cobaltstrike | b69870fec7f438f67937e34f1447542f2ff7f7b50353d7e50800e84903e7e207

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-aa691scc44
SHA256 b69870fec7f438f67937e34f1447542f2ff7f7b50353d7e50800e84903e7e207
MD5 77505270a250a5e744f22d21493be26b
SHA1 880bd6fd8a9ca46f81eaf40f23e5a6c34cee52c9
SHA512 8ffdc27d1382aa5050672ec412163c324e67044031bf8cb5eb9bb42dd50d0c98c40fd8ad075f8c708b66af2fdf444fb5604759d3d3ef5ba107e50fecccc17736
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00050000000232a4-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-17.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-31.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-39.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-49.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023420-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-69.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-95.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-113.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-40.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00050000000232a4-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023420-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5112-0-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	UPX
behavioral2/files/0x00050000000232a4-4.dat	UPX
behavioral2/memory/3984-7-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-12.dat	UPX
behavioral2/files/0x0007000000023424-17.dat	UPX
behavioral2/memory/2972-28-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	UPX
behavioral2/memory/2136-29-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-31.dat	UPX
behavioral2/memory/4248-30-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	UPX
behavioral2/memory/4352-24-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-22.dat	UPX
behavioral2/files/0x0007000000023429-39.dat	UPX
behavioral2/files/0x000700000002342a-49.dat	UPX
behavioral2/files/0x0009000000023420-51.dat	UPX
behavioral2/files/0x000700000002342c-65.dat	UPX
behavioral2/files/0x000700000002342d-69.dat	UPX
behavioral2/files/0x000700000002342e-74.dat	UPX
behavioral2/files/0x000700000002342f-79.dat	UPX
behavioral2/files/0x0007000000023430-89.dat	UPX
behavioral2/files/0x0007000000023431-95.dat	UPX
behavioral2/files/0x0007000000023433-104.dat	UPX
behavioral2/files/0x0007000000023435-113.dat	UPX
behavioral2/files/0x0007000000023436-119.dat	UPX
behavioral2/files/0x0007000000023434-111.dat	UPX
behavioral2/files/0x0007000000023432-102.dat	UPX
behavioral2/memory/4716-86-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	UPX
behavioral2/memory/2128-83-0x00007FF631920000-0x00007FF631C74000-memory.dmp	UPX
behavioral2/memory/1392-82-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	UPX
behavioral2/memory/3640-81-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	UPX
behavioral2/memory/1072-78-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-60.dat	UPX
behavioral2/memory/3232-55-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	UPX
behavioral2/memory/1808-52-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	UPX
behavioral2/memory/4024-50-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023427-40.dat	UPX
behavioral2/memory/4076-36-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	UPX
behavioral2/memory/4648-122-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	UPX
behavioral2/memory/2192-123-0x00007FF680400000-0x00007FF680754000-memory.dmp	UPX
behavioral2/memory/4432-121-0x00007FF678F00000-0x00007FF679254000-memory.dmp	UPX
behavioral2/memory/1944-124-0x00007FF6C3300000-0x00007FF6C3654000-memory.dmp	UPX
behavioral2/memory/3328-125-0x00007FF6C1340000-0x00007FF6C1694000-memory.dmp	UPX
behavioral2/memory/3896-126-0x00007FF7BC5C0000-0x00007FF7BC914000-memory.dmp	UPX
behavioral2/memory/3488-127-0x00007FF67BDA0000-0x00007FF67C0F4000-memory.dmp	UPX
behavioral2/memory/5112-128-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	UPX
behavioral2/memory/3984-129-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	UPX
behavioral2/memory/4248-130-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	UPX
behavioral2/memory/4076-131-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	UPX
behavioral2/memory/1808-132-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	UPX
behavioral2/memory/3232-133-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	UPX
behavioral2/memory/3984-134-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	UPX
behavioral2/memory/4352-135-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	UPX
behavioral2/memory/2136-136-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	UPX
behavioral2/memory/2972-137-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	UPX
behavioral2/memory/4248-138-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	UPX
behavioral2/memory/4076-139-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	UPX
behavioral2/memory/4024-140-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	UPX
behavioral2/memory/3232-141-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	UPX
behavioral2/memory/1808-142-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	UPX
behavioral2/memory/1072-143-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	UPX
behavioral2/memory/3640-144-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	UPX
behavioral2/memory/2128-145-0x00007FF631920000-0x00007FF631C74000-memory.dmp	UPX
behavioral2/memory/4716-147-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	UPX
behavioral2/memory/1392-146-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	UPX
behavioral2/memory/4648-149-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5112-0-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	xmrig
behavioral2/files/0x00050000000232a4-4.dat	xmrig
behavioral2/memory/3984-7-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-12.dat	xmrig
behavioral2/files/0x0007000000023424-17.dat	xmrig
behavioral2/memory/2972-28-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	xmrig
behavioral2/memory/2136-29-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-31.dat	xmrig
behavioral2/memory/4248-30-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	xmrig
behavioral2/memory/4352-24-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-22.dat	xmrig
behavioral2/files/0x0007000000023429-39.dat	xmrig
behavioral2/files/0x000700000002342a-49.dat	xmrig
behavioral2/files/0x0009000000023420-51.dat	xmrig
behavioral2/files/0x000700000002342c-65.dat	xmrig
behavioral2/files/0x000700000002342d-69.dat	xmrig
behavioral2/files/0x000700000002342e-74.dat	xmrig
behavioral2/files/0x000700000002342f-79.dat	xmrig
behavioral2/files/0x0007000000023430-89.dat	xmrig
behavioral2/files/0x0007000000023431-95.dat	xmrig
behavioral2/files/0x0007000000023433-104.dat	xmrig
behavioral2/files/0x0007000000023435-113.dat	xmrig
behavioral2/files/0x0007000000023436-119.dat	xmrig
behavioral2/files/0x0007000000023434-111.dat	xmrig
behavioral2/files/0x0007000000023432-102.dat	xmrig
behavioral2/memory/4716-86-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	xmrig
behavioral2/memory/2128-83-0x00007FF631920000-0x00007FF631C74000-memory.dmp	xmrig
behavioral2/memory/1392-82-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	xmrig
behavioral2/memory/3640-81-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	xmrig
behavioral2/memory/1072-78-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-60.dat	xmrig
behavioral2/memory/3232-55-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	xmrig
behavioral2/memory/1808-52-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	xmrig
behavioral2/memory/4024-50-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-40.dat	xmrig
behavioral2/memory/4076-36-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	xmrig
behavioral2/memory/4648-122-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	xmrig
behavioral2/memory/2192-123-0x00007FF680400000-0x00007FF680754000-memory.dmp	xmrig
behavioral2/memory/4432-121-0x00007FF678F00000-0x00007FF679254000-memory.dmp	xmrig
behavioral2/memory/1944-124-0x00007FF6C3300000-0x00007FF6C3654000-memory.dmp	xmrig
behavioral2/memory/3328-125-0x00007FF6C1340000-0x00007FF6C1694000-memory.dmp	xmrig
behavioral2/memory/3896-126-0x00007FF7BC5C0000-0x00007FF7BC914000-memory.dmp	xmrig
behavioral2/memory/3488-127-0x00007FF67BDA0000-0x00007FF67C0F4000-memory.dmp	xmrig
behavioral2/memory/5112-128-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	xmrig
behavioral2/memory/3984-129-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	xmrig
behavioral2/memory/4248-130-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	xmrig
behavioral2/memory/4076-131-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	xmrig
behavioral2/memory/1808-132-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	xmrig
behavioral2/memory/3232-133-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	xmrig
behavioral2/memory/3984-134-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	xmrig
behavioral2/memory/4352-135-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	xmrig
behavioral2/memory/2136-136-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	xmrig
behavioral2/memory/2972-137-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	xmrig
behavioral2/memory/4248-138-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	xmrig
behavioral2/memory/4076-139-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	xmrig
behavioral2/memory/4024-140-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	xmrig
behavioral2/memory/3232-141-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	xmrig
behavioral2/memory/1808-142-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	xmrig
behavioral2/memory/1072-143-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	xmrig
behavioral2/memory/3640-144-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	xmrig
behavioral2/memory/2128-145-0x00007FF631920000-0x00007FF631C74000-memory.dmp	xmrig
behavioral2/memory/4716-147-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	xmrig
behavioral2/memory/1392-146-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	xmrig
behavioral2/memory/4648-149-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3984	EXhXIBY.exe
4352	PPjTRwQ.exe
2136	ZTnDYze.exe
2972	MRjHNJN.exe
4248	muIVuOS.exe
4076	Hkdghli.exe
4024	FFzgfWt.exe
1808	eNGTRDD.exe
3232	wxxtyAU.exe
1072	jmWYgMT.exe
3640	DihDpCl.exe
1392	fPlAwSN.exe
2128	XsznOjA.exe
4716	vZWLXrZ.exe
4432	OxedOkp.exe
4648	yfMpxdA.exe
2192	OVtpMtX.exe
1944	HgiVLzk.exe
3328	oEmVAoN.exe
3896	LnnQoUG.exe
3488	ocBZFyi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5112-0-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	upx
behavioral2/files/0x00050000000232a4-4.dat	upx
behavioral2/memory/3984-7-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-12.dat	upx
behavioral2/files/0x0007000000023424-17.dat	upx
behavioral2/memory/2972-28-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	upx
behavioral2/memory/2136-29-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	upx
behavioral2/files/0x0007000000023426-31.dat	upx
behavioral2/memory/4248-30-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	upx
behavioral2/memory/4352-24-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	upx
behavioral2/files/0x0007000000023425-22.dat	upx
behavioral2/files/0x0007000000023429-39.dat	upx
behavioral2/files/0x000700000002342a-49.dat	upx
behavioral2/files/0x0009000000023420-51.dat	upx
behavioral2/files/0x000700000002342c-65.dat	upx
behavioral2/files/0x000700000002342d-69.dat	upx
behavioral2/files/0x000700000002342e-74.dat	upx
behavioral2/files/0x000700000002342f-79.dat	upx
behavioral2/files/0x0007000000023430-89.dat	upx
behavioral2/files/0x0007000000023431-95.dat	upx
behavioral2/files/0x0007000000023433-104.dat	upx
behavioral2/files/0x0007000000023435-113.dat	upx
behavioral2/files/0x0007000000023436-119.dat	upx
behavioral2/files/0x0007000000023434-111.dat	upx
behavioral2/files/0x0007000000023432-102.dat	upx
behavioral2/memory/4716-86-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	upx
behavioral2/memory/2128-83-0x00007FF631920000-0x00007FF631C74000-memory.dmp	upx
behavioral2/memory/1392-82-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	upx
behavioral2/memory/3640-81-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	upx
behavioral2/memory/1072-78-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	upx
behavioral2/files/0x000700000002342b-60.dat	upx
behavioral2/memory/3232-55-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	upx
behavioral2/memory/1808-52-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	upx
behavioral2/memory/4024-50-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	upx
behavioral2/files/0x0007000000023427-40.dat	upx
behavioral2/memory/4076-36-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	upx
behavioral2/memory/4648-122-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	upx
behavioral2/memory/2192-123-0x00007FF680400000-0x00007FF680754000-memory.dmp	upx
behavioral2/memory/4432-121-0x00007FF678F00000-0x00007FF679254000-memory.dmp	upx
behavioral2/memory/1944-124-0x00007FF6C3300000-0x00007FF6C3654000-memory.dmp	upx
behavioral2/memory/3328-125-0x00007FF6C1340000-0x00007FF6C1694000-memory.dmp	upx
behavioral2/memory/3896-126-0x00007FF7BC5C0000-0x00007FF7BC914000-memory.dmp	upx
behavioral2/memory/3488-127-0x00007FF67BDA0000-0x00007FF67C0F4000-memory.dmp	upx
behavioral2/memory/5112-128-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp	upx
behavioral2/memory/3984-129-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	upx
behavioral2/memory/4248-130-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	upx
behavioral2/memory/4076-131-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	upx
behavioral2/memory/1808-132-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	upx
behavioral2/memory/3232-133-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	upx
behavioral2/memory/3984-134-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp	upx
behavioral2/memory/4352-135-0x00007FF678EE0000-0x00007FF679234000-memory.dmp	upx
behavioral2/memory/2136-136-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp	upx
behavioral2/memory/2972-137-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp	upx
behavioral2/memory/4248-138-0x00007FF681CB0000-0x00007FF682004000-memory.dmp	upx
behavioral2/memory/4076-139-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp	upx
behavioral2/memory/4024-140-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp	upx
behavioral2/memory/3232-141-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp	upx
behavioral2/memory/1808-142-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp	upx
behavioral2/memory/1072-143-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp	upx
behavioral2/memory/3640-144-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp	upx
behavioral2/memory/2128-145-0x00007FF631920000-0x00007FF631C74000-memory.dmp	upx
behavioral2/memory/4716-147-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp	upx
behavioral2/memory/1392-146-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp	upx
behavioral2/memory/4648-149-0x00007FF600850000-0x00007FF600BA4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\OVtpMtX.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HgiVLzk.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oEmVAoN.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LnnQoUG.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZTnDYze.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eNGTRDD.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wxxtyAU.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jmWYgMT.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fPlAwSN.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yfMpxdA.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MRjHNJN.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Hkdghli.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vZWLXrZ.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OxedOkp.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ocBZFyi.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EXhXIBY.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PPjTRwQ.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\muIVuOS.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FFzgfWt.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DihDpCl.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XsznOjA.exe	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3984	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	86
PID 5112 wrote to memory of 3984	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	86
PID 5112 wrote to memory of 4352	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	87
PID 5112 wrote to memory of 4352	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	87
PID 5112 wrote to memory of 2136	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	88
PID 5112 wrote to memory of 2136	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	88
PID 5112 wrote to memory of 2972	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	89
PID 5112 wrote to memory of 2972	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	89
PID 5112 wrote to memory of 4248	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	90
PID 5112 wrote to memory of 4248	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	90
PID 5112 wrote to memory of 4076	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	91
PID 5112 wrote to memory of 4076	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	91
PID 5112 wrote to memory of 4024	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	92
PID 5112 wrote to memory of 4024	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	92
PID 5112 wrote to memory of 1808	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	93
PID 5112 wrote to memory of 1808	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	93
PID 5112 wrote to memory of 3232	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	94
PID 5112 wrote to memory of 3232	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	94
PID 5112 wrote to memory of 1072	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	95
PID 5112 wrote to memory of 1072	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	95
PID 5112 wrote to memory of 3640	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	96
PID 5112 wrote to memory of 3640	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	96
PID 5112 wrote to memory of 1392	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	97
PID 5112 wrote to memory of 1392	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	97
PID 5112 wrote to memory of 2128	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	98
PID 5112 wrote to memory of 2128	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	98
PID 5112 wrote to memory of 4716	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	99
PID 5112 wrote to memory of 4716	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	99
PID 5112 wrote to memory of 4432	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	100
PID 5112 wrote to memory of 4432	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	100
PID 5112 wrote to memory of 4648	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	101
PID 5112 wrote to memory of 4648	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	101
PID 5112 wrote to memory of 2192	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	102
PID 5112 wrote to memory of 2192	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	102
PID 5112 wrote to memory of 1944	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	103
PID 5112 wrote to memory of 1944	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	103
PID 5112 wrote to memory of 3328	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	104
PID 5112 wrote to memory of 3328	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	104
PID 5112 wrote to memory of 3896	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	105
PID 5112 wrote to memory of 3896	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	105
PID 5112 wrote to memory of 3488	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	106
PID 5112 wrote to memory of 3488	5112	2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_77505270a250a5e744f22d21493be26b_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System\EXhXIBY.exe
  C:\Windows\System\EXhXIBY.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\PPjTRwQ.exe
  C:\Windows\System\PPjTRwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\ZTnDYze.exe
  C:\Windows\System\ZTnDYze.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MRjHNJN.exe
  C:\Windows\System\MRjHNJN.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\muIVuOS.exe
  C:\Windows\System\muIVuOS.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\Hkdghli.exe
  C:\Windows\System\Hkdghli.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\FFzgfWt.exe
  C:\Windows\System\FFzgfWt.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\eNGTRDD.exe
  C:\Windows\System\eNGTRDD.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\wxxtyAU.exe
  C:\Windows\System\wxxtyAU.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\jmWYgMT.exe
  C:\Windows\System\jmWYgMT.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\DihDpCl.exe
  C:\Windows\System\DihDpCl.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\fPlAwSN.exe
  C:\Windows\System\fPlAwSN.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\XsznOjA.exe
  C:\Windows\System\XsznOjA.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\vZWLXrZ.exe
  C:\Windows\System\vZWLXrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\OxedOkp.exe
  C:\Windows\System\OxedOkp.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\yfMpxdA.exe
  C:\Windows\System\yfMpxdA.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\OVtpMtX.exe
  C:\Windows\System\OVtpMtX.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\HgiVLzk.exe
  C:\Windows\System\HgiVLzk.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\oEmVAoN.exe
  C:\Windows\System\oEmVAoN.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\LnnQoUG.exe
  C:\Windows\System\LnnQoUG.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\ocBZFyi.exe
  C:\Windows\System\ocBZFyi.exe
  2⤵
  - Executes dropped EXE
  PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DihDpCl.exe

Path C:\Windows\System\DihDpCl.exe
Size 5.9MB
SHA256 4c80b16ba6bfd61537a01734dac67c783a51bd2652b8bfd039640c762af95ca4
MD5 3c1a1f3bbb232e5bde936285ab7b4077
SHA1 317eecb3074e0c347e2ee70dfe73f399998d7b3e
SHA512 0a57e251654b79969453023667ff2c50a9f3ab0e10c70d143b69dbb5e0d34359d955d71e527e036bf6505d2183f3cd29a6ac24f01af2fdb88d167f64249242f0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

EXhXIBY.exe

Path C:\Windows\System\EXhXIBY.exe
Size 5.9MB
SHA256 86fd952429dfc4ccd1c610dd62ba872900137055505333f3b60d95bffab241cd
MD5 163d5e4a6c9934486f4debe0f8f3b67f
SHA1 6c082dadcdd99a2f0d80cff507e6789f034c4bc8
SHA512 6fa4e553ebe6927e944b5318d27a51cb5919b4f4ac1d7ed37da529b2fc2ae66dcd820fb3a3b3243260ee9e3270ab08139674817af1315b607ce1aad38b8e86ca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

FFzgfWt.exe

Path C:\Windows\System\FFzgfWt.exe
Size 5.9MB
SHA256 cf34e371d4c48980b2d6d4f66bcce79d0b9fd667ccd412700e60f49332069eee
MD5 f880012e85c9260e34a8d0da27f1e924
SHA1 23974e828bb108d6c67224463e5f39fb63669722
SHA512 4f7fcbc33f864ca1235645eae9a1db6154e3f8b1b2b154f46bff9ac19fdb2fbc4da33d898674e9183441d7949a20be0c38109853bb772e7c23908c60a9034a78
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

HgiVLzk.exe

Path C:\Windows\System\HgiVLzk.exe
Size 5.9MB
SHA256 da5d59260dc95f8e3d3c4260c4994f09a574cd4889acdef83f387f96353f40a2
MD5 c9019919a16483321e2d889fced1d7a8
SHA1 9853aa82aa92a059d34a2162a04c197f45a0d989
SHA512 1442c23228884f6b0618f81972a69014256f934ab7b4ccdf8887e09a2e20519afdd3af273e1feaa47fa17f5260f606a0d74befdc6cd18cc5d573d0da93b14694
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkdghli.exe

Path C:\Windows\System\Hkdghli.exe
Size 5.9MB
SHA256 e04acad61e52b7c39fd74f8df65714c15831bad907433867da0cf01ef93e1f0b
MD5 8952e3873ce7db22e6b718443450f46a
SHA1 e153e9fe9cf0047060cf113acd3d5b97c81831c5
SHA512 b01d29e9306d30c47253946199f1dff4094318e5819af0955b07ef0d73ca18013f76a687b8c03e772bbc7692ce904de7fdfa6270071da6da285501f16c5e36c1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

LnnQoUG.exe

Path C:\Windows\System\LnnQoUG.exe
Size 5.9MB
SHA256 3e2f74b28cd1c9a57b0ec16bb15ce2b952e5ba36c06ee1baeba2077b6d7dd8fc
MD5 94204cb53fc6a6dbb7d090f2d6fc33fb
SHA1 9f88ea0f45462c1967fb50f7ab96b30272d81409
SHA512 f8ba8296fef6fff805643f96dc374d0ab49c33ce2795ced93ddeb37d01a570e90a7d97154092680194e32259ecbee9bb0fd12cdaa37ab648541ae90247f1c55b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

MRjHNJN.exe

Path C:\Windows\System\MRjHNJN.exe
Size 5.9MB
SHA256 f701becaa98f7a47171b99af8984c48f876802b942fa841fece9256169089177
MD5 ad21edf236bebf7c3ec6dee3b8faa03d
SHA1 d7286634e1f5ed2bd49b1a5adabd2a990eb873b8
SHA512 ffab6639bfb6191cabceb1467a80cd01343bc6c55f67056ef9b5c02d9eec68d0d80271e57eb42b3026dfbf6de765ba4b27c74d2eab14e1993f18fc60075626e2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

OVtpMtX.exe

Path C:\Windows\System\OVtpMtX.exe
Size 5.9MB
SHA256 30150dc72fa6da459c624ca9f33c87f0bbff5d8c0aec942405454b06308e9271
MD5 0bd367474387c4028de6f7e4f37143e6
SHA1 95d97a090294bd9312b43a7e3e7342ab069db9d4
SHA512 cca26ec5f6c2269ec9023d797389b7a94bd5a17d47c1d85a31c8ceeecfeae6ccc1d19c2856c3b0ee0d89368026bbbbe50f2cc5c9f74708dc2a49a8942dfd8368
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

OxedOkp.exe

Path C:\Windows\System\OxedOkp.exe
Size 5.9MB
SHA256 ea49b569efbf948f34decad75b352b8a138a16474df4ca8145d112c9699d0b56
MD5 f77e9c93d50c4219ec020de7b93fcdf4
SHA1 629ffdb5d3298bd16217ea37e42c2bdcbc0a32ba
SHA512 c1c109cf95da54fa5b4dce4631d3596d6c47a3f263222a12b38980426af6930ccd2e14a923668732c9457966340f85b286450817e4f5a81e5189873b71ce658b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

PPjTRwQ.exe

Path C:\Windows\System\PPjTRwQ.exe
Size 5.9MB
SHA256 2041bec9e7eb7c7476f9de32b469ad7a6c447f1224d73760384659b8e9dd2854
MD5 87adc767cff42825487b964ae73e0b7b
SHA1 9b816819efd3abe293e675350b12b9e56aef2124
SHA512 7d630a5ea43859594ee273ac7977899a4c67cd9cf6aca3a725474732a46ef240a66f7e8ab4ec3b902819ace346a2d5af4ca3d7fb9730317ba07596301d0a0e69
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsznOjA.exe

Path C:\Windows\System\XsznOjA.exe
Size 5.9MB
SHA256 6a23762d325f7edc7d97740864705b054b7fa41be6cf3603933ce4ba5dcfe785
MD5 ab5936276f8aff071222396332011f0f
SHA1 9eace4873388327ffe120b5a6dd13d1e14b8e562
SHA512 f49cc70fe09cd489e8831a392cb2a29a9077ee3c38eae897609d8f9c463fc624b9973a0c7ba2442f91bdf1fd01ca79ffa8411a20e9428f61981c029a336962a8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZTnDYze.exe

Path C:\Windows\System\ZTnDYze.exe
Size 5.9MB
SHA256 3ca1e0cf31205e638703c50e72a654b95e09609c5020ebad12cc442de8865fe1
MD5 f17f30bfd11692db877921fdbc2e56aa
SHA1 6e40fb5734c35f98723b922c46885e680fc1e8fc
SHA512 3482c6af609b91465364c083d6ee59389fd0c4fc0bae8fbe6060d6b05e62b10c9165e656c19f0972533a5ffa7a631ff6720b6149b1b116fa02841e9cf15b43db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

eNGTRDD.exe

Path C:\Windows\System\eNGTRDD.exe
Size 5.9MB
SHA256 592fdfc0e6f2cbbb10cf16956c95683e56da76457c6ec5a294c679e92eb583d1
MD5 e2a33d9d9b9fa359cdf86580d622cd05
SHA1 bdd3e5e91457e868e176de49d5f1894513b2a5cd
SHA512 8914ed8893f67e8a72ce186a0538babdf342c5f8368cffd681c2fdbb533b534a1f6d344e716646ee77621d0b8285fd1154a763cf461736008002ea434a4e666d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

fPlAwSN.exe

Path C:\Windows\System\fPlAwSN.exe
Size 5.9MB
SHA256 439dd95f4d98a18789e028b6b043eccaa24bd1589f85c8157553c1167d027357
MD5 929039e64d0605f07accc87259099929
SHA1 ed84188844c16814c4c82cefdd5a90b978775a92
SHA512 99eca3ee7d30548335f2792ab055d94b17a06112dbeb81ee096c9f119013896bc231c0737787ab6ce537ed77ae58ad8785056cd6f010d70e21831541bad5e824
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmWYgMT.exe

Path C:\Windows\System\jmWYgMT.exe
Size 5.9MB
SHA256 255e6256223aa3dae00959dd7800b4905a30fad678d9d63f0a2897ee3a75dd19
MD5 9ddde07fd7db0216a4ec0f45cc76ecf4
SHA1 36f8c53910fb84151224d0fc41c853ff2220d4e3
SHA512 0c71940b777e912dabe0bb39f0881b80fd9896d3c38edfee6e47a87bc81fea14174edfa4b50d3d17e94eae7ca903addf6111dfacd4b771d1804371898e79a759
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

muIVuOS.exe

Path C:\Windows\System\muIVuOS.exe
Size 5.9MB
SHA256 efa466d5c9c49adbd3692c285514898b4f14e32fdb151ff515b9adcb14b6c7b3
MD5 c2a7246cddbe0da22b652f15ee777b8f
SHA1 33ce65428fcdd8304841e0f01e83a62a1e736d09
SHA512 1eb28599225c84ae792c1b639558966203f23d350fbaf6ec98f6b49abb454af7d9cb11660bd3b793c7b6d73eff64c2eb5f58e215a189f000277bb271c13a687f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

oEmVAoN.exe

Path C:\Windows\System\oEmVAoN.exe
Size 5.9MB
SHA256 cd4b6feabd60280d85403f1e67103ce921c75cfbe1d6cf65c1e6e5f237f5e9af
MD5 1168248d89f235e58b93f1e15ca8f401
SHA1 0f5eb29e2b64756f563ad053ac6cfc9e6da920e6
SHA512 0943e26bd881aa041aaf59780be2afee2e9902cd0ee6caaa78165882e3560f9f8001ebd3b83f80423ebe785d32ed9df07bb995c21b47edc7b346769d2d4a10ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

ocBZFyi.exe

Path C:\Windows\System\ocBZFyi.exe
Size 5.9MB
SHA256 30d05944e70067bf7ae1bf3574ea2984a9fa546d54895becce2b9bf6bea5cc7b
MD5 eb33df6d131028ca4eefe170d9e72f3a
SHA1 0c0d36932a040aaf634fded845062469570d6417
SHA512 59ed53d7329755ee8b76a279610912cc26c48c8c6919bae71070006c5d3500c795251ba71f80001a8da3ec4e88cf8d1c39390c39c9ee7cb04b80bf70750ad4ad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

vZWLXrZ.exe

Path C:\Windows\System\vZWLXrZ.exe
Size 5.9MB
SHA256 3658a5356f3bcd54b1a1e9886f267d258c0b51a885a1c6c4c20c626cd05c6104
MD5 b6d1d48f258f6e05c9023f45b89fbb3b
SHA1 455330749cb49fc536609baf1f7f9e0cde4c2afc
SHA512 d7bdd4edd65201816aa44995360d9eb495398f86de95dd2d1fb8bf8878638170478834c899ec40f7ca437986f0a74f5fae96fdf6594af5a9ee70307465975402
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

wxxtyAU.exe

Path C:\Windows\System\wxxtyAU.exe
Size 5.9MB
SHA256 71c30c2abea2cbf54b036ce1bf838294f93f1445344843b203e17a9ffa394465
MD5 a29afec420644744e69ca5cdfe06750d
SHA1 f70ffe7f36d8f000116324842a96bfc2bf77e60b
SHA512 8259ae583d7e518f125d0e442cd46e2ddf49f26bef00810d77a4f1ed061f9be01c038dce63cd8437604d0939ccf7d6536dd7569453d93c09c593c4db41822cad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

yfMpxdA.exe

Path C:\Windows\System\yfMpxdA.exe
Size 5.9MB
SHA256 951708229786f02beafd556d9e06134c50201667964fef2dcde72c6761b90edd
MD5 ca34a3ee842386b1fc674e3deefa6e7d
SHA1 4b1e882c35d531def248eb971552577d25df28d2
SHA512 c73554b1b6aa8d2532455660c73b8b0e3367086bcbce4324d49bd7297792126ca9e814b2ac8e7eb7053743c07c72980f828f62cbc84bebd951404e80973c7dac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1072-143-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp

Download

memory/1072-78-0x00007FF76E950000-0x00007FF76ECA4000-memory.dmp

Download

memory/1392-146-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp

Download

memory/1392-82-0x00007FF7E4AC0000-0x00007FF7E4E14000-memory.dmp

Download

memory/1808-52-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp

Download

memory/1808-132-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp

Download

memory/1808-142-0x00007FF752AE0000-0x00007FF752E34000-memory.dmp

Download

memory/1944-151-0x00007FF6C3300000-0x00007FF6C3654000-memory.dmp

Download

memory/1944-124-0x00007FF6C3300000-0x00007FF6C3654000-memory.dmp

Download

memory/2128-83-0x00007FF631920000-0x00007FF631C74000-memory.dmp

Download

memory/2128-145-0x00007FF631920000-0x00007FF631C74000-memory.dmp

Download

memory/2136-29-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp

Download

memory/2136-136-0x00007FF7AE720000-0x00007FF7AEA74000-memory.dmp

Download

memory/2192-123-0x00007FF680400000-0x00007FF680754000-memory.dmp

Download

memory/2192-148-0x00007FF680400000-0x00007FF680754000-memory.dmp

Download

memory/2972-28-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp

Download

memory/2972-137-0x00007FF6C9100000-0x00007FF6C9454000-memory.dmp

Download

memory/3232-141-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp

Download

memory/3232-133-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp

Download

memory/3232-55-0x00007FF669CA0000-0x00007FF669FF4000-memory.dmp

Download

memory/3328-125-0x00007FF6C1340000-0x00007FF6C1694000-memory.dmp

Download

memory/3328-153-0x00007FF6C1340000-0x00007FF6C1694000-memory.dmp

Download

memory/3488-154-0x00007FF67BDA0000-0x00007FF67C0F4000-memory.dmp

Download

memory/3488-127-0x00007FF67BDA0000-0x00007FF67C0F4000-memory.dmp

Download

memory/3640-144-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp

Download

memory/3640-81-0x00007FF78FB30000-0x00007FF78FE84000-memory.dmp

Download

memory/3896-126-0x00007FF7BC5C0000-0x00007FF7BC914000-memory.dmp

Download

memory/3896-152-0x00007FF7BC5C0000-0x00007FF7BC914000-memory.dmp

Download

memory/3984-7-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp

Download

memory/3984-134-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp

Download

memory/3984-129-0x00007FF72FA90000-0x00007FF72FDE4000-memory.dmp

Download

memory/4024-140-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp

Download

memory/4024-50-0x00007FF759D60000-0x00007FF75A0B4000-memory.dmp

Download

memory/4076-36-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp

Download

memory/4076-139-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp

Download

memory/4076-131-0x00007FF6AA390000-0x00007FF6AA6E4000-memory.dmp

Download

memory/4248-138-0x00007FF681CB0000-0x00007FF682004000-memory.dmp

Download

memory/4248-130-0x00007FF681CB0000-0x00007FF682004000-memory.dmp

Download

memory/4248-30-0x00007FF681CB0000-0x00007FF682004000-memory.dmp

Download

memory/4352-24-0x00007FF678EE0000-0x00007FF679234000-memory.dmp

Download

memory/4352-135-0x00007FF678EE0000-0x00007FF679234000-memory.dmp

Download

memory/4432-150-0x00007FF678F00000-0x00007FF679254000-memory.dmp

Download

memory/4432-121-0x00007FF678F00000-0x00007FF679254000-memory.dmp

Download

memory/4648-122-0x00007FF600850000-0x00007FF600BA4000-memory.dmp

Download

memory/4648-149-0x00007FF600850000-0x00007FF600BA4000-memory.dmp

Download

memory/4716-86-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp

Download

memory/4716-147-0x00007FF70C950000-0x00007FF70CCA4000-memory.dmp

Download

memory/5112-1-0x00000136C0400000-0x00000136C0410000-memory.dmp

Download

memory/5112-0-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp

Download

memory/5112-128-0x00007FF669D80000-0x00007FF66A0D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads