cobaltstrike | f1f3082ad00e446e5039c02e2b5807e612570635dab04039c6d19ff4337ac8ce

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240602-am7fjscg23
SHA256 f1f3082ad00e446e5039c02e2b5807e612570635dab04039c6d19ff4337ac8ce
MD5 d6de2fcb5588fab7a986c3eaa91b07e3
SHA1 0477c9d785ac5f2ab1f02b8dd978ced65f20ee43
SHA512 a17a03d99d7314f47aa0d421c0a8d6e64d209c139fbc5a82147ab5e72a170613cc0d81726b1e630f5a0693a172a8a01fb29c8f551112afc40f4fc8f9265fed6f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002342f-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-19.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-27.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-26.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-39.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-15.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023430-61.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-85.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-92.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-122.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-125.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-95.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-75.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-62.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002342f-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-19.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023430-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1228-0-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	UPX
behavioral2/files/0x000800000002342f-5.dat	UPX
behavioral2/memory/2596-6-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	UPX
behavioral2/memory/2744-12-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	UPX
behavioral2/files/0x0007000000023434-19.dat	UPX
behavioral2/memory/1892-21-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	UPX
behavioral2/memory/4968-22-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	UPX
behavioral2/files/0x0007000000023436-27.dat	UPX
behavioral2/files/0x0007000000023435-26.dat	UPX
behavioral2/files/0x0007000000023439-45.dat	UPX
behavioral2/files/0x0007000000023438-42.dat	UPX
behavioral2/memory/3576-50-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp	UPX
behavioral2/files/0x0007000000023437-39.dat	UPX
behavioral2/memory/4216-43-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	UPX
behavioral2/memory/4504-38-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	UPX
behavioral2/memory/4448-35-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	UPX
behavioral2/files/0x0007000000023433-15.dat	UPX
behavioral2/files/0x0008000000023430-61.dat	UPX
behavioral2/files/0x000700000002343c-64.dat	UPX
behavioral2/memory/1228-70-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	UPX
behavioral2/files/0x0007000000023440-85.dat	UPX
behavioral2/files/0x000700000002343e-92.dat	UPX
behavioral2/files/0x000700000002343f-91.dat	UPX
behavioral2/files/0x0007000000023444-116.dat	UPX
behavioral2/files/0x0007000000023445-122.dat	UPX
behavioral2/files/0x0007000000023446-125.dat	UPX
behavioral2/files/0x0007000000023443-111.dat	UPX
behavioral2/files/0x0007000000023442-109.dat	UPX
behavioral2/memory/1892-101-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	UPX
behavioral2/files/0x0007000000023441-95.dat	UPX
behavioral2/memory/432-94-0x00007FF763F10000-0x00007FF764261000-memory.dmp	UPX
behavioral2/memory/2068-93-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	UPX
behavioral2/memory/2744-100-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	UPX
behavioral2/memory/5076-90-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	UPX
behavioral2/memory/2596-89-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	UPX
behavioral2/memory/440-87-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	UPX
behavioral2/memory/896-86-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp	UPX
behavioral2/memory/4888-81-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	UPX
behavioral2/files/0x000700000002343d-75.dat	UPX
behavioral2/memory/3344-71-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-62.dat	UPX
behavioral2/memory/4920-59-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	UPX
behavioral2/memory/4932-127-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp	UPX
behavioral2/memory/1052-129-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp	UPX
behavioral2/memory/2372-131-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp	UPX
behavioral2/memory/628-130-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp	UPX
behavioral2/memory/2448-128-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp	UPX
behavioral2/memory/4448-133-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	UPX
behavioral2/memory/4968-132-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	UPX
behavioral2/memory/1228-134-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	UPX
behavioral2/memory/3344-144-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	UPX
behavioral2/memory/4888-145-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	UPX
behavioral2/memory/2068-147-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	UPX
behavioral2/memory/5076-148-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	UPX
behavioral2/memory/432-150-0x00007FF763F10000-0x00007FF764261000-memory.dmp	UPX
behavioral2/memory/440-149-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	UPX
behavioral2/memory/4920-143-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	UPX
behavioral2/memory/4216-141-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	UPX
behavioral2/memory/4504-140-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	UPX
behavioral2/memory/1228-156-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	UPX
behavioral2/memory/2596-211-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	UPX
behavioral2/memory/2744-213-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	UPX
behavioral2/memory/1892-217-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	UPX
behavioral2/memory/4968-216-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	UPX

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/3576-50-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp	xmrig
behavioral2/memory/1228-70-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	xmrig
behavioral2/memory/1892-101-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	xmrig
behavioral2/memory/2744-100-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	xmrig
behavioral2/memory/2596-89-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	xmrig
behavioral2/memory/896-86-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp	xmrig
behavioral2/memory/4932-127-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp	xmrig
behavioral2/memory/1052-129-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp	xmrig
behavioral2/memory/2372-131-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp	xmrig
behavioral2/memory/628-130-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp	xmrig
behavioral2/memory/2448-128-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp	xmrig
behavioral2/memory/4448-133-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	xmrig
behavioral2/memory/4968-132-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	xmrig
behavioral2/memory/1228-134-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	xmrig
behavioral2/memory/3344-144-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	xmrig
behavioral2/memory/4888-145-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	xmrig
behavioral2/memory/2068-147-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	xmrig
behavioral2/memory/5076-148-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	xmrig
behavioral2/memory/432-150-0x00007FF763F10000-0x00007FF764261000-memory.dmp	xmrig
behavioral2/memory/440-149-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	xmrig
behavioral2/memory/4920-143-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	xmrig
behavioral2/memory/4216-141-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	xmrig
behavioral2/memory/4504-140-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	xmrig
behavioral2/memory/1228-156-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	xmrig
behavioral2/memory/2596-211-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	xmrig
behavioral2/memory/2744-213-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	xmrig
behavioral2/memory/1892-217-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	xmrig
behavioral2/memory/4968-216-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	xmrig
behavioral2/memory/4448-219-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	xmrig
behavioral2/memory/4504-221-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	xmrig
behavioral2/memory/4216-223-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	xmrig
behavioral2/memory/3576-225-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp	xmrig
behavioral2/memory/4920-227-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	xmrig
behavioral2/memory/4888-229-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	xmrig
behavioral2/memory/3344-233-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	xmrig
behavioral2/memory/896-232-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp	xmrig
behavioral2/memory/432-235-0x00007FF763F10000-0x00007FF764261000-memory.dmp	xmrig
behavioral2/memory/440-237-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	xmrig
behavioral2/memory/2068-239-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	xmrig
behavioral2/memory/5076-241-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	xmrig
behavioral2/memory/4932-244-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp	xmrig
behavioral2/memory/2448-245-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp	xmrig
behavioral2/memory/1052-247-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp	xmrig
behavioral2/memory/628-250-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp	xmrig
behavioral2/memory/2372-251-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2596	fwXKmat.exe
2744	IvLYJgD.exe
1892	NaTZkBc.exe
4968	BBqUFBm.exe
4448	ASwuwyc.exe
4504	LxZzKCM.exe
4216	uDHecms.exe
3576	KHfMnXw.exe
4920	wULjXGm.exe
3344	WLzGeUu.exe
4888	rRBxoFa.exe
896	WJOnVEF.exe
5076	bjBFYmY.exe
2068	BrAWsvC.exe
440	SoZCjcG.exe
432	GHtkDEI.exe
4932	hhYsEkd.exe
2448	alpQkrf.exe
1052	KoyXxzi.exe
628	DCiHGUX.exe
2372	QiCbwOg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1228-0-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	upx
behavioral2/files/0x000800000002342f-5.dat	upx
behavioral2/memory/2596-6-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	upx
behavioral2/memory/2744-12-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	upx
behavioral2/files/0x0007000000023434-19.dat	upx
behavioral2/memory/1892-21-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	upx
behavioral2/memory/4968-22-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	upx
behavioral2/files/0x0007000000023436-27.dat	upx
behavioral2/files/0x0007000000023435-26.dat	upx
behavioral2/files/0x0007000000023439-45.dat	upx
behavioral2/files/0x0007000000023438-42.dat	upx
behavioral2/memory/3576-50-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp	upx
behavioral2/files/0x0007000000023437-39.dat	upx
behavioral2/memory/4216-43-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	upx
behavioral2/memory/4504-38-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	upx
behavioral2/memory/4448-35-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	upx
behavioral2/files/0x0007000000023433-15.dat	upx
behavioral2/files/0x0008000000023430-61.dat	upx
behavioral2/files/0x000700000002343c-64.dat	upx
behavioral2/memory/1228-70-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	upx
behavioral2/files/0x0007000000023440-85.dat	upx
behavioral2/files/0x000700000002343e-92.dat	upx
behavioral2/files/0x000700000002343f-91.dat	upx
behavioral2/files/0x0007000000023444-116.dat	upx
behavioral2/files/0x0007000000023445-122.dat	upx
behavioral2/files/0x0007000000023446-125.dat	upx
behavioral2/files/0x0007000000023443-111.dat	upx
behavioral2/files/0x0007000000023442-109.dat	upx
behavioral2/memory/1892-101-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	upx
behavioral2/files/0x0007000000023441-95.dat	upx
behavioral2/memory/432-94-0x00007FF763F10000-0x00007FF764261000-memory.dmp	upx
behavioral2/memory/2068-93-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	upx
behavioral2/memory/2744-100-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	upx
behavioral2/memory/5076-90-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	upx
behavioral2/memory/2596-89-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	upx
behavioral2/memory/440-87-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	upx
behavioral2/memory/896-86-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp	upx
behavioral2/memory/4888-81-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	upx
behavioral2/files/0x000700000002343d-75.dat	upx
behavioral2/memory/3344-71-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	upx
behavioral2/files/0x000700000002343a-62.dat	upx
behavioral2/memory/4920-59-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	upx
behavioral2/memory/4932-127-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp	upx
behavioral2/memory/1052-129-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp	upx
behavioral2/memory/2372-131-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp	upx
behavioral2/memory/628-130-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp	upx
behavioral2/memory/2448-128-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp	upx
behavioral2/memory/4448-133-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp	upx
behavioral2/memory/4968-132-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	upx
behavioral2/memory/1228-134-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	upx
behavioral2/memory/3344-144-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp	upx
behavioral2/memory/4888-145-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp	upx
behavioral2/memory/2068-147-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp	upx
behavioral2/memory/5076-148-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp	upx
behavioral2/memory/432-150-0x00007FF763F10000-0x00007FF764261000-memory.dmp	upx
behavioral2/memory/440-149-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp	upx
behavioral2/memory/4920-143-0x00007FF785B40000-0x00007FF785E91000-memory.dmp	upx
behavioral2/memory/4216-141-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp	upx
behavioral2/memory/4504-140-0x00007FF642960000-0x00007FF642CB1000-memory.dmp	upx
behavioral2/memory/1228-156-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp	upx
behavioral2/memory/2596-211-0x00007FF741570000-0x00007FF7418C1000-memory.dmp	upx
behavioral2/memory/2744-213-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp	upx
behavioral2/memory/1892-217-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp	upx
behavioral2/memory/4968-216-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fwXKmat.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IvLYJgD.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wULjXGm.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rRBxoFa.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DCiHGUX.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NaTZkBc.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LxZzKCM.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WLzGeUu.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WJOnVEF.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BrAWsvC.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bjBFYmY.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KHfMnXw.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KoyXxzi.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\alpQkrf.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QiCbwOg.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BBqUFBm.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ASwuwyc.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uDHecms.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SoZCjcG.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GHtkDEI.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hhYsEkd.exe	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2596	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	83
PID 1228 wrote to memory of 2596	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	83
PID 1228 wrote to memory of 2744	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	84
PID 1228 wrote to memory of 2744	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	84
PID 1228 wrote to memory of 1892	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	85
PID 1228 wrote to memory of 1892	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	85
PID 1228 wrote to memory of 4968	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	86
PID 1228 wrote to memory of 4968	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	86
PID 1228 wrote to memory of 4448	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	87
PID 1228 wrote to memory of 4448	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	87
PID 1228 wrote to memory of 4504	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	88
PID 1228 wrote to memory of 4504	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	88
PID 1228 wrote to memory of 4216	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	89
PID 1228 wrote to memory of 4216	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	89
PID 1228 wrote to memory of 3576	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	90
PID 1228 wrote to memory of 3576	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	90
PID 1228 wrote to memory of 4920	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	92
PID 1228 wrote to memory of 4920	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	92
PID 1228 wrote to memory of 3344	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	94
PID 1228 wrote to memory of 3344	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	94
PID 1228 wrote to memory of 4888	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	95
PID 1228 wrote to memory of 4888	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	95
PID 1228 wrote to memory of 896	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	96
PID 1228 wrote to memory of 896	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	96
PID 1228 wrote to memory of 2068	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	97
PID 1228 wrote to memory of 2068	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	97
PID 1228 wrote to memory of 5076	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	98
PID 1228 wrote to memory of 5076	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	98
PID 1228 wrote to memory of 440	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	99
PID 1228 wrote to memory of 440	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	99
PID 1228 wrote to memory of 432	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	100
PID 1228 wrote to memory of 432	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	100
PID 1228 wrote to memory of 4932	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	101
PID 1228 wrote to memory of 4932	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	101
PID 1228 wrote to memory of 2448	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	102
PID 1228 wrote to memory of 2448	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	102
PID 1228 wrote to memory of 1052	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	103
PID 1228 wrote to memory of 1052	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	103
PID 1228 wrote to memory of 628	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	104
PID 1228 wrote to memory of 628	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	104
PID 1228 wrote to memory of 2372	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	105
PID 1228 wrote to memory of 2372	1228	2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_d6de2fcb5588fab7a986c3eaa91b07e3_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\System\fwXKmat.exe
  C:\Windows\System\fwXKmat.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\IvLYJgD.exe
  C:\Windows\System\IvLYJgD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\NaTZkBc.exe
  C:\Windows\System\NaTZkBc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\BBqUFBm.exe
  C:\Windows\System\BBqUFBm.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\ASwuwyc.exe
  C:\Windows\System\ASwuwyc.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\LxZzKCM.exe
  C:\Windows\System\LxZzKCM.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\uDHecms.exe
  C:\Windows\System\uDHecms.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\KHfMnXw.exe
  C:\Windows\System\KHfMnXw.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\wULjXGm.exe
  C:\Windows\System\wULjXGm.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\WLzGeUu.exe
  C:\Windows\System\WLzGeUu.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\rRBxoFa.exe
  C:\Windows\System\rRBxoFa.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\WJOnVEF.exe
  C:\Windows\System\WJOnVEF.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\BrAWsvC.exe
  C:\Windows\System\BrAWsvC.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\bjBFYmY.exe
  C:\Windows\System\bjBFYmY.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\SoZCjcG.exe
  C:\Windows\System\SoZCjcG.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\GHtkDEI.exe
  C:\Windows\System\GHtkDEI.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\hhYsEkd.exe
  C:\Windows\System\hhYsEkd.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\alpQkrf.exe
  C:\Windows\System\alpQkrf.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\KoyXxzi.exe
  C:\Windows\System\KoyXxzi.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\DCiHGUX.exe
  C:\Windows\System\DCiHGUX.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\QiCbwOg.exe
  C:\Windows\System\QiCbwOg.exe
  2⤵
  - Executes dropped EXE
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ASwuwyc.exe

Path C:\Windows\System\ASwuwyc.exe
Size 5.2MB
SHA256 5ea6cfe144271d01a8cecc2d51de6845fd6a744cf0920d1a8a61c9eea6fc4ad4
MD5 b387be5e7be3d63a3101b74b08230c4d
SHA1 de8135c10bd71072e49301a2e36582c4ed761400
SHA512 40bb8fcc5300c143759f09c0e0fa302f252a73faa52c133b1b8a09c3f4f03f92fb8ba941aad5b52aa109e3d87ac3de152627149c53e4e5e3a12d3e03d8567376
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

BBqUFBm.exe

Path C:\Windows\System\BBqUFBm.exe
Size 5.2MB
SHA256 7b39c59e6b978a1ac8cd02fea53d6064a14a1cd2a6f8764b0d2640cfa7caad9e
MD5 7ba64245c1763fb7d74fcc5a06704322
SHA1 ff58abf16e32810ba373024ed970aa7cd40ee11f
SHA512 6a1dbaa93186d95461c40247b509e0f78061d28aa55b67358b3417652938ebd95c2faec70dbc9cc1ccc9e7f4038e902543703a7aca12162d00829d63c5667b6d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrAWsvC.exe

Path C:\Windows\System\BrAWsvC.exe
Size 5.2MB
SHA256 795f750c4e33c12aeeddda12967b3aa4394cc59d4c4dc48d1bbf197b01fba0ff
MD5 ee906fafa6293cd299b9e5f6d7efe3e2
SHA1 175348ba55840c3e5c8378d319db2a455c1cc896
SHA512 1559ebab87c4201c64b4e549952f29503acd29246432a2567a631687fbe5ad8672423977b070dbcc00c28030509c04205a21c342ccd28bc0497d151e0b9d8dbe
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCiHGUX.exe

Path C:\Windows\System\DCiHGUX.exe
Size 5.2MB
SHA256 411129fa389912d44c4d4559ff53680947638ab375c984eb807610ad4d829c56
MD5 061c4902ad8a3db4448473cb706f23b9
SHA1 c7d9b712d6dc5c6f674329717ad42c716980a640
SHA512 acbd59e8b15be89ddef2a1939a15419cbbd7e77967c64ebc1b96e63f453c9a161e8e1eb2ba7555bad83c88e51300ca381b99911d613161dcf59ed0f6dd5ff906
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHtkDEI.exe

Path C:\Windows\System\GHtkDEI.exe
Size 5.2MB
SHA256 625c10dfdc52c2f5c9384f2749360eccf1c70675e0d8a783b0a8077862d2778c
MD5 1cd02d843144b8edbdb7358de4efc241
SHA1 430d294fcbe95da5d34061c393fada9b67b6cba2
SHA512 5ed148dac68c44eb929bae33c890150466d78e8f616622341bcf1aa9364b2537482e2acb6c59fa8df4e934d6feeefe7d1aa0601083402b7a5b870ccef0eb7c3b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IvLYJgD.exe

Path C:\Windows\System\IvLYJgD.exe
Size 5.2MB
SHA256 9583ab41077ca01c94cfd60f115b1b44412dc298be5f4601eabdeac205b2dbcc
MD5 5a99b12259a4bf9c3b0143d7a5b5cb86
SHA1 eef47a6d8249d2834d546971fa496e18f308d0e7
SHA512 6a17c3a51a87d9e6e8d5dec075fd691fcea4ada9668cee184bd3749f1c6d48a6380def90039e7b9c6ed036f0befd39b558f11eb200bdaa275cfa4c72a39de050
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHfMnXw.exe

Path C:\Windows\System\KHfMnXw.exe
Size 5.2MB
SHA256 fb5a5b3e3b1160ce65e33a24bd51dcbc7fc8c2d70f7368a0ee88b41576c30c1f
MD5 fe1f390990aec3e4ff5d0ea1acb21c7d
SHA1 9bcf60ed7641b4c75893922678549674ddb5e17c
SHA512 e0d5051372fc1c9e86697c44b1c705ce28733b4ce347aee4c118ec82edb05fff2046cc8f020c05e5cc2385f457ad1ef2e5f70443fc37ed3e5cf8d3536e98f764
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

KoyXxzi.exe

Path C:\Windows\System\KoyXxzi.exe
Size 5.2MB
SHA256 607386d8a42e9e41566e072f0d07f181fe3f03eb572b2bf21dd3adf5b0163690
MD5 d62a05e5480f6a3dd4c89e3b1e701df4
SHA1 7ef53da595b60e52113fa071dd55ecb49579d216
SHA512 855e7f766e467c08ef1deecdb068726459ff60f3db70f5b6ed4d8e1c4db939fe599df32b8e44609862e9f827701d53fe8cc3276451ba2120391ca96d1f3ffdb1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

LxZzKCM.exe

Path C:\Windows\System\LxZzKCM.exe
Size 5.2MB
SHA256 c5c8aa03a22d3e38d0da9dca9c7bf9b9e32d87a6afaa0201700fefe0866ef49c
MD5 e26cde125eead3b8b7fb778f9726f4aa
SHA1 a8da3a0444968ebb9fdb3116fc1710cfd6a15ab6
SHA512 b9e72b90defdaaa57275185b299ecbd62e0cae8751a71ba46af40ef5b0f2aadeb49d4bea8c808cba948810345cab85e62848b3a385c0f3b42997f01d648bef03
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NaTZkBc.exe

Path C:\Windows\System\NaTZkBc.exe
Size 5.2MB
SHA256 2fd5ca08873f66997d3b3af4af6c381e0da4aeaec5e9eb908e2fde565dd54328
MD5 2dd8180502d8d38e9c95f0aae28edd02
SHA1 3efd933c2b044598f3a52f539076b63b96ff22cf
SHA512 30785e2c82eeb36a418ecb3dd47fe145ded51dadf516b3acb7b6ad8ee0425bd046a06d5e88e08b7ba570c3329ff7232ce5c2512e65d3b4f63251d21af4dbaf7e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

QiCbwOg.exe

Path C:\Windows\System\QiCbwOg.exe
Size 5.2MB
SHA256 03a8db06fd3661cd9c524d4cf9815340a36da12fb78cbb008779498c188d2a5f
MD5 3087b31152b01c542f4d8c5b513033ed
SHA1 8767acbee73b52ec0baea1f2d34e70b21d739538
SHA512 27ca6591f07c93fa52c9e6a4fd8eb523105c6ac5c36677dc4efa162883e6763b7a458deee39484c6ab083982bc78153041e966122eb08647aac994f350e10a96
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SoZCjcG.exe

Path C:\Windows\System\SoZCjcG.exe
Size 5.2MB
SHA256 cbd3d5652d8cbb0a37698eea9ddeea7af2b21f460d7180020f81e467aa09a595
MD5 bb9bb6378e6528658dd565ecd2a35d0b
SHA1 65e90304e8a7cc74713910b448dd3e6ee6a5966b
SHA512 285ff328619ec76b994abe2055ec8139d6365dfc69a5240648082195aba62b6371b45e09199a08d2fa1f41d3280fad7ee7c2150df14e2564f1b5ad88db81cefb
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

WJOnVEF.exe

Path C:\Windows\System\WJOnVEF.exe
Size 5.2MB
SHA256 dda595e394db9cfe89f8cd97e1e6bbc9ca349c99f20c3a2ffed930bf4df4ffde
MD5 c93876015c3cb385c7b348825ed6aaa4
SHA1 c5ca5d4fbf64575a68fab66333063e117db7f01d
SHA512 07f7e9427de36abb064355d49e363b255d68999634efb3e943e30fbaaf116056c810b49f7064d885319704c9a7f78da32413ae63566188e0e58b7f67938a4024
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

WLzGeUu.exe

Path C:\Windows\System\WLzGeUu.exe
Size 5.2MB
SHA256 af12730833e84df1820869c9b14edcd091b6d6a012e91a6b57e0e6006de06805
MD5 5ee677f4dfbdac28ff3a2dd36847ac70
SHA1 6119025ef22f4862ced9815ca96d00a96dd94f37
SHA512 56dab90c7f96b2db15c18e77b84e3d972649c354a4eab70ecaef6a5db4e5620690341bcf06fd301adf76fb4cad3224e69e60bfffb1aedbb002cb1c462e938a8f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

alpQkrf.exe

Path C:\Windows\System\alpQkrf.exe
Size 5.2MB
SHA256 1af20f5aefa33f5115c457b2a88803442a2aac3fe8476868c630ec9a82ae3aad
MD5 92ce166b9f4c123b7ec517217edf18bc
SHA1 37d6374db9f8f6430fb6d81b431b182f0a5ca880
SHA512 516fdcbd0abe35875e62c70ad7242a84dad6ef1614abd269dbac3e2751e93c263eff790a4c56fd88e7132dcb22ad4206ce832e24eaed653122aeaa4551e004a5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjBFYmY.exe

Path C:\Windows\System\bjBFYmY.exe
Size 5.2MB
SHA256 0c4c8dee660c5c0fe407c9a49b94c44cea4e7e7b65ebcbe6e435bcac98b433d5
MD5 2e746df702c862282bf577f1f83ba227
SHA1 f34ab9deb7209f9352396db79cecee9d54562d0c
SHA512 15b188bdae5fe9876ea7b1bd3168ed42548a0d69b31ba7c00d2ceac5303793d5cc26bae28afaaa01981f52d92c2fa8341072150f0ad3aabe5de2ca9dc57c191f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwXKmat.exe

Path C:\Windows\System\fwXKmat.exe
Size 5.2MB
SHA256 4f6bde8bfa636b93be74f543f09209222bb6bd028895c7e60e5a0976caaa8f37
MD5 d376e898d42adc465bf499acf0f1a16e
SHA1 e4628cff8b42d23cdd112e16df1b734188db101f
SHA512 7134b219eea69db848b9b67ae5058d5c3d306f7637ec39a03cd66e4e89d53e42e348fb32e2db737e102c0e8c868f76a404c7910b45a1fc38c8ea197af43265a4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

hhYsEkd.exe

Path C:\Windows\System\hhYsEkd.exe
Size 5.2MB
SHA256 e0001b18e5f218ae3295b7fd79f00af41cdfda306b6b38a20c19270ac25941e9
MD5 9ab9aea0a228e5cb9adc69f1b704bd3b
SHA1 b76aef63ac011ef20277cc168118a5ee21c8c528
SHA512 ebbf098a98118b2f4035b772f37937fc38691b520c1cd1010af59873806d52faecc239c4b939a81a7dd6f00242fb8be4c0c7fabaad7d8a0dcf11a306b05fdcb6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

rRBxoFa.exe

Path C:\Windows\System\rRBxoFa.exe
Size 5.2MB
SHA256 c9219b6f0d155ef0395b9af112566cdc51cafa1df49f26fc457d3ad5dd306695
MD5 a89e1019144452b360ceb0d0c6496e5a
SHA1 9ec4e29bd144f8025ebd70bd8d34c8da0cda8b04
SHA512 3200f2762165e321f838c0a4b5cff0ebbef39f440ef2780cb26454b9f8d5fa8fd1e671f6b16686c1217947fd8bdb67dbbc5159a1c4b2343e9f80cd7a31d2dd69
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

uDHecms.exe

Path C:\Windows\System\uDHecms.exe
Size 5.2MB
SHA256 57c92b7e3d3767bbedab5cc5503e3d2102e182bd59413e92016875821f5d7d96
MD5 cf9e692f2ccabcedbce1d118e126894f
SHA1 1bb777ad7b4d349f9eee508f48330b18496cfcba
SHA512 508a5d7f24c0d3429cb57f5900ed09bbc514616e6e28fdeccd496ba6f0ca2779d7bfe56c454edcd9ef29a2c1208578d54af52ebbdd66ea65f441319e082114b5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wULjXGm.exe

Path C:\Windows\System\wULjXGm.exe
Size 5.2MB
SHA256 8b1253f2f88d805d86d3205eeec4d9b26ab002226e7803ba50b8f7ee38598f66
MD5 00df306c847a0684b05d8dafbccd8de7
SHA1 8baa7fe4a2d7c1adf584a1279308d70a77950e68
SHA512 a34ba2eea95e674341e9d1c48ab5e74f1ea7c90e5ba1cf51a71536427a8607e0bb57b119f7aedd57397082f9e6f85ea9f55a32735f503042ac2e20a6755dcc32
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-150-0x00007FF763F10000-0x00007FF764261000-memory.dmp

Download

memory/432-235-0x00007FF763F10000-0x00007FF764261000-memory.dmp

Download

memory/432-94-0x00007FF763F10000-0x00007FF764261000-memory.dmp

Download

memory/440-149-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp

Download

memory/440-87-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp

Download

memory/440-237-0x00007FF7219C0000-0x00007FF721D11000-memory.dmp

Download

memory/628-250-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp

Download

memory/628-130-0x00007FF7A3C60000-0x00007FF7A3FB1000-memory.dmp

Download

memory/896-232-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp

Download

memory/896-86-0x00007FF7D67B0000-0x00007FF7D6B01000-memory.dmp

Download

memory/1052-129-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp

Download

memory/1052-247-0x00007FF7F32F0000-0x00007FF7F3641000-memory.dmp

Download

memory/1228-156-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp

Download

memory/1228-0-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp

Download

memory/1228-134-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp

Download

memory/1228-70-0x00007FF6B2070000-0x00007FF6B23C1000-memory.dmp

Download

memory/1228-1-0x000002283B0D0000-0x000002283B0E0000-memory.dmp

Download

memory/1892-101-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp

Download

memory/1892-21-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp

Download

memory/1892-217-0x00007FF6A1BC0000-0x00007FF6A1F11000-memory.dmp

Download

memory/2068-147-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp

Download

memory/2068-93-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp

Download

memory/2068-239-0x00007FF6F8120000-0x00007FF6F8471000-memory.dmp

Download

memory/2372-131-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp

Download

memory/2372-251-0x00007FF6AE1C0000-0x00007FF6AE511000-memory.dmp

Download

memory/2448-128-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp

Download

memory/2448-245-0x00007FF7B7140000-0x00007FF7B7491000-memory.dmp

Download

memory/2596-89-0x00007FF741570000-0x00007FF7418C1000-memory.dmp

Download

memory/2596-211-0x00007FF741570000-0x00007FF7418C1000-memory.dmp

Download

memory/2596-6-0x00007FF741570000-0x00007FF7418C1000-memory.dmp

Download

memory/2744-12-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp

Download

memory/2744-213-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp

Download

memory/2744-100-0x00007FF6AF1E0000-0x00007FF6AF531000-memory.dmp

Download

memory/3344-144-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp

Download

memory/3344-71-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp

Download

memory/3344-233-0x00007FF6A9350000-0x00007FF6A96A1000-memory.dmp

Download

memory/3576-50-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp

Download

memory/3576-225-0x00007FF7A33F0000-0x00007FF7A3741000-memory.dmp

Download

memory/4216-223-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp

Download

memory/4216-43-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp

Download

memory/4216-141-0x00007FF669CD0000-0x00007FF66A021000-memory.dmp

Download

memory/4448-133-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp

Download

memory/4448-219-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp

Download

memory/4448-35-0x00007FF6BD0C0000-0x00007FF6BD411000-memory.dmp

Download

memory/4504-140-0x00007FF642960000-0x00007FF642CB1000-memory.dmp

Download

memory/4504-221-0x00007FF642960000-0x00007FF642CB1000-memory.dmp

Download

memory/4504-38-0x00007FF642960000-0x00007FF642CB1000-memory.dmp

Download

memory/4888-229-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp

Download

memory/4888-81-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp

Download

memory/4888-145-0x00007FF6E7160000-0x00007FF6E74B1000-memory.dmp

Download

memory/4920-227-0x00007FF785B40000-0x00007FF785E91000-memory.dmp

Download

memory/4920-59-0x00007FF785B40000-0x00007FF785E91000-memory.dmp

Download

memory/4920-143-0x00007FF785B40000-0x00007FF785E91000-memory.dmp

Download

memory/4932-127-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp

Download

memory/4932-244-0x00007FF6B2B30000-0x00007FF6B2E81000-memory.dmp

Download

memory/4968-132-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp

Download

memory/4968-22-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp

Download

memory/4968-216-0x00007FF7C5F70000-0x00007FF7C62C1000-memory.dmp

Download

memory/5076-241-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp

Download

memory/5076-90-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp

Download

memory/5076-148-0x00007FF6316B0000-0x00007FF631A01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads