cobaltstrike | 6c7cbba110913525079c85c430b8eb0c40443b1ddf1835cb260bcdd4bcdfb892

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240602-eqp3wsae3z
SHA256 6c7cbba110913525079c85c430b8eb0c40443b1ddf1835cb260bcdd4bcdfb892
MD5 f2784969a92913b12d9bd6e2bb880f76
SHA1 12cd8b74fcf640d22c0d71705bf106b2a9aacd3e
SHA512 1a572c94f28479b5863a4ba442e2359d58f914443e38362dad2f19f8d93009fd094c281ade49ad2575d96136f4519661ad3d2668388ff67b602c08d89fd598e4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000700000002340e-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-81.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-69.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-26.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002340a-8.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-89.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-117.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-129.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-121.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-109.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000700000002340e-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002340a-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3144-0-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-12.dat	UPX
behavioral2/memory/2816-22-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-30.dat	UPX
behavioral2/files/0x0007000000023413-36.dat	UPX
behavioral2/files/0x0007000000023411-41.dat	UPX
behavioral2/files/0x0007000000023415-47.dat	UPX
behavioral2/memory/2904-61-0x00007FF6825D0000-0x00007FF682921000-memory.dmp	UPX
behavioral2/memory/4692-65-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-67.dat	UPX
behavioral2/files/0x0007000000023419-81.dat	UPX
behavioral2/files/0x000700000002341a-85.dat	UPX
behavioral2/memory/5116-84-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	UPX
behavioral2/memory/1716-83-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	UPX
behavioral2/memory/3788-80-0x00007FF702600000-0x00007FF702951000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-76.dat	UPX
behavioral2/memory/1764-74-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-69.dat	UPX
behavioral2/memory/4792-66-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	UPX
behavioral2/memory/1260-51-0x00007FF638510000-0x00007FF638861000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-50.dat	UPX
behavioral2/memory/3932-37-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-34.dat	UPX
behavioral2/memory/2308-31-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	UPX
behavioral2/files/0x000700000002340f-26.dat	UPX
behavioral2/memory/316-24-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	UPX
behavioral2/memory/5044-18-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	UPX
behavioral2/memory/1496-9-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	UPX
behavioral2/files/0x000800000002340a-8.dat	UPX
behavioral2/files/0x000700000002341b-89.dat	UPX
behavioral2/memory/2924-97-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp	UPX
behavioral2/memory/4008-100-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-106.dat	UPX
behavioral2/memory/812-113-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-117.dat	UPX
behavioral2/files/0x000700000002341f-119.dat	UPX
behavioral2/memory/2432-124-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	UPX
behavioral2/files/0x0007000000023421-129.dat	UPX
behavioral2/memory/3524-131-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	UPX
behavioral2/memory/976-134-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp	UPX
behavioral2/memory/316-132-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	UPX
behavioral2/memory/2816-128-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	UPX
behavioral2/memory/3144-125-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-121.dat	UPX
behavioral2/memory/412-123-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	UPX
behavioral2/memory/5044-118-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	UPX
behavioral2/memory/1496-114-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	UPX
behavioral2/files/0x000700000002341d-109.dat	UPX
behavioral2/memory/3144-102-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	UPX
behavioral2/memory/3932-138-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	UPX
behavioral2/memory/2308-139-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	UPX
behavioral2/memory/1764-143-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	UPX
behavioral2/memory/4792-144-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	UPX
behavioral2/memory/1716-147-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	UPX
behavioral2/memory/4692-142-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	UPX
behavioral2/memory/1260-141-0x00007FF638510000-0x00007FF638861000-memory.dmp	UPX
behavioral2/memory/3144-149-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	UPX
behavioral2/memory/4008-165-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	UPX
behavioral2/memory/2432-168-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	UPX
behavioral2/memory/412-167-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	UPX
behavioral2/memory/812-166-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	UPX
behavioral2/memory/3144-171-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	UPX
behavioral2/memory/1496-211-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	UPX
behavioral2/memory/2816-215-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	UPX

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2904-61-0x00007FF6825D0000-0x00007FF682921000-memory.dmp	xmrig
behavioral2/memory/5116-84-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	xmrig
behavioral2/memory/3788-80-0x00007FF702600000-0x00007FF702951000-memory.dmp	xmrig
behavioral2/memory/1764-74-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	xmrig
behavioral2/memory/2924-97-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp	xmrig
behavioral2/memory/3524-131-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	xmrig
behavioral2/memory/976-134-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp	xmrig
behavioral2/memory/316-132-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	xmrig
behavioral2/memory/2816-128-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	xmrig
behavioral2/memory/3144-125-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	xmrig
behavioral2/memory/5044-118-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	xmrig
behavioral2/memory/1496-114-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	xmrig
behavioral2/memory/3144-102-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	xmrig
behavioral2/memory/3932-138-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	xmrig
behavioral2/memory/2308-139-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	xmrig
behavioral2/memory/1764-143-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	xmrig
behavioral2/memory/4792-144-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	xmrig
behavioral2/memory/1716-147-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	xmrig
behavioral2/memory/4692-142-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	xmrig
behavioral2/memory/1260-141-0x00007FF638510000-0x00007FF638861000-memory.dmp	xmrig
behavioral2/memory/3144-149-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	xmrig
behavioral2/memory/4008-165-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	xmrig
behavioral2/memory/2432-168-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	xmrig
behavioral2/memory/412-167-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	xmrig
behavioral2/memory/812-166-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	xmrig
behavioral2/memory/3144-171-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	xmrig
behavioral2/memory/1496-211-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	xmrig
behavioral2/memory/2816-215-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	xmrig
behavioral2/memory/5044-214-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	xmrig
behavioral2/memory/2308-224-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	xmrig
behavioral2/memory/2904-222-0x00007FF6825D0000-0x00007FF682921000-memory.dmp	xmrig
behavioral2/memory/316-225-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	xmrig
behavioral2/memory/3932-219-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	xmrig
behavioral2/memory/1260-218-0x00007FF638510000-0x00007FF638861000-memory.dmp	xmrig
behavioral2/memory/1764-236-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	xmrig
behavioral2/memory/4792-234-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	xmrig
behavioral2/memory/4692-237-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	xmrig
behavioral2/memory/3788-232-0x00007FF702600000-0x00007FF702951000-memory.dmp	xmrig
behavioral2/memory/5116-229-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	xmrig
behavioral2/memory/1716-227-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	xmrig
behavioral2/memory/2924-246-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp	xmrig
behavioral2/memory/4008-248-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	xmrig
behavioral2/memory/812-250-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	xmrig
behavioral2/memory/2432-256-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	xmrig
behavioral2/memory/412-254-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	xmrig
behavioral2/memory/3524-253-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	xmrig
behavioral2/memory/976-258-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1496	lalaVoJ.exe
5044	dAwLqTe.exe
2816	AmuXBQz.exe
316	LkHVGYS.exe
3932	gKUnwqc.exe
2308	CAWwdub.exe
2904	SJfioon.exe
1260	yEVkfMa.exe
4692	bBWwfZg.exe
1764	OoHhHDT.exe
4792	nujAGWb.exe
3788	nPBpYiD.exe
5116	QlsWqQg.exe
1716	MVcyaOi.exe
2924	GTlZOyP.exe
4008	hUTIVpc.exe
812	nMWsiCe.exe
412	niWJblN.exe
2432	eJlWHoG.exe
3524	CzRERIe.exe
976	vKvKsws.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3144-0-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	upx
behavioral2/files/0x000700000002340e-12.dat	upx
behavioral2/memory/2816-22-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	upx
behavioral2/files/0x0007000000023412-30.dat	upx
behavioral2/files/0x0007000000023413-36.dat	upx
behavioral2/files/0x0007000000023411-41.dat	upx
behavioral2/files/0x0007000000023415-47.dat	upx
behavioral2/memory/2904-61-0x00007FF6825D0000-0x00007FF682921000-memory.dmp	upx
behavioral2/memory/4692-65-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	upx
behavioral2/files/0x0007000000023416-67.dat	upx
behavioral2/files/0x0007000000023419-81.dat	upx
behavioral2/files/0x000700000002341a-85.dat	upx
behavioral2/memory/5116-84-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp	upx
behavioral2/memory/1716-83-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	upx
behavioral2/memory/3788-80-0x00007FF702600000-0x00007FF702951000-memory.dmp	upx
behavioral2/files/0x0007000000023418-76.dat	upx
behavioral2/memory/1764-74-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	upx
behavioral2/files/0x0007000000023417-69.dat	upx
behavioral2/memory/4792-66-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	upx
behavioral2/memory/1260-51-0x00007FF638510000-0x00007FF638861000-memory.dmp	upx
behavioral2/files/0x0007000000023414-50.dat	upx
behavioral2/memory/3932-37-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	upx
behavioral2/files/0x0007000000023410-34.dat	upx
behavioral2/memory/2308-31-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	upx
behavioral2/files/0x000700000002340f-26.dat	upx
behavioral2/memory/316-24-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	upx
behavioral2/memory/5044-18-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	upx
behavioral2/memory/1496-9-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	upx
behavioral2/files/0x000800000002340a-8.dat	upx
behavioral2/files/0x000700000002341b-89.dat	upx
behavioral2/memory/2924-97-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp	upx
behavioral2/memory/4008-100-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	upx
behavioral2/files/0x000700000002341c-106.dat	upx
behavioral2/memory/812-113-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	upx
behavioral2/files/0x000700000002341e-117.dat	upx
behavioral2/files/0x000700000002341f-119.dat	upx
behavioral2/memory/2432-124-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	upx
behavioral2/files/0x0007000000023421-129.dat	upx
behavioral2/memory/3524-131-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp	upx
behavioral2/memory/976-134-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp	upx
behavioral2/memory/316-132-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp	upx
behavioral2/memory/2816-128-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	upx
behavioral2/memory/3144-125-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	upx
behavioral2/files/0x0007000000023420-121.dat	upx
behavioral2/memory/412-123-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	upx
behavioral2/memory/5044-118-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp	upx
behavioral2/memory/1496-114-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	upx
behavioral2/files/0x000700000002341d-109.dat	upx
behavioral2/memory/3144-102-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	upx
behavioral2/memory/3932-138-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp	upx
behavioral2/memory/2308-139-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp	upx
behavioral2/memory/1764-143-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp	upx
behavioral2/memory/4792-144-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp	upx
behavioral2/memory/1716-147-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp	upx
behavioral2/memory/4692-142-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp	upx
behavioral2/memory/1260-141-0x00007FF638510000-0x00007FF638861000-memory.dmp	upx
behavioral2/memory/3144-149-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	upx
behavioral2/memory/4008-165-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp	upx
behavioral2/memory/2432-168-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp	upx
behavioral2/memory/412-167-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp	upx
behavioral2/memory/812-166-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp	upx
behavioral2/memory/3144-171-0x00007FF7964F0000-0x00007FF796841000-memory.dmp	upx
behavioral2/memory/1496-211-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp	upx
behavioral2/memory/2816-215-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\bBWwfZg.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QlsWqQg.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GTlZOyP.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nMWsiCe.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vKvKsws.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lalaVoJ.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OoHhHDT.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nujAGWb.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nPBpYiD.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dAwLqTe.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AmuXBQz.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CAWwdub.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SJfioon.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yEVkfMa.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hUTIVpc.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CzRERIe.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LkHVGYS.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gKUnwqc.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MVcyaOi.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\niWJblN.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eJlWHoG.exe	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1496	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	84
PID 3144 wrote to memory of 1496	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	84
PID 3144 wrote to memory of 5044	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	85
PID 3144 wrote to memory of 5044	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	85
PID 3144 wrote to memory of 2816	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	86
PID 3144 wrote to memory of 2816	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	86
PID 3144 wrote to memory of 316	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	87
PID 3144 wrote to memory of 316	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	87
PID 3144 wrote to memory of 3932	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	88
PID 3144 wrote to memory of 3932	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	88
PID 3144 wrote to memory of 2308	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	89
PID 3144 wrote to memory of 2308	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	89
PID 3144 wrote to memory of 2904	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	90
PID 3144 wrote to memory of 2904	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	90
PID 3144 wrote to memory of 1260	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	91
PID 3144 wrote to memory of 1260	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	91
PID 3144 wrote to memory of 4692	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	92
PID 3144 wrote to memory of 4692	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	92
PID 3144 wrote to memory of 1764	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	93
PID 3144 wrote to memory of 1764	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	93
PID 3144 wrote to memory of 4792	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	94
PID 3144 wrote to memory of 4792	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	94
PID 3144 wrote to memory of 3788	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	95
PID 3144 wrote to memory of 3788	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	95
PID 3144 wrote to memory of 5116	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	96
PID 3144 wrote to memory of 5116	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	96
PID 3144 wrote to memory of 1716	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	97
PID 3144 wrote to memory of 1716	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	97
PID 3144 wrote to memory of 2924	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	98
PID 3144 wrote to memory of 2924	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	98
PID 3144 wrote to memory of 4008	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	99
PID 3144 wrote to memory of 4008	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	99
PID 3144 wrote to memory of 812	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	100
PID 3144 wrote to memory of 812	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	100
PID 3144 wrote to memory of 412	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	101
PID 3144 wrote to memory of 412	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	101
PID 3144 wrote to memory of 2432	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	102
PID 3144 wrote to memory of 2432	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	102
PID 3144 wrote to memory of 3524	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	103
PID 3144 wrote to memory of 3524	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	103
PID 3144 wrote to memory of 976	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	104
PID 3144 wrote to memory of 976	3144	2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_f2784969a92913b12d9bd6e2bb880f76_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\System\lalaVoJ.exe
  C:\Windows\System\lalaVoJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\dAwLqTe.exe
  C:\Windows\System\dAwLqTe.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\AmuXBQz.exe
  C:\Windows\System\AmuXBQz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\LkHVGYS.exe
  C:\Windows\System\LkHVGYS.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\gKUnwqc.exe
  C:\Windows\System\gKUnwqc.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\CAWwdub.exe
  C:\Windows\System\CAWwdub.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\SJfioon.exe
  C:\Windows\System\SJfioon.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\yEVkfMa.exe
  C:\Windows\System\yEVkfMa.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\bBWwfZg.exe
  C:\Windows\System\bBWwfZg.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\OoHhHDT.exe
  C:\Windows\System\OoHhHDT.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nujAGWb.exe
  C:\Windows\System\nujAGWb.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\nPBpYiD.exe
  C:\Windows\System\nPBpYiD.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\QlsWqQg.exe
  C:\Windows\System\QlsWqQg.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\MVcyaOi.exe
  C:\Windows\System\MVcyaOi.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\GTlZOyP.exe
  C:\Windows\System\GTlZOyP.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\hUTIVpc.exe
  C:\Windows\System\hUTIVpc.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\nMWsiCe.exe
  C:\Windows\System\nMWsiCe.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\niWJblN.exe
  C:\Windows\System\niWJblN.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\eJlWHoG.exe
  C:\Windows\System\eJlWHoG.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\CzRERIe.exe
  C:\Windows\System\CzRERIe.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\vKvKsws.exe
  C:\Windows\System\vKvKsws.exe
  2⤵
  - Executes dropped EXE
  PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AmuXBQz.exe

Path C:\Windows\System\AmuXBQz.exe
Size 5.2MB
SHA256 b6952da24207c0406201f2d71a25c8861ef144cb546a2d773317f49060f6d170
MD5 ad2ca0cbaed4f42359f37f41a1a29e1f
SHA1 b794dcf40463f22012afa2bec1cfe8785d3d99d3
SHA512 11370a189efc9f0959b5c3ee8c36157d93f1cfb1b36dce578137ee272a3c17df7c9c2f395e4269bdf3c699425d5617c0272b7f613b1b7806021a0869b7113e70
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

CAWwdub.exe

Path C:\Windows\System\CAWwdub.exe
Size 5.2MB
SHA256 9a818c8cca9a8e5cb933668c5dfd153d21946e8e497a57e1583df9d309c59eaf
MD5 103d1b607d3e124f973050d523d436ae
SHA1 6c04543c8473ca08e0ea98de4d6dd2bfaa4f5a68
SHA512 3d07c5a83e6fefdec259497becb848f9c63946bcf231249deb57dc41e0d819399a3ccb6d635554ede2094cdc81c98ae5e4c8c005d560940fd9f708e6f83b7ef7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

CzRERIe.exe

Path C:\Windows\System\CzRERIe.exe
Size 5.2MB
SHA256 a02f932236a480ddbc07605e6431124c63cee34055f076d9c1d327e1383ef4ce
MD5 d9f293f895336a23f638c10f1b345756
SHA1 0d7c9490d47b23e8ad0482d9ffe55d6f187a9b68
SHA512 6518e9bf50c3d44522050a9e565c03fed06bd49d78e52c8e4e23c6f40aca8be0b14cf52e8ee57b3f3881fe94467b556424cb83023628a1a716d1989f2a3c871e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTlZOyP.exe

Path C:\Windows\System\GTlZOyP.exe
Size 5.2MB
SHA256 9d6e5ed79a0951e4e5cdcac57e408968d53d09246fb7ba0ebfe7aeb22e26164e
MD5 67c07248ea153315ec5b9573eb4ee693
SHA1 be628fedeafab8a61c98200168085a6e7bfe76b3
SHA512 9d6ee079564485e2da920cf0e6bd7389ca54dbb14a8884ac88dd3a247ff5b324ae54cd9875a3a7661bbd058e8644880ad054bcf20e110918e1188f737e577d52
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

LkHVGYS.exe

Path C:\Windows\System\LkHVGYS.exe
Size 5.2MB
SHA256 baec9fa2bd72fa3b4d1dd8486543456a34a079a29b5b9adac19fafd8020b3b66
MD5 57304a80118fd8bfd2a650db8bda6753
SHA1 807fbfee1b5885ecd90c326e9fc1c7ed9f0298ad
SHA512 cb893716a6991f1aa7e4e7f49fdde8ab58d5e309dbf878ca2930c3e3b6c25657dc8e2f03f83c13998691a30c0053aa8e651aeb5d7fe4d44de82c7f01ff8b7dfd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MVcyaOi.exe

Path C:\Windows\System\MVcyaOi.exe
Size 5.2MB
SHA256 5f7701f8c52f4b23d145c66e96df53382761422231c6eecdbefd8117a8e87356
MD5 d2b48acceab40262a1d59b78a7a77f5c
SHA1 646dc12c8153d1ed1af352e5ce38a1e0773c276d
SHA512 446e9c00df3c9516672132da92f232802d33e094c292e5e51fe6d3d05a1c63c700d8090a2230ad8d72ec729ce39e0cefb964f9f403cd9f2f5b248026c3a4ff82
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

OoHhHDT.exe

Path C:\Windows\System\OoHhHDT.exe
Size 5.2MB
SHA256 a276e6763dea505c8f953d0ffb4077ac41d1e39da75b4bcee0d97332d8ba313c
MD5 52d55b07c928a46a084f3733d2141774
SHA1 dd4d860b874ae09315bc1eb0f2933d3ee43fcabb
SHA512 f3d1aaac6f59527b5bd852edc94d42b8da58c950297f17f5cd9a16553f7059c50df8ce0d5cd158fe0ae61ac41d2430873158d1f3d4a12eb16b747e1001305587
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

QlsWqQg.exe

Path C:\Windows\System\QlsWqQg.exe
Size 5.2MB
SHA256 ff00063478a57190054dee2ce06ed759f2ca7edb9b44bd45df1cde66acd89a86
MD5 07b062cf52a60d04c3b331b06c593c7a
SHA1 912bacc21468443e41c5ef63c9a03b442a63d395
SHA512 5a5f8a5ec296a345bf2d3477e81feb35e87ed35a3709e7c98090a936d604cd3780b692c47440f14804d1014bf380ac6c76cc1216885e5127b3d6dae638125d1d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SJfioon.exe

Path C:\Windows\System\SJfioon.exe
Size 5.2MB
SHA256 bf97e9f1bfd10e9760bd163fa6a5ef3afcdf5fbc5ce020447312caf79c90ea8f
MD5 061e1270ee933d1d021db4f40818a808
SHA1 42c1e99c17c0fc391035bacabcf59941ca0a017a
SHA512 0014c183cedced32c65c69e978cc2fe478017d9fdfe6bced7744a5e9c9baf18187d55edf4bb9dff993c41ca6bf53f5c0f6c531aec1699fbf7da0db70a4a56523
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBWwfZg.exe

Path C:\Windows\System\bBWwfZg.exe
Size 5.2MB
SHA256 f80a16a66088d2b7716c90c44868d772942906ce1562ee250954d82638599bc6
MD5 ca918fe0bd972fa135f8ee87e7a53c08
SHA1 3e599d95bbb76fc63365b365ee331b46aaeec653
SHA512 989e18078133b012f9245bcbee753b71e350bab59bf592c64e8055c6b666ea768077a6afbaf79e349a7a26acf136c422d788827e5287c64f1808c762f69bd41d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

dAwLqTe.exe

Path C:\Windows\System\dAwLqTe.exe
Size 5.2MB
SHA256 0078c16d28a881a05b709e2492106243d5936077af7005536d249ba7792fdbd6
MD5 3d6d88706a5e7d98c5dd8c1d18c36e37
SHA1 4259ca1b66dbce8fa9d8288e872dede0c2d7a2fd
SHA512 dd033f41db6c323fec0db7a4af11b0b1cb08255c0e3da6bcee33f6c58bef71019285823563f437cfb0b3c0e142219067dc004d4f2d0006d57f0ad945f223676a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

eJlWHoG.exe

Path C:\Windows\System\eJlWHoG.exe
Size 5.2MB
SHA256 f2712cddce420c127061c61eb6ac5fdf3bbc3707513103d8179cafd3930ad9bf
MD5 32e551874cae03a2bd00485b648ce023
SHA1 eb10911e50df972cc9b7a76f05669a1f9fcbdc47
SHA512 2bb364cfda4a3ca0fc79676b9be924da48c3a8b50fdc3feb6c5475f5e7608e64a4fd86aede0eba7e1a3c049691037cb29138b8542a5d19216b664d6ac2d4f3b2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKUnwqc.exe

Path C:\Windows\System\gKUnwqc.exe
Size 5.2MB
SHA256 20e73f13870830f6497542cc5fc72a4a8a5cf3af454c843690cbd90316960a1e
MD5 4f5cf701d09aa126187e4c3e7dc027f8
SHA1 f3c6ff7adf6e3a005ea9799283f0af91c71c60fe
SHA512 e3a3a6b51b9531fe2d95286a9daee11586074bf1ddddf3f47574b164b68c513c798ffca108246a1913800ce2a851a1722d6cd3e8eb385724f9f27ece40ac2079
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

hUTIVpc.exe

Path C:\Windows\System\hUTIVpc.exe
Size 5.2MB
SHA256 7ee40e510987249ac2ed688a8e1005e81f929e1f608bb573fe2109caa25879ff
MD5 4831757344ad57b052e25e82ae29e53a
SHA1 8d6e532f38578e62e5af143c151901127f9261c6
SHA512 d0d5b7bc222fe0b462f34fcd16fade04386c7dbf134b15ac643144268604e6325cd038169ac8f19fb9f5f3134e189688601c6ed6f5e3bf0ae978cf5771c401f4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

lalaVoJ.exe

Path C:\Windows\System\lalaVoJ.exe
Size 5.2MB
SHA256 45577049de33c4c03030775d68acef24bc885ca14ab2870bff250167f9227641
MD5 71dbc9875f922e6ff517f45d97435832
SHA1 c97b3bb602837c9c67b84682a4774ff99e7ff4c7
SHA512 f4959e07aefdf854140092d6dd82f264d5907a1e5f710d12cfde0a095aa613c057e6d7642e1507dccdb868655bf5ecdbf9c30623193d6f1a34b8b531a5d1017c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

nMWsiCe.exe

Path C:\Windows\System\nMWsiCe.exe
Size 5.2MB
SHA256 2dfd99816382608378f0656ef37f98b1eec9139eef04b2eb31fac1c1443ddccd
MD5 5963264fbe675a9caeedb08cc10e6f43
SHA1 69d78165c37e29c32c0adad7f629d7d14e861374
SHA512 b853dbd7f6349e94c11b11df4c1ef261fb36758077f2530faed93c5b77d259d23e91d52d36159e51548ad2eee719271cf8cfc6e045c0d3f7928595d8c2b2179c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPBpYiD.exe

Path C:\Windows\System\nPBpYiD.exe
Size 5.2MB
SHA256 22a0da576a0e1fb4ac1b2ce2a09a889895d188cefbbeca2c5fa97386b541b3bf
MD5 4ae08fc4a9e8ee4537afc7093bbdea1d
SHA1 101c8fe71c3c7c6b734d6f0075a07ac7fd2432be
SHA512 ba93b525ea7b7710c9af23ad36a99de4840b839fea35f1b0291ba987cd3534aff2ad2285794ccb6feae87ae284097cc15d38cf094539069c345f5c0c018af7b0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

niWJblN.exe

Path C:\Windows\System\niWJblN.exe
Size 5.2MB
SHA256 1f920a0a6c2c2bc01a482254fb9eb32c03462f7bcb8f47b3d790bdbaf57d685d
MD5 537f31553a1f101a64a1c5f897acbfbe
SHA1 4a1b37fcd70bdfd29ebd85966ca7b0e381e1df99
SHA512 dad9509eb3993d1d33f7af7d3d1e3851466f263e8631034994ab6fedeb18bcba1e613ca47474d6a6a9e018dfb2ed021302377ffa26ba716a0f11649200b6be76
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

nujAGWb.exe

Path C:\Windows\System\nujAGWb.exe
Size 5.2MB
SHA256 7cc98b48b2b77e1280acee413283f6d82ddf4aecbe64b1616649674409da3186
MD5 eb03fc70eb694449c2f93f0e103ab893
SHA1 83c980bb20b6c7f9db7aa4ee2ca8b9ed52364e99
SHA512 e498fde985a074a011bf576f99b60cc07a9e0fb6b95792f26579ce8d8f2a6df5328ea20f421cd60b95ee26fa01c36a963cfd27f9c0e0f236762246e6db8899e9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vKvKsws.exe

Path C:\Windows\System\vKvKsws.exe
Size 5.2MB
SHA256 d9d62d735884f5c5b0e5143553fc32916c1838e56e85bfdb8e3e10f43aa9b354
MD5 3f79c47c00472aa5fd1eaa3dcd0e2a84
SHA1 4d55db93869f964f2dd4d2295df0ce0758c8d09c
SHA512 d69098bbafff7f4bea6aa17a1554e38cf15807e4314923e941e21048a7418c40cb743116abe45e2659d6148815096210825d9cc52b07d7fc6bfe60e672b9e9cc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yEVkfMa.exe

Path C:\Windows\System\yEVkfMa.exe
Size 5.2MB
SHA256 4ea6510f23eb5437b645a29731f2359f010512a2dc81ac56f639246f0cf16944
MD5 452e0c54f03556f5f3fe739aac409e0b
SHA1 6f116dbdb291a7d0611f6d668d5a41675770fc13
SHA512 010c1e4c168fc554b21a72cb6dca0688b6b731e232483f0f65af36b65addd1d660382347ea22bcd266a2ab81d3fa295f9e2016fb7084eff773c40bdf90e67010
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-225-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp

Download

memory/316-132-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp

Download

memory/316-24-0x00007FF70A1D0000-0x00007FF70A521000-memory.dmp

Download

memory/412-167-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp

Download

memory/412-123-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp

Download

memory/412-254-0x00007FF6BD0E0000-0x00007FF6BD431000-memory.dmp

Download

memory/812-113-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp

Download

memory/812-250-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp

Download

memory/812-166-0x00007FF72E1B0000-0x00007FF72E501000-memory.dmp

Download

memory/976-134-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp

Download

memory/976-258-0x00007FF7E1CA0000-0x00007FF7E1FF1000-memory.dmp

Download

memory/1260-51-0x00007FF638510000-0x00007FF638861000-memory.dmp

Download

memory/1260-218-0x00007FF638510000-0x00007FF638861000-memory.dmp

Download

memory/1260-141-0x00007FF638510000-0x00007FF638861000-memory.dmp

Download

memory/1496-114-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp

Download

memory/1496-211-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp

Download

memory/1496-9-0x00007FF7F45F0000-0x00007FF7F4941000-memory.dmp

Download

memory/1716-83-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp

Download

memory/1716-227-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp

Download

memory/1716-147-0x00007FF64DCD0000-0x00007FF64E021000-memory.dmp

Download

memory/1764-236-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp

Download

memory/1764-74-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp

Download

memory/1764-143-0x00007FF77D970000-0x00007FF77DCC1000-memory.dmp

Download

memory/2308-224-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp

Download

memory/2308-31-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp

Download

memory/2308-139-0x00007FF74A920000-0x00007FF74AC71000-memory.dmp

Download

memory/2432-256-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp

Download

memory/2432-168-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp

Download

memory/2432-124-0x00007FF7BFAC0000-0x00007FF7BFE11000-memory.dmp

Download

memory/2816-128-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp

Download

memory/2816-22-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp

Download

memory/2816-215-0x00007FF6647E0000-0x00007FF664B31000-memory.dmp

Download

memory/2904-61-0x00007FF6825D0000-0x00007FF682921000-memory.dmp

Download

memory/2904-222-0x00007FF6825D0000-0x00007FF682921000-memory.dmp

Download

memory/2924-97-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp

Download

memory/2924-246-0x00007FF70DB80000-0x00007FF70DED1000-memory.dmp

Download

memory/3144-0-0x00007FF7964F0000-0x00007FF796841000-memory.dmp

Download

memory/3144-149-0x00007FF7964F0000-0x00007FF796841000-memory.dmp

Download

memory/3144-102-0x00007FF7964F0000-0x00007FF796841000-memory.dmp

Download

memory/3144-1-0x000001C8FFCE0000-0x000001C8FFCF0000-memory.dmp

Download

memory/3144-125-0x00007FF7964F0000-0x00007FF796841000-memory.dmp

Download

memory/3144-171-0x00007FF7964F0000-0x00007FF796841000-memory.dmp

Download

memory/3524-253-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp

Download

memory/3524-131-0x00007FF6E4A00000-0x00007FF6E4D51000-memory.dmp

Download

memory/3788-80-0x00007FF702600000-0x00007FF702951000-memory.dmp

Download

memory/3788-232-0x00007FF702600000-0x00007FF702951000-memory.dmp

Download

memory/3932-37-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp

Download

memory/3932-219-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp

Download

memory/3932-138-0x00007FF6258C0000-0x00007FF625C11000-memory.dmp

Download

memory/4008-100-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp

Download

memory/4008-248-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp

Download

memory/4008-165-0x00007FF6F99A0000-0x00007FF6F9CF1000-memory.dmp

Download

memory/4692-142-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp

Download

memory/4692-237-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp

Download

memory/4692-65-0x00007FF731E70000-0x00007FF7321C1000-memory.dmp

Download

memory/4792-66-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp

Download

memory/4792-144-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp

Download

memory/4792-234-0x00007FF68E890000-0x00007FF68EBE1000-memory.dmp

Download

memory/5044-118-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp

Download

memory/5044-18-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp

Download

memory/5044-214-0x00007FF72BA00000-0x00007FF72BD51000-memory.dmp

Download

memory/5116-84-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp

Download

memory/5116-229-0x00007FF7BC880000-0x00007FF7BCBD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads