cobaltstrike | 8a81d165f97979b47889782c3eea5f664b70075e25f0a3fb844f7b1ebec1a9d0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240602-eq6qmsae41
SHA256 8a81d165f97979b47889782c3eea5f664b70075e25f0a3fb844f7b1ebec1a9d0
MD5 fdd9ac38292802808eff84336ec309d4
SHA1 6c3b3a709e4e98dd2e4d56d57c74a4803cf65262
SHA512 9c0c6873ba36fbada8ad369ac6a1405d6bcad54c16ecd03c7a29b8be554caf7f9eb789a3bcd08b5a719e4b9fb48caa1baa899b5e4953a2435fca7a670d1abe33
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000b0000000233c3-5.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023400-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-69.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023401-64.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-57.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002335d-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-79.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023364-95.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023361-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-104.dat	cobalt_reflective_dll
behavioral2/files/0x000d000000023360-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-127.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-123.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000233c3-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023400-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023401-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002335d-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023364-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023361-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d000000023360-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2540-0-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	UPX
behavioral2/files/0x000b0000000233c3-5.dat	UPX
behavioral2/memory/3692-6-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	UPX
behavioral2/files/0x0008000000023400-10.dat	UPX
behavioral2/files/0x0007000000023405-11.dat	UPX
behavioral2/files/0x0007000000023406-23.dat	UPX
behavioral2/memory/1820-22-0x00007FF799840000-0x00007FF799B91000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-30.dat	UPX
behavioral2/files/0x0007000000023408-36.dat	UPX
behavioral2/memory/4540-34-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	UPX
behavioral2/memory/2596-28-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	UPX
behavioral2/memory/2328-14-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	UPX
behavioral2/memory/3348-43-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	UPX
behavioral2/memory/4904-47-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	UPX
behavioral2/memory/4872-55-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	UPX
behavioral2/memory/4824-65-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	UPX
behavioral2/memory/3692-72-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-74.dat	UPX
behavioral2/memory/3724-71-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	UPX
behavioral2/files/0x000700000002340b-69.dat	UPX
behavioral2/files/0x0008000000023401-64.dat	UPX
behavioral2/memory/2540-62-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-57.dat	UPX
behavioral2/memory/1868-48-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	UPX
behavioral2/files/0x000b00000002335d-46.dat	UPX
behavioral2/files/0x0007000000023409-41.dat	UPX
behavioral2/memory/1084-78-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-79.dat	UPX
behavioral2/memory/2296-89-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	UPX
behavioral2/files/0x0009000000023364-95.dat	UPX
behavioral2/memory/4828-94-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	UPX
behavioral2/files/0x0009000000023361-102.dat	UPX
behavioral2/files/0x000700000002340e-104.dat	UPX
behavioral2/memory/4908-100-0x00007FF775130000-0x00007FF775481000-memory.dmp	UPX
behavioral2/memory/1604-88-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp	UPX
behavioral2/files/0x000d000000023360-84.dat	UPX
behavioral2/files/0x000700000002340f-109.dat	UPX
behavioral2/memory/4572-113-0x00007FF7325E0000-0x00007FF732931000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-116.dat	UPX
behavioral2/memory/1868-118-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-127.dat	UPX
behavioral2/files/0x0007000000023412-123.dat	UPX
behavioral2/memory/1192-132-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp	UPX
behavioral2/memory/2188-131-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp	UPX
behavioral2/memory/4824-130-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	UPX
behavioral2/memory/4872-129-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	UPX
behavioral2/memory/4372-121-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp	UPX
behavioral2/memory/2528-108-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp	UPX
behavioral2/memory/2540-133-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	UPX
behavioral2/memory/3724-146-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	UPX
behavioral2/memory/4828-150-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	UPX
behavioral2/memory/4908-149-0x00007FF775130000-0x00007FF775481000-memory.dmp	UPX
behavioral2/memory/2296-148-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	UPX
behavioral2/memory/2540-156-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	UPX
behavioral2/memory/3692-201-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	UPX
behavioral2/memory/2328-203-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	UPX
behavioral2/memory/1820-205-0x00007FF799840000-0x00007FF799B91000-memory.dmp	UPX
behavioral2/memory/2596-207-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	UPX
behavioral2/memory/4540-209-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	UPX
behavioral2/memory/3348-211-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	UPX
behavioral2/memory/4904-213-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	UPX
behavioral2/memory/1868-222-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	UPX
behavioral2/memory/4824-226-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	UPX
behavioral2/memory/4872-224-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/1820-22-0x00007FF799840000-0x00007FF799B91000-memory.dmp	xmrig
behavioral2/memory/4540-34-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	xmrig
behavioral2/memory/2596-28-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	xmrig
behavioral2/memory/2328-14-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	xmrig
behavioral2/memory/3348-43-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	xmrig
behavioral2/memory/4904-47-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	xmrig
behavioral2/memory/3692-72-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	xmrig
behavioral2/memory/2540-62-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	xmrig
behavioral2/memory/1084-78-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp	xmrig
behavioral2/memory/2296-89-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	xmrig
behavioral2/memory/1604-88-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp	xmrig
behavioral2/memory/4572-113-0x00007FF7325E0000-0x00007FF732931000-memory.dmp	xmrig
behavioral2/memory/1868-118-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	xmrig
behavioral2/memory/1192-132-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp	xmrig
behavioral2/memory/2188-131-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp	xmrig
behavioral2/memory/4824-130-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	xmrig
behavioral2/memory/4872-129-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	xmrig
behavioral2/memory/4372-121-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp	xmrig
behavioral2/memory/2528-108-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp	xmrig
behavioral2/memory/2540-133-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	xmrig
behavioral2/memory/3724-146-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	xmrig
behavioral2/memory/4828-150-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	xmrig
behavioral2/memory/4908-149-0x00007FF775130000-0x00007FF775481000-memory.dmp	xmrig
behavioral2/memory/2296-148-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	xmrig
behavioral2/memory/2540-156-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	xmrig
behavioral2/memory/3692-201-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	xmrig
behavioral2/memory/2328-203-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	xmrig
behavioral2/memory/1820-205-0x00007FF799840000-0x00007FF799B91000-memory.dmp	xmrig
behavioral2/memory/2596-207-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	xmrig
behavioral2/memory/4540-209-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	xmrig
behavioral2/memory/3348-211-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	xmrig
behavioral2/memory/4904-213-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	xmrig
behavioral2/memory/1868-222-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	xmrig
behavioral2/memory/4824-226-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	xmrig
behavioral2/memory/4872-224-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	xmrig
behavioral2/memory/3724-228-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	xmrig
behavioral2/memory/1084-230-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp	xmrig
behavioral2/memory/1604-232-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp	xmrig
behavioral2/memory/2296-234-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	xmrig
behavioral2/memory/4828-236-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	xmrig
behavioral2/memory/4908-240-0x00007FF775130000-0x00007FF775481000-memory.dmp	xmrig
behavioral2/memory/2528-239-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp	xmrig
behavioral2/memory/4572-245-0x00007FF7325E0000-0x00007FF732931000-memory.dmp	xmrig
behavioral2/memory/4372-247-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp	xmrig
behavioral2/memory/2188-249-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp	xmrig
behavioral2/memory/1192-251-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3692	suagqdQ.exe
2328	jsmiDxY.exe
1820	yJfVQhx.exe
2596	UuIrYBD.exe
4540	SdOVsiC.exe
3348	qviTCHl.exe
4904	MBHYTxt.exe
1868	inghniK.exe
4872	pSkTzsi.exe
4824	McDurVr.exe
3724	eFpnpNb.exe
1084	QunHzQX.exe
1604	UrcSPlt.exe
2296	RRgaGrC.exe
4908	LPNQSqV.exe
4828	NcpTQEe.exe
2528	QwugAuC.exe
4572	nFBIffC.exe
4372	HNRQFqv.exe
2188	SdBfrRu.exe
1192	OQaTpxa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2540-0-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	upx
behavioral2/files/0x000b0000000233c3-5.dat	upx
behavioral2/memory/3692-6-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	upx
behavioral2/files/0x0008000000023400-10.dat	upx
behavioral2/files/0x0007000000023405-11.dat	upx
behavioral2/files/0x0007000000023406-23.dat	upx
behavioral2/memory/1820-22-0x00007FF799840000-0x00007FF799B91000-memory.dmp	upx
behavioral2/files/0x0007000000023407-30.dat	upx
behavioral2/files/0x0007000000023408-36.dat	upx
behavioral2/memory/4540-34-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	upx
behavioral2/memory/2596-28-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	upx
behavioral2/memory/2328-14-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	upx
behavioral2/memory/3348-43-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	upx
behavioral2/memory/4904-47-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	upx
behavioral2/memory/4872-55-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	upx
behavioral2/memory/4824-65-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	upx
behavioral2/memory/3692-72-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	upx
behavioral2/files/0x000700000002340c-74.dat	upx
behavioral2/memory/3724-71-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	upx
behavioral2/files/0x000700000002340b-69.dat	upx
behavioral2/files/0x0008000000023401-64.dat	upx
behavioral2/memory/2540-62-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	upx
behavioral2/files/0x000700000002340a-57.dat	upx
behavioral2/memory/1868-48-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	upx
behavioral2/files/0x000b00000002335d-46.dat	upx
behavioral2/files/0x0007000000023409-41.dat	upx
behavioral2/memory/1084-78-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp	upx
behavioral2/files/0x000700000002340d-79.dat	upx
behavioral2/memory/2296-89-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	upx
behavioral2/files/0x0009000000023364-95.dat	upx
behavioral2/memory/4828-94-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	upx
behavioral2/files/0x0009000000023361-102.dat	upx
behavioral2/files/0x000700000002340e-104.dat	upx
behavioral2/memory/4908-100-0x00007FF775130000-0x00007FF775481000-memory.dmp	upx
behavioral2/memory/1604-88-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp	upx
behavioral2/files/0x000d000000023360-84.dat	upx
behavioral2/files/0x000700000002340f-109.dat	upx
behavioral2/memory/4572-113-0x00007FF7325E0000-0x00007FF732931000-memory.dmp	upx
behavioral2/files/0x0007000000023410-116.dat	upx
behavioral2/memory/1868-118-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	upx
behavioral2/files/0x0007000000023413-127.dat	upx
behavioral2/files/0x0007000000023412-123.dat	upx
behavioral2/memory/1192-132-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp	upx
behavioral2/memory/2188-131-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp	upx
behavioral2/memory/4824-130-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	upx
behavioral2/memory/4872-129-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	upx
behavioral2/memory/4372-121-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp	upx
behavioral2/memory/2528-108-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp	upx
behavioral2/memory/2540-133-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	upx
behavioral2/memory/3724-146-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp	upx
behavioral2/memory/4828-150-0x00007FF732580000-0x00007FF7328D1000-memory.dmp	upx
behavioral2/memory/4908-149-0x00007FF775130000-0x00007FF775481000-memory.dmp	upx
behavioral2/memory/2296-148-0x00007FF72A310000-0x00007FF72A661000-memory.dmp	upx
behavioral2/memory/2540-156-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp	upx
behavioral2/memory/3692-201-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp	upx
behavioral2/memory/2328-203-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp	upx
behavioral2/memory/1820-205-0x00007FF799840000-0x00007FF799B91000-memory.dmp	upx
behavioral2/memory/2596-207-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp	upx
behavioral2/memory/4540-209-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp	upx
behavioral2/memory/3348-211-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp	upx
behavioral2/memory/4904-213-0x00007FF71F020000-0x00007FF71F371000-memory.dmp	upx
behavioral2/memory/1868-222-0x00007FF717FC0000-0x00007FF718311000-memory.dmp	upx
behavioral2/memory/4824-226-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp	upx
behavioral2/memory/4872-224-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qviTCHl.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nFBIffC.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HNRQFqv.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SdBfrRu.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MBHYTxt.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pSkTzsi.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eFpnpNb.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UrcSPlt.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QwugAuC.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LPNQSqV.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\suagqdQ.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yJfVQhx.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UuIrYBD.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\inghniK.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RRgaGrC.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OQaTpxa.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jsmiDxY.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SdOVsiC.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\McDurVr.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QunHzQX.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NcpTQEe.exe	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3692	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	83
PID 2540 wrote to memory of 3692	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	83
PID 2540 wrote to memory of 2328	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	84
PID 2540 wrote to memory of 2328	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	84
PID 2540 wrote to memory of 1820	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	85
PID 2540 wrote to memory of 1820	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	85
PID 2540 wrote to memory of 2596	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	87
PID 2540 wrote to memory of 2596	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	87
PID 2540 wrote to memory of 4540	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	88
PID 2540 wrote to memory of 4540	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	88
PID 2540 wrote to memory of 3348	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	89
PID 2540 wrote to memory of 3348	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	89
PID 2540 wrote to memory of 4904	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	90
PID 2540 wrote to memory of 4904	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	90
PID 2540 wrote to memory of 1868	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	92
PID 2540 wrote to memory of 1868	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	92
PID 2540 wrote to memory of 4872	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	93
PID 2540 wrote to memory of 4872	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	93
PID 2540 wrote to memory of 4824	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	94
PID 2540 wrote to memory of 4824	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	94
PID 2540 wrote to memory of 3724	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	95
PID 2540 wrote to memory of 3724	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	95
PID 2540 wrote to memory of 1084	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	96
PID 2540 wrote to memory of 1084	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	96
PID 2540 wrote to memory of 1604	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	97
PID 2540 wrote to memory of 1604	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	97
PID 2540 wrote to memory of 2296	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	98
PID 2540 wrote to memory of 2296	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	98
PID 2540 wrote to memory of 4908	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	99
PID 2540 wrote to memory of 4908	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	99
PID 2540 wrote to memory of 4828	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	100
PID 2540 wrote to memory of 4828	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	100
PID 2540 wrote to memory of 2528	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	101
PID 2540 wrote to memory of 2528	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	101
PID 2540 wrote to memory of 4572	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	102
PID 2540 wrote to memory of 4572	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	102
PID 2540 wrote to memory of 4372	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	103
PID 2540 wrote to memory of 4372	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	103
PID 2540 wrote to memory of 2188	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	104
PID 2540 wrote to memory of 2188	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	104
PID 2540 wrote to memory of 1192	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	105
PID 2540 wrote to memory of 1192	2540	2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_fdd9ac38292802808eff84336ec309d4_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System\suagqdQ.exe
  C:\Windows\System\suagqdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\jsmiDxY.exe
  C:\Windows\System\jsmiDxY.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\yJfVQhx.exe
  C:\Windows\System\yJfVQhx.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\UuIrYBD.exe
  C:\Windows\System\UuIrYBD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\SdOVsiC.exe
  C:\Windows\System\SdOVsiC.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\qviTCHl.exe
  C:\Windows\System\qviTCHl.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\MBHYTxt.exe
  C:\Windows\System\MBHYTxt.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\inghniK.exe
  C:\Windows\System\inghniK.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\pSkTzsi.exe
  C:\Windows\System\pSkTzsi.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\McDurVr.exe
  C:\Windows\System\McDurVr.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\eFpnpNb.exe
  C:\Windows\System\eFpnpNb.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\QunHzQX.exe
  C:\Windows\System\QunHzQX.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\UrcSPlt.exe
  C:\Windows\System\UrcSPlt.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\RRgaGrC.exe
  C:\Windows\System\RRgaGrC.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\LPNQSqV.exe
  C:\Windows\System\LPNQSqV.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\NcpTQEe.exe
  C:\Windows\System\NcpTQEe.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\QwugAuC.exe
  C:\Windows\System\QwugAuC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\nFBIffC.exe
  C:\Windows\System\nFBIffC.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\HNRQFqv.exe
  C:\Windows\System\HNRQFqv.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\SdBfrRu.exe
  C:\Windows\System\SdBfrRu.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\OQaTpxa.exe
  C:\Windows\System\OQaTpxa.exe
  2⤵
  - Executes dropped EXE
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

HNRQFqv.exe

Path C:\Windows\System\HNRQFqv.exe
Size 5.2MB
SHA256 1556f72ad28f6bd10606978a020319f5a2af352e7a2b7623cd42c631c6d2dde7
MD5 778468212055d977f34bbfa50f88fdf6
SHA1 4e97705059a226d4c12bf7d44ce0dd4ff4a9c6d4
SHA512 8f382295313255c39b358ef8435627d1c6ba15bfb2e11b179686e9b6809a0e9ca5af03b3649341a7c0e91bc0b14ea9d9f3cf5ffef5b2f55ed8eb18127e271f87
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LPNQSqV.exe

Path C:\Windows\System\LPNQSqV.exe
Size 5.2MB
SHA256 90e8eefddc179ad4b934db79ddf23455b8c9d950f6019a5e8fa860ef6c0df758
MD5 75aa75bb27b8e59fb6669a20dea11bf6
SHA1 a2f4433c223dceea5bc5e6d92bfcc14aabb0c2f6
SHA512 0bd4ddc004af9dc4da0ea1e56c637074ef2516c4ce78a9bd4c9c4d6a9b7510138b7b26dd1c127eae0fcd6a63cdc428cf514babaa6aec592b0719bdef7f5e2e27
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MBHYTxt.exe

Path C:\Windows\System\MBHYTxt.exe
Size 5.2MB
SHA256 12f8d05af551f6e200a71b1bf6a6070f2f6172cb7ee6ddb4b4a30bd55164416b
MD5 2f6d1afe19424b6a10020068380bd1dd
SHA1 6b9a628bfeee904635734ac4bfa8aed6ae86eb3a
SHA512 d562a5e5c91b5a77126dc19146a98cba03156acdf6b0d04d7b052d93d268a288fb200ee4c174d3b4024085feda6c0f5d61503d15639ae5fda99371f03dd59a42
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

McDurVr.exe

Path C:\Windows\System\McDurVr.exe
Size 5.2MB
SHA256 0453b3be93fa5d73d86345430535c98b1ccbd2872ea7aedef53c0a97321869b6
MD5 7025b679936dfa818ef7482c6632d228
SHA1 d8f4ea6d77a12e01ef21629e6d3a123c7178a005
SHA512 4db7f690a6553bff7d4434ac7330306cc0bc89e1b94f61b8b418e0c933f752628ede3c7a06d2ae8a1ab02bdb5595d9d13528e90753eceb94c4162643d300c29a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

NcpTQEe.exe

Path C:\Windows\System\NcpTQEe.exe
Size 5.2MB
SHA256 c1e4018ec8e1d08f44feef538de3438f835c21af382811878584db61b4f87ba7
MD5 11f80678f4b68c66ad3d80c60e7e923e
SHA1 2d034446bd881ae9a4aa330b82a6d00a72f6408a
SHA512 15195520e82b7b76deaad5fac2ad4979ff6e8604e89a28bdd97a4de03693e4177376c5225688c98e837b7ff04a76a927b35ffed50e677e6e851266ad31458aa1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQaTpxa.exe

Path C:\Windows\System\OQaTpxa.exe
Size 5.2MB
SHA256 e33dd4cfd5a61f52f113a2557681ab868319575b5bbe5adfccf032c4f5f703a8
MD5 8d15c450e638a17796429b3ad9e5e471
SHA1 35f50f06f947002557072185cc6689106909eed5
SHA512 326cc7bbbd5936cb9b4eae634fc475cea6ce5e192faef324b42ca0d2d882c6a43af0b58aeef6bcd42eb7de73fff484c8f0236719ca2211483aff7a6418af3191
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

QunHzQX.exe

Path C:\Windows\System\QunHzQX.exe
Size 5.2MB
SHA256 5143095c965b834ef4b244f717cb5d8eafb19096c97b18efa017f560b06e12ad
MD5 e35622fec3a74edd4a487cf5c48e646d
SHA1 6e2467f836956c9adfac126102b09d23a27b0a18
SHA512 d9573016f5701c90d5e0aedec423a8e36f3bb4072a76eff64b10658a7302ffc78db544b33fc5469d46fc226d2fea3ec0fb5b92e7881a17db436ae0082ddaaf81
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwugAuC.exe

Path C:\Windows\System\QwugAuC.exe
Size 5.2MB
SHA256 2fe0b189b772b8f45f78cb5b01422ad407e7ae9ef0969fdb106f49113b363623
MD5 3eb0145c88efab9d2506a6ff9e00c060
SHA1 712aa79d9cc5e65be910a67160104b35a91a85e1
SHA512 87c6eba8ed52efb3b5c3839559ca9c1817bfbecca80bb164da9265291da91f761270421e6552803e285d9d669505b548008e2be1eecfd7083c42805b572a4063
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

RRgaGrC.exe

Path C:\Windows\System\RRgaGrC.exe
Size 5.2MB
SHA256 02f84b301bf305bbc07aae1a673a23c60607749eeb6532f0327dd5ac29abc4e6
MD5 b8b37d281cbc42134e04c9e1405dbe5b
SHA1 491315a618f59a750868aaf27ef30c5a191fb4b9
SHA512 3e1a00177a97bf0c1c82e5d4c29c95b6f024b92fa9a9067e1cd324daed831074f51e9be43159080f968531044cdd3ef0a763cd4eb06d483f4fe8bc309848d592
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SdBfrRu.exe

Path C:\Windows\System\SdBfrRu.exe
Size 5.2MB
SHA256 f500d6ed8069a13a35cefbbfc7376518e6a2e6f3044cf3582033ba90e18607a6
MD5 5b907189d85fa3d6fde7cddb3b3066e9
SHA1 9fb57e4996894f75b5ffff86165f2b495d595b63
SHA512 e21e1651f9ffbeb95cdd62b4dd219bd8ca3f229b929c0b5540a424a20ee00b08e79d85db91df66d235e564f372ab64993c123277b5b7e979517aedee7b99153b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SdOVsiC.exe

Path C:\Windows\System\SdOVsiC.exe
Size 5.2MB
SHA256 8f5550ecc294364898a567de986eb6b5f5697cb4cf8c4dd3bc749dbb7c0115cc
MD5 737111e90715ac63bca821eb89c38f57
SHA1 f2a6430e89e3626760f47320172eb3fc687a8a09
SHA512 7475bc056ff740e750aa1ef91eb6b0651d02cf37f9adbf5b9f0841dd324f5d629e564ed85b270f9bc173e4bb84a87a03a504a9463cfb0029ab4680fdb37c5018
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UrcSPlt.exe

Path C:\Windows\System\UrcSPlt.exe
Size 5.2MB
SHA256 e4b04b909c0f036a4096dacf8c48324b8f6d17c06e003ac8c1cd80aeab108fa6
MD5 fe42cdb47016f53632349ea15a058e00
SHA1 bf6ba7c07e8afec9274c6b59313acc42b2bf4222
SHA512 769d7816b8bab83e3b7088dbef7da835085b123e58813eee7f8a4025ad8b9e74e1b24c87a0715071749f247c2717694c9c6b20d9143623ace02096a26e3bd738
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

UuIrYBD.exe

Path C:\Windows\System\UuIrYBD.exe
Size 5.2MB
SHA256 1f7fbc84895d383895f68455c8119c4c11cdbf4f0d17472af71f9ed14f23d1da
MD5 b3f4be9c3cbdf6eb1719a073b21f2074
SHA1 6aaf138e98b5c133071dbac6fc969f2df4b7fbcd
SHA512 d1a28ac0607aa0e35116dcee3544a06bd824534e253cf6d44a39e086c2b6374348fdf335a4528a112d81982e2f272ce971b138a71bf45ec69d52cf9bdcd42509
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

eFpnpNb.exe

Path C:\Windows\System\eFpnpNb.exe
Size 5.2MB
SHA256 43b8a403773415d4f8ac16c6233be9a17d060a037c041f000d06abaf0509aade
MD5 1dd09a0337ccdfdcd211f0c49bc6389a
SHA1 9315f489be2e4066ea87c60e03636d224216accd
SHA512 9ccbb9d49692ebc5b0248781739f18be91efb665947f8149828f4036f9a3e41fb7f92fe291241ed71411904cd45808ff0fd575f9e9f68bf25b23dce8adc1f059
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

inghniK.exe

Path C:\Windows\System\inghniK.exe
Size 5.2MB
SHA256 5a239633b7e3b82fc9bc0ec2b1c63b219c3228808ac2e78c9a644d299b4ccd82
MD5 6de8b6f277cec6459b11608048f91b76
SHA1 97a943e713eb6ef7a13212659fb6b9904bbcb49e
SHA512 03b2ad0802eaf0486a2322403bf70b0535270bcff366361c8d561cf49858383a3f8513362869b6163b8d007a8eb14811b95a81a73cba3a0f8f184129779dd0a1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsmiDxY.exe

Path C:\Windows\System\jsmiDxY.exe
Size 5.2MB
SHA256 6e03a439e86c5c9ec5aac5f3af2cdd04fdeb3aa5541bf8e8885c5a23ceba9eea
MD5 29d409937958498ffcfac704c615637a
SHA1 a267e8200577be7ff593a6c6488c6d2e209dd197
SHA512 5b5beebca640b2e5ec379288e61dc0969245aa928bac3b3eacae91c060dc5bc2dd6a4292742f7d9d36f4ea9c447240dab5de057ab5530cb04354a311138a0bea
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

nFBIffC.exe

Path C:\Windows\System\nFBIffC.exe
Size 5.2MB
SHA256 b0490583751f9020c74666487b3a78908fe1c316092e397891e52ad71fd2885c
MD5 01975f9979e792525e0917bd71e40db3
SHA1 d328ce0515d8ac10051a0ba04fceaf5f3178586e
SHA512 1bca3cc10952268cfa2fed1ad095b4bf9a06c471054b1b72c662f6d7d168012590de9b881f58c2cef00d74f8d7340d53348827c5f6474b1828fa47d63730b73b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pSkTzsi.exe

Path C:\Windows\System\pSkTzsi.exe
Size 5.2MB
SHA256 da31da38c6829f772a3dc3c56b345f93f5aef2ef06723a3538bccfb09c3f8f9a
MD5 cf36642d2ef67127b789a00c47ff6a84
SHA1 07a6a9347ed17dfb5dff2618b5a03105a618f074
SHA512 eb527edba581cfc1b15f18292f10d03452803839d98b62948136830fc06c06ddb288af753852283e5995a614cb4ca8ba223ab4baee51290c223f2f7f04593522
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qviTCHl.exe

Path C:\Windows\System\qviTCHl.exe
Size 5.2MB
SHA256 550bc35d9fe39b921cde9523c57ed7463dc17d0b9497b2c4ebbfe335563e8dd2
MD5 dc12b353f8c53bc72d44df99ecd677ab
SHA1 2c6b32886386a83dc9921f0bb27281570908f6e9
SHA512 a2263bfc1530791af7e89bc5f734310bd4908d84f14344099b86c28b80c949e58eb93335ff975aaf2652ea2b6d4bc0ba71e52dab5d4e7781a0e92d873b2dc3c2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

suagqdQ.exe

Path C:\Windows\System\suagqdQ.exe
Size 5.2MB
SHA256 d74e27f4379a841d3ef288fdd5ad7bd000cab5ede0df60da239a06605274c777
MD5 7c51b26b6b0638c4bd74c494c1b4a54d
SHA1 3337069286e65dc1452e8cfe2d070e84e241cc3b
SHA512 acf97d4e1020be59b6d33f9d164d51740cb506a18965242953d60df4a931d1a90ad46a1b519a02992013137dab7c264893143f8de31a6712da8a45755eb4f061
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

yJfVQhx.exe

Path C:\Windows\System\yJfVQhx.exe
Size 5.2MB
SHA256 a0ad565f21d50745911997cd30eb9b54d379bfd880d0d1842cdb969a9b7dee34
MD5 b25d21733ad00582110f961ff4644a95
SHA1 2bde8fe502162d6a00bec379e38626b5e9a54e57
SHA512 48f82ef34585751b3fc77a8074ccb4b2e897233e78c8266e5acb0b01abc52789938faa367b8370192c28dce080cfd33ea55e955560d670f240f6ced3e90e6006
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1084-78-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp

Download

memory/1084-230-0x00007FF6328B0000-0x00007FF632C01000-memory.dmp

Download

memory/1192-251-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp

Download

memory/1192-132-0x00007FF779AA0000-0x00007FF779DF1000-memory.dmp

Download

memory/1604-88-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp

Download

memory/1604-232-0x00007FF7E19A0000-0x00007FF7E1CF1000-memory.dmp

Download

memory/1820-205-0x00007FF799840000-0x00007FF799B91000-memory.dmp

Download

memory/1820-22-0x00007FF799840000-0x00007FF799B91000-memory.dmp

Download

memory/1868-222-0x00007FF717FC0000-0x00007FF718311000-memory.dmp

Download

memory/1868-118-0x00007FF717FC0000-0x00007FF718311000-memory.dmp

Download

memory/1868-48-0x00007FF717FC0000-0x00007FF718311000-memory.dmp

Download

memory/2188-249-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp

Download

memory/2188-131-0x00007FF7F9FF0000-0x00007FF7FA341000-memory.dmp

Download

memory/2296-148-0x00007FF72A310000-0x00007FF72A661000-memory.dmp

Download

memory/2296-234-0x00007FF72A310000-0x00007FF72A661000-memory.dmp

Download

memory/2296-89-0x00007FF72A310000-0x00007FF72A661000-memory.dmp

Download

memory/2328-203-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp

Download

memory/2328-14-0x00007FF6DD280000-0x00007FF6DD5D1000-memory.dmp

Download

memory/2528-239-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp

Download

memory/2528-108-0x00007FF65F8A0000-0x00007FF65FBF1000-memory.dmp

Download

memory/2540-0-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp

Download

memory/2540-62-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp

Download

memory/2540-1-0x000002E691610000-0x000002E691620000-memory.dmp

Download

memory/2540-133-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp

Download

memory/2540-156-0x00007FF63B570000-0x00007FF63B8C1000-memory.dmp

Download

memory/2596-207-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp

Download

memory/2596-28-0x00007FF78CDE0000-0x00007FF78D131000-memory.dmp

Download

memory/3348-43-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp

Download

memory/3348-211-0x00007FF79AE10000-0x00007FF79B161000-memory.dmp

Download

memory/3692-6-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp

Download

memory/3692-72-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp

Download

memory/3692-201-0x00007FF666E60000-0x00007FF6671B1000-memory.dmp

Download

memory/3724-228-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp

Download

memory/3724-146-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp

Download

memory/3724-71-0x00007FF75C8C0000-0x00007FF75CC11000-memory.dmp

Download

memory/4372-121-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp

Download

memory/4372-247-0x00007FF7D4520000-0x00007FF7D4871000-memory.dmp

Download

memory/4540-34-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp

Download

memory/4540-209-0x00007FF6D81F0000-0x00007FF6D8541000-memory.dmp

Download

memory/4572-245-0x00007FF7325E0000-0x00007FF732931000-memory.dmp

Download

memory/4572-113-0x00007FF7325E0000-0x00007FF732931000-memory.dmp

Download

memory/4824-226-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp

Download

memory/4824-130-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp

Download

memory/4824-65-0x00007FF7806B0000-0x00007FF780A01000-memory.dmp

Download

memory/4828-236-0x00007FF732580000-0x00007FF7328D1000-memory.dmp

Download

memory/4828-150-0x00007FF732580000-0x00007FF7328D1000-memory.dmp

Download

memory/4828-94-0x00007FF732580000-0x00007FF7328D1000-memory.dmp

Download

memory/4872-129-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp

Download

memory/4872-55-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp

Download

memory/4872-224-0x00007FF68C6F0000-0x00007FF68CA41000-memory.dmp

Download

memory/4904-213-0x00007FF71F020000-0x00007FF71F371000-memory.dmp

Download

memory/4904-47-0x00007FF71F020000-0x00007FF71F371000-memory.dmp

Download

memory/4908-100-0x00007FF775130000-0x00007FF775481000-memory.dmp

Download

memory/4908-240-0x00007FF775130000-0x00007FF775481000-memory.dmp

Download

memory/4908-149-0x00007FF775130000-0x00007FF775481000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads