119398a27b7212ebb94836af1db5cf7714db990e1c8
MD5 b5fa9756bfa499a118e470cea6a86713
SHA1 18528dd3d8f979b3fd4497e98d7c21f1710a5520
SHA512 b308202b091997406c9d1317cae885abb8fec7e81da8c9526a9efe4081cb36d2f6511aeac3868a66ed1978ea4c5a15d57eff714bcfefbcfcb195467ea139b835
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

PjylCwR.exe

Path C:\Windows\System\PjylCwR.exe
Size 5.9MB
SHA256 8a095f2354761219dc96f7c268576de9b63fc0c05c3798a93ef321198943a1a4
MD5 fe809a05e793f40c2454f10805e88b5e
SHA1 65b0305bf0ca35626dfdd1ee58c8d9e39dd5c873
SHA512 18091f784d464fd0febdfcaaed7587a7947d0c7df3b18727237cd0874b3e122f94f346827cd11be62d247da53f4024cbe2b7289affa177971ab37b5fbd1e1ab2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

QOvJTkm.exe

Path C:\Windows\System\QOvJTkm.exe
Size 5.9MB
SHA256 225152a60ad093250dcb4563011c66b52b6cacf659e474cf9959a727f7461eae
MD5 21eb4ebd5a321748d5b757b003762d75
SHA1 99f14474e51c05d8585cec87130e3538ea1f48b8
SHA512 63442ab0192117f510a441c6407d3273ce46694909312704b37d322e6987351fbdf14f61f0a3a1ad8575160a05757440410d622ba657a80e898b64ce6b3d650e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

QfXSLfT.exe

Path C:\Windows\System\QfXSLfT.exe
Size 5.9MB
SHA256 66a237502c09e5d3ce01cbbd152a49b57472487a96d4da60506d02620da94f90
MD5 2816d3782e0389e082463215666e96ed
SHA1 60003f09f7cfb9f76cae73496d75b44a1d7d7fe8
SHA512 6e50765759c4045b397ca471b7f02108fdcfa1bbcd18f98f57cc724b44e81c5ab8f68fceaab5537d6b901e065e63aae07d544f220ce0584097163084522dc1cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

Smmnoug.exe

Path C:\Windows\System\Smmnoug.exe
Size 5.9MB
SHA256 726d62f3012c7159b4e59c113239344f72212d1240991b03698e82de9283b73f
MD5 94b16216eaca5bef31aa3e4e12b3f45b
SHA1 afe11012f9e3fd65067d2e059f1bf034544d378e
SHA512 d156ed95bd92b2924672312417899b6513e11b25c9fa85e0aa01d521d1dd53566e8f8081d669312c42d7b535089e8d2c05e382b9bd674e4d2aa875b196eb81d9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

UzeATLo.exe

Path C:\Windows\System\UzeATLo.exe
Size 5.9MB
SHA256 093553413b85cf450435135cf4118570139846edb3ae0e34dac6809321ce8932
MD5 df8566f32ba03838f6ed1735db4d1a26
SHA1 dc9c00a9ab5b0a26bada56f90f15857238a095eb
SHA512 f8e1bc8115cfa0652a39541dc0b89509d90e92335dbf4898b340620c7d790a218d2be86f303dbfb77acc090c2219be3cef56a7a359cd81212d70ee3ab350d6fd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBEgjVz.exe

Path C:\Windows\System\VBEgjVz.exe
Size 5.9MB
SHA256 73c7497c6da1f49ef376c41d86280f6cc7525a0e6d87f1bf5adbc6896353a64b
MD5 051401184e6a81e5f60d1e005fc35e7e
SHA1 a082bd0d53b02fa1b10d4bd91faa698f8e840874
SHA512 0f9038c2ed2fbf00b814e5fd7bdcfe3da337f87de356fe18d43b8fb4fed85623935934a2336216cdfdd13f725b56283d3e3ac4c65933eeba31c710f9dfe6a7e4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

gabVocp.exe

Path C:\Windows\System\gabVocp.exe
Size 5.9MB
SHA256 0bcaee06750a38fb81e5bba8f573aec4df0d1962af40abded131e4d4d7f13de0
MD5 20285714c76a4264de922781d50ba713
SHA1 79c2a4cf9306294af8193833a10184af9b7cfc10
SHA512 a90c229a3fba9f0fc12d0942b6fc0a6c531deab9631efc599cb5c9026a211c752aed35306be0b048b5bc5422007e2c5d453f91a1a4db14fe54106cdefdc8e86c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

kWdFBpg.exe

Path C:\Windows\System\kWdFBpg.exe
Size 5.9MB
SHA256 f2207e510eca4f5722da08f615d7dec9c0b61f7e709ab565e7559d2d35a4541e
MD5 abaad90c645792f233118ce5cd2727aa
SHA1 ef2730589dc181acc98e05f891aaa336dfdeb422
SHA512 83d3a0b4e8979a98d853282f497c2b817dc32498fc6cce36116d91f50edc1bcedb06fc65515bc65439cff85daa18530da86c86699d2ff7803610f8a3b23f73d5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

kdIYEvD.exe

Path C:\Windows\System\kdIYEvD.exe
Size 5.9MB
SHA256 f611a4a873b1e8228be93818e3a11f9827ee1ee674e0c01596c7f733dab0cf94
MD5 dc7294e9772ef22c873654b0924a752f
SHA1 e1f232ed0dde3c629e09ca618b5d5d4fe7c2dca0
SHA512 9362d013deccfd1720718f9f91620f4d977115310a57ce1b515712f8470c777564856b708fca4f55a08800316b21422d3c48a16eba932d7dba6eaaaded9e4955
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnYPmjo.exe

Path C:\Windows\System\lnYPmjo.exe
Size 5.9MB
SHA256 1e9b0a135cb6464ed6a2f91275651347e0a79c53c2bb25f09981615b8f1eaf37
MD5 8c2a041fefc7afd30587730c699512c1
SHA1 d4fbb20aff529862a3d558042ff41db9c9420fa9
SHA512 f083bc87a9433a4f5a3b7e821295a6e113443a1ecb5cd1ee0122dee4a9445b566078486614dc59ed8df6b6d72275b706060a437e00a36c8fbf43c9f52ce2224f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

oyDJGCH.exe

Path C:\Windows\System\oyDJGCH.exe
Size 5.9MB
SHA256 e31ff88113ab6b5cdb913cc93b51a65b466a9565849e45b96956dfda47ebfad4
MD5 5d1c3c576b43d0318601f7c1b4d72f65
SHA1 cb0caf844dafc36b898f2731588507f7e191d765
SHA512 7422e4fff6704d3f75f3356ab49852ba10c6305306317e867b0ed169248167335fe8c3892616e3904802c9788b498f2a4abf81990962553bbb109657b4a3241e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qylRFDB.exe

Path C:\Windows\System\qylRFDB.exe
Size 5.9MB
SHA256 c3baad6ab9ba8e49b82c0e2b4b13b4322adb8721fc103df9910be11fdccce97a
MD5 326a215c0147df1bc3a26f49d77ca068
SHA1 f60f5579a0b5b8d01cbd5844c2e6ba3b1d16f953
SHA512 74211be89e6bf39549437b37c42c4e18a7da47e311e522acaf40d27e2a138a9f869f4260baf7cf42f8c2e6cfe00edc23e9fa1cde0d26baf34590b6b207d1ab02
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vSxevfI.exe

Path C:\Windows\System\vSxevfI.exe
Size 5.9MB
SHA256 5f3b4d298df1d94550db731b184f120126d695d1a820ebe7da033e37f55ad122
MD5 68d809f70844772ddb06834e87f39817
SHA1 44ff77fe9c909112dcb099aa1017868607c70e8d
SHA512 ca3bf2d2558bc5e470c5f66bdce3270d97120c857f2610715540cfeedaffd40d7559082d862dd789a4090a17b747e7261780d42f544612d87663f8b2d8d4e957
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

vtAkWAw.exe

Path C:\Windows\System\vtAkWAw.exe
Size 5.9MB
SHA256 7e5e36cd6c3457d318efc947717c89ff0f29b871d546d5495140da6423004ed4
MD5 0361d60103e06e125f334a1664d42882
SHA1 0b64af7445f876d7f9fecb51454501ac807b19d4
SHA512 7b1630e6906da4c76469b67552d5c43009fb149dddfc75d5432b46e8a3d29173e27fc7ee775cf59d09270a6b70ef60f1cd037a9f289d3b3b30c5b27ada6f41a6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-144-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp

Download

memory/412-50-0x00007FF7170A0000-0x00007FF7173F4000-memory.dmp

Download

memory/532-136-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp

Download

memory/532-8-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp

Download

memory/532-69-0x00007FF755AE0000-0x00007FF755E34000-memory.dmp

Download

memory/648-75-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp

Download

memory/648-137-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp

Download

memory/648-14-0x00007FF66AFF0000-0x00007FF66B344000-memory.dmp

Download

memory/1240-157-0x00007FF7CA450000-0x00007FF7CA7A4000-memory.dmp

Download

memory/1240-133-0x00007FF7CA450000-0x00007FF7CA7A4000-memory.dmp

Download

memory/1480-26-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp

Download

memory/1480-140-0x00007FF757BC0000-0x00007FF757F14000-memory.dmp

Download

memory/1624-150-0x00007FF6390A0000-0x00007FF6393F4000-memory.dmp

Download

memory/1624-101-0x00007FF6390A0000-0x00007FF6393F4000-memory.dmp

Download

memory/1764-56-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp

Download

memory/1764-125-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp

Download

memory/1764-145-0x00007FF6EC970000-0x00007FF6ECCC4000-memory.dmp

Download

memory/1796-70-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp

Download

memory/1796-147-0x00007FF78CB70000-0x00007FF78CEC4000-memory.dmp

Download

memory/1860-32-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp

Download

memory/1860-141-0x00007FF6D7020000-0x00007FF6D7374000-memory.dmp

Download

memory/1972-61-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp

Download

memory/1972-0-0x00007FF6027E0000-0x00007FF602B34000-memory.dmp

Download

memory/1972-1-0x0000019366760000-0x0000019366770000-memory.dmp

Download

memory/2128-148-0x00007FF7332F0000-0x00007FF733644000-memory.dmp

Download

memory/2128-77-0x00007FF7332F0000-0x00007FF733644000-memory.dmp

Download

memory/2168-149-0x00007FF725360000-0x00007FF7256B4000-memory.dmp

Download

memory/2168-81-0x00007FF725360000-0x00007FF7256B4000-memory.dmp

Download

memory/2168-134-0x00007FF725360000-0x00007FF7256B4000-memory.dmp

Download

memory/2196-142-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp

Download

memory/2196-38-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp

Download

memory/2196-111-0x00007FF71A7E0000-0x00007FF71AB34000-memory.dmp

Download

memory/2256-106-0x00007FF659310000-0x00007FF659664000-memory.dmp

Download

memory/2256-152-0x00007FF659310000-0x00007FF659664000-memory.dmp

Download

memory/2376-138-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp

Download

memory/2376-20-0x00007FF6AFBF0000-0x00007FF6AFF44000-memory.dmp

Download

memory/2804-151-0x00007FF702DC0000-0x00007FF703114000-memory.dmp

Download

memory/2804-104-0x00007FF702DC0000-0x00007FF703114000-memory.dmp

Download

memory/2808-155-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp

Download

memory/2808-135-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp

Download

memory/2808-122-0x00007FF753AF0000-0x00007FF753E44000-memory.dmp

Download

memory/2936-154-0x00007FF69CD20000-0x00007FF69D074000-memory.dmp

Download

memory/2936-114-0x00007FF69CD20000-0x00007FF69D074000-memory.dmp

Download

memory/3504-146-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp

Download

memory/3504-63-0x00007FF72B820000-0x00007FF72BB74000-memory.dmp

Download

memory/3900-126-0x00007FF674700000-0x00007FF674A54000-memory.dmp

Download

memory/3900-156-0x00007FF674700000-0x00007FF674A54000-memory.dmp

Download

memory/3900-139-0x00007FF674700000-0x00007FF674A54000-memory.dmp

Download

memory/3932-44-0x00007FF73D410000-0x00007FF73D764000-memory.dmp

Download

memory/3932-143-0x00007FF73D410000-0x00007FF73D764000-memory.dmp

Download

memory/3932-118-0x00007FF73D410000-0x00007FF73D764000-memory.dmp

Download

memory/5080-153-0x00007FF718D00000-0x00007FF719054000-memory.dmp

Download

memory/5080-107-0x00007FF718D00000-0x00007FF719054000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads