cobaltstrike | b9bded4981bc7f093eb09997a218fa712e340996d97ccfd0d4a16f72c30dc88e

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240602-hr14bseh64
SHA256 b9bded4981bc7f093eb09997a218fa712e340996d97ccfd0d4a16f72c30dc88e
MD5 9e488620715a2373df175a584f26fd8b
SHA1 a9e6d1b6fdf6d13618a0da7e71ca4091317867dc
SHA512 7157a38a0cee9721a4e4a3c1831b0831895134a4e238f35a2dbc07f3a7c7c1e55e636a417aaf7b57b01531be949b9892d6c20b61de38c954ae5db28dedaf0e7e
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibC56utgpPFotBER/mQ32lUV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023276-6.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233ea-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ee-17.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ef-21.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f1-30.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f3-46.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f4-51.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f2-45.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f0-35.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f5-59.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233eb-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-69.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-85.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-98.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-100.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-110.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-119.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-132.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-116.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-91.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-79.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023276-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233ea-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ee-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ef-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f1-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f3-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f4-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f2-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f0-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f5-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233eb-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-132.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4936-0-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	UPX
behavioral2/files/0x0007000000023276-6.dat	UPX
behavioral2/files/0x00080000000233ea-11.dat	UPX
behavioral2/files/0x00070000000233ee-17.dat	UPX
behavioral2/files/0x00070000000233ef-21.dat	UPX
behavioral2/files/0x00070000000233f1-30.dat	UPX
behavioral2/memory/3368-36-0x00007FF672940000-0x00007FF672C91000-memory.dmp	UPX
behavioral2/files/0x00070000000233f3-46.dat	UPX
behavioral2/files/0x00070000000233f4-51.dat	UPX
behavioral2/memory/5092-52-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	UPX
behavioral2/memory/872-49-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	UPX
behavioral2/files/0x00070000000233f2-45.dat	UPX
behavioral2/memory/2952-43-0x00007FF774800000-0x00007FF774B51000-memory.dmp	UPX
behavioral2/memory/2592-37-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	UPX
behavioral2/memory/552-32-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	UPX
behavioral2/files/0x00070000000233f0-35.dat	UPX
behavioral2/memory/3168-29-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	UPX
behavioral2/memory/1520-23-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	UPX
behavioral2/memory/3116-13-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	UPX
behavioral2/files/0x00070000000233f5-59.dat	UPX
behavioral2/files/0x00080000000233eb-64.dat	UPX
behavioral2/files/0x00070000000233f6-69.dat	UPX
behavioral2/memory/892-65-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-85.dat	UPX
behavioral2/files/0x00070000000233fb-98.dat	UPX
behavioral2/files/0x00070000000233fa-100.dat	UPX
behavioral2/files/0x00070000000233fd-110.dat	UPX
behavioral2/files/0x00070000000233ff-119.dat	UPX
behavioral2/memory/4536-124-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	UPX
behavioral2/memory/2952-127-0x00007FF774800000-0x00007FF774B51000-memory.dmp	UPX
behavioral2/files/0x00070000000233fc-132.dat	UPX
behavioral2/memory/4632-126-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	UPX
behavioral2/memory/3368-125-0x00007FF672940000-0x00007FF672C91000-memory.dmp	UPX
behavioral2/memory/4784-123-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp	UPX
behavioral2/memory/2592-122-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	UPX
behavioral2/memory/3040-121-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	UPX
behavioral2/memory/3292-117-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp	UPX
behavioral2/files/0x00070000000233fe-116.dat	UPX
behavioral2/memory/552-113-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	UPX
behavioral2/memory/5076-107-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp	UPX
behavioral2/memory/4816-101-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	UPX
behavioral2/memory/4564-96-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp	UPX
behavioral2/memory/4496-95-0x00007FF649550000-0x00007FF6498A1000-memory.dmp	UPX
behavioral2/memory/1520-94-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	UPX
behavioral2/memory/4936-92-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	UPX
behavioral2/files/0x00070000000233f8-91.dat	UPX
behavioral2/files/0x00070000000233f7-79.dat	UPX
behavioral2/memory/3604-70-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	UPX
behavioral2/memory/2236-61-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	UPX
behavioral2/memory/4936-134-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	UPX
behavioral2/memory/5092-143-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	UPX
behavioral2/memory/892-145-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	UPX
behavioral2/memory/3604-146-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	UPX
behavioral2/memory/2236-144-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	UPX
behavioral2/memory/872-142-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	UPX
behavioral2/memory/4536-152-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	UPX
behavioral2/memory/4632-155-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	UPX
behavioral2/memory/3040-153-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	UPX
behavioral2/memory/4816-150-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	UPX
behavioral2/memory/4936-156-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	UPX
behavioral2/memory/3116-212-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	UPX
behavioral2/memory/3168-214-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	UPX
behavioral2/memory/1520-216-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	UPX
behavioral2/memory/552-218-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/552-32-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	xmrig
behavioral2/memory/3168-29-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	xmrig
behavioral2/memory/3116-13-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	xmrig
behavioral2/memory/2952-127-0x00007FF774800000-0x00007FF774B51000-memory.dmp	xmrig
behavioral2/memory/3368-125-0x00007FF672940000-0x00007FF672C91000-memory.dmp	xmrig
behavioral2/memory/4784-123-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp	xmrig
behavioral2/memory/2592-122-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	xmrig
behavioral2/memory/3292-117-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp	xmrig
behavioral2/memory/552-113-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	xmrig
behavioral2/memory/5076-107-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp	xmrig
behavioral2/memory/4564-96-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp	xmrig
behavioral2/memory/4496-95-0x00007FF649550000-0x00007FF6498A1000-memory.dmp	xmrig
behavioral2/memory/1520-94-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	xmrig
behavioral2/memory/4936-92-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	xmrig
behavioral2/memory/4936-134-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	xmrig
behavioral2/memory/5092-143-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	xmrig
behavioral2/memory/892-145-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	xmrig
behavioral2/memory/3604-146-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	xmrig
behavioral2/memory/2236-144-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	xmrig
behavioral2/memory/872-142-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	xmrig
behavioral2/memory/4536-152-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	xmrig
behavioral2/memory/4632-155-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	xmrig
behavioral2/memory/3040-153-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	xmrig
behavioral2/memory/4816-150-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	xmrig
behavioral2/memory/4936-156-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	xmrig
behavioral2/memory/3116-212-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	xmrig
behavioral2/memory/3168-214-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	xmrig
behavioral2/memory/1520-216-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	xmrig
behavioral2/memory/552-218-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	xmrig
behavioral2/memory/3368-220-0x00007FF672940000-0x00007FF672C91000-memory.dmp	xmrig
behavioral2/memory/2592-222-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	xmrig
behavioral2/memory/2952-224-0x00007FF774800000-0x00007FF774B51000-memory.dmp	xmrig
behavioral2/memory/5092-226-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	xmrig
behavioral2/memory/872-228-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	xmrig
behavioral2/memory/2236-237-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	xmrig
behavioral2/memory/892-239-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	xmrig
behavioral2/memory/4496-242-0x00007FF649550000-0x00007FF6498A1000-memory.dmp	xmrig
behavioral2/memory/3604-243-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	xmrig
behavioral2/memory/5076-247-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp	xmrig
behavioral2/memory/4564-246-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp	xmrig
behavioral2/memory/3292-251-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp	xmrig
behavioral2/memory/4784-250-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp	xmrig
behavioral2/memory/4816-253-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	xmrig
behavioral2/memory/4536-255-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	xmrig
behavioral2/memory/4632-258-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	xmrig
behavioral2/memory/3040-259-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3116	ThzIGsn.exe
3168	IHCvwjo.exe
1520	HFpesiY.exe
552	OefaPNE.exe
3368	bOpClfr.exe
2592	qTgTZkC.exe
2952	AEqGMct.exe
872	rZriQhA.exe
5092	IfafHMS.exe
2236	BmdiatS.exe
892	EJqHOTe.exe
3604	uTRiIGK.exe
4496	DTbQSKJ.exe
5076	oGNkhgl.exe
4564	NXLhwPs.exe
4816	xpPIxkj.exe
3292	EBTsBCQ.exe
3040	fSLdOBQ.exe
4784	BvSRQmr.exe
4632	jKzxBma.exe
4536	vVjpjuq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-0-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	upx
behavioral2/files/0x0007000000023276-6.dat	upx
behavioral2/files/0x00080000000233ea-11.dat	upx
behavioral2/files/0x00070000000233ee-17.dat	upx
behavioral2/files/0x00070000000233ef-21.dat	upx
behavioral2/files/0x00070000000233f1-30.dat	upx
behavioral2/memory/3368-36-0x00007FF672940000-0x00007FF672C91000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-46.dat	upx
behavioral2/files/0x00070000000233f4-51.dat	upx
behavioral2/memory/5092-52-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	upx
behavioral2/memory/872-49-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-45.dat	upx
behavioral2/memory/2952-43-0x00007FF774800000-0x00007FF774B51000-memory.dmp	upx
behavioral2/memory/2592-37-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	upx
behavioral2/memory/552-32-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-35.dat	upx
behavioral2/memory/3168-29-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	upx
behavioral2/memory/1520-23-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	upx
behavioral2/memory/3116-13-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-59.dat	upx
behavioral2/files/0x00080000000233eb-64.dat	upx
behavioral2/files/0x00070000000233f6-69.dat	upx
behavioral2/memory/892-65-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-85.dat	upx
behavioral2/files/0x00070000000233fb-98.dat	upx
behavioral2/files/0x00070000000233fa-100.dat	upx
behavioral2/files/0x00070000000233fd-110.dat	upx
behavioral2/files/0x00070000000233ff-119.dat	upx
behavioral2/memory/4536-124-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	upx
behavioral2/memory/2952-127-0x00007FF774800000-0x00007FF774B51000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-132.dat	upx
behavioral2/memory/4632-126-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	upx
behavioral2/memory/3368-125-0x00007FF672940000-0x00007FF672C91000-memory.dmp	upx
behavioral2/memory/4784-123-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp	upx
behavioral2/memory/2592-122-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp	upx
behavioral2/memory/3040-121-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	upx
behavioral2/memory/3292-117-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-116.dat	upx
behavioral2/memory/552-113-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	upx
behavioral2/memory/5076-107-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp	upx
behavioral2/memory/4816-101-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	upx
behavioral2/memory/4564-96-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp	upx
behavioral2/memory/4496-95-0x00007FF649550000-0x00007FF6498A1000-memory.dmp	upx
behavioral2/memory/1520-94-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	upx
behavioral2/memory/4936-92-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-91.dat	upx
behavioral2/files/0x00070000000233f7-79.dat	upx
behavioral2/memory/3604-70-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	upx
behavioral2/memory/2236-61-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	upx
behavioral2/memory/4936-134-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	upx
behavioral2/memory/5092-143-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp	upx
behavioral2/memory/892-145-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp	upx
behavioral2/memory/3604-146-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp	upx
behavioral2/memory/2236-144-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp	upx
behavioral2/memory/872-142-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp	upx
behavioral2/memory/4536-152-0x00007FF72D030000-0x00007FF72D381000-memory.dmp	upx
behavioral2/memory/4632-155-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp	upx
behavioral2/memory/3040-153-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp	upx
behavioral2/memory/4816-150-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp	upx
behavioral2/memory/4936-156-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp	upx
behavioral2/memory/3116-212-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp	upx
behavioral2/memory/3168-214-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp	upx
behavioral2/memory/1520-216-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp	upx
behavioral2/memory/552-218-0x00007FF782470000-0x00007FF7827C1000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\OefaPNE.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AEqGMct.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oGNkhgl.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jKzxBma.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IHCvwjo.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bOpClfr.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EJqHOTe.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EBTsBCQ.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vVjpjuq.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ThzIGsn.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rZriQhA.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BmdiatS.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uTRiIGK.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xpPIxkj.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BvSRQmr.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HFpesiY.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qTgTZkC.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IfafHMS.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DTbQSKJ.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NXLhwPs.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fSLdOBQ.exe	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3116	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	84
PID 4936 wrote to memory of 3116	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	84
PID 4936 wrote to memory of 3168	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	85
PID 4936 wrote to memory of 3168	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	85
PID 4936 wrote to memory of 1520	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	86
PID 4936 wrote to memory of 1520	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	86
PID 4936 wrote to memory of 552	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	87
PID 4936 wrote to memory of 552	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	87
PID 4936 wrote to memory of 3368	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	88
PID 4936 wrote to memory of 3368	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	88
PID 4936 wrote to memory of 2592	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	89
PID 4936 wrote to memory of 2592	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	89
PID 4936 wrote to memory of 2952	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	90
PID 4936 wrote to memory of 2952	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	90
PID 4936 wrote to memory of 872	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	91
PID 4936 wrote to memory of 872	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	91
PID 4936 wrote to memory of 5092	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	92
PID 4936 wrote to memory of 5092	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	92
PID 4936 wrote to memory of 2236	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	93
PID 4936 wrote to memory of 2236	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	93
PID 4936 wrote to memory of 892	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	94
PID 4936 wrote to memory of 892	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	94
PID 4936 wrote to memory of 3604	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	95
PID 4936 wrote to memory of 3604	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	95
PID 4936 wrote to memory of 4496	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	96
PID 4936 wrote to memory of 4496	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	96
PID 4936 wrote to memory of 5076	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	97
PID 4936 wrote to memory of 5076	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	97
PID 4936 wrote to memory of 4564	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	98
PID 4936 wrote to memory of 4564	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	98
PID 4936 wrote to memory of 4816	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	99
PID 4936 wrote to memory of 4816	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	99
PID 4936 wrote to memory of 3292	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	100
PID 4936 wrote to memory of 3292	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	100
PID 4936 wrote to memory of 4536	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	101
PID 4936 wrote to memory of 4536	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	101
PID 4936 wrote to memory of 3040	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	102
PID 4936 wrote to memory of 3040	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	102
PID 4936 wrote to memory of 4784	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	103
PID 4936 wrote to memory of 4784	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	103
PID 4936 wrote to memory of 4632	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	104
PID 4936 wrote to memory of 4632	4936	2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_9e488620715a2373df175a584f26fd8b_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System\ThzIGsn.exe
  C:\Windows\System\ThzIGsn.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\IHCvwjo.exe
  C:\Windows\System\IHCvwjo.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\HFpesiY.exe
  C:\Windows\System\HFpesiY.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\OefaPNE.exe
  C:\Windows\System\OefaPNE.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\bOpClfr.exe
  C:\Windows\System\bOpClfr.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\qTgTZkC.exe
  C:\Windows\System\qTgTZkC.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\AEqGMct.exe
  C:\Windows\System\AEqGMct.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\rZriQhA.exe
  C:\Windows\System\rZriQhA.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\IfafHMS.exe
  C:\Windows\System\IfafHMS.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\BmdiatS.exe
  C:\Windows\System\BmdiatS.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\EJqHOTe.exe
  C:\Windows\System\EJqHOTe.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\uTRiIGK.exe
  C:\Windows\System\uTRiIGK.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\DTbQSKJ.exe
  C:\Windows\System\DTbQSKJ.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\oGNkhgl.exe
  C:\Windows\System\oGNkhgl.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\NXLhwPs.exe
  C:\Windows\System\NXLhwPs.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\xpPIxkj.exe
  C:\Windows\System\xpPIxkj.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\EBTsBCQ.exe
  C:\Windows\System\EBTsBCQ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\vVjpjuq.exe
  C:\Windows\System\vVjpjuq.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\fSLdOBQ.exe
  C:\Windows\System\fSLdOBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\BvSRQmr.exe
  C:\Windows\System\BvSRQmr.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\jKzxBma.exe
  C:\Windows\System\jKzxBma.exe
  2⤵
  - Executes dropped EXE
  PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AEqGMct.exe

Path C:\Windows\System\AEqGMct.exe
Size 5.2MB
SHA256 35c3fe6b552c2b40253c79fd414f05bc9a9fcdcb4fb5339c49649b58df50e63e
MD5 d3cbcf9b28c2f9108e96591a43d25124
SHA1 1a7e0bef8dc73fe3b3e5bf00a26bae8d39690988
SHA512 58e7f5a6b4bd08fd64f13d3e216f47f9b2144098f3158caab7a7e592ab7e0e10d07d7a371ac2de1455b608e15b50d613d43f2401f15f3732fbf5b049270cf370
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibC56utgpPFotBER/mQ32lUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

BmdiatS.exe

Path C:\Windows\System\BmdiatS.exe
Size 5.2MB
SHA256 9f4c7fcf6043ab25e5d9c7267b8e0523922fa8f490e9c53fd5bc528c52d61971
MD5 c7433f3dea66ec566b53a750aab31142
SHA1 cf11aee14b5ca2017d6c7c213ca5e2d235118c7f
SHA512 7386dee77ea44abd89e61e8b1bc2580fef28397229d1881af2da4a4c441135281273841e63cac507f77aad0e34a79e588a450b6974af5f42d41b4558fab05ed3
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibC56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

BvSRQmr.exe

Path C:\Windows\System\BvSRQmr.exe
Size 5.2MB
SHA256 4288238a8c512ab5c0b348158c89a89beb5cc967bdfd06420869fa2f61162bcf
MD5 5acd56a13ea009dc754c4fe5f32eeea2
SHA1 8fed0716d41057b1921a0f15834d4bf8a06dc0df
SHA512 b90f469e6ec781238b2196cfb170ebc5f605dd175dc3a94977ed9ab1617026f49cbfe864b58db2c1e66c7ecce8f8b772b779ac56c4cf09b9ff8c73fbfff8811f
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibC56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

DTbQSKJ.exe

Path C:\Windows\System\DTbQSKJ.exe
Size 5.2MB
SHA256 784df1f7e164c9710baafb80f3c9f93b86276f161cbe681a15310a6063998655
MD5 38f13657a1fa98263c58088bbb81c48e
SHA1 2867a35de88ecd512087ebf7bd17d65f4bc94e69
SHA512 b5fbf49fa78bdbb304931b1943e7f066e9ce8f25b162ee9a1de9aa2e38892c3eb0941a915a4af25bc188bbbe482f5c37945c4d6e7e794635e8adbca9b99ea982
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibC56utgpPFotBER/mQ32lU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBTsBCQ.exe

Path C:\Windows\System\EBTsBCQ.exe
Size 5.2MB
SHA256 792dbdaaf750a1400b1e1a8d22eac86b2eade0bf8b6edfdf470995c4101adf85
MD5 f17a16dac30d8d9978e719f8c7890159
SHA1 be8f30ec3f717bd56efadf66bfdc41cc8f60fd87
SHA512 8c33129202a25a7bb089b4e6d9c2af5a8762e90af02dfe4b983eca11680c41fe1b5613f3df37879baa083fd0a12f3b8d05e20dbfdc2b983eb1068028ed7beaba
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibC56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

EJqHOTe.exe

Path C:\Windows\System\EJqHOTe.exe
Size 5.2MB
SHA256 7a46003f74082208689eebad939476d9173dd5bd5e367998518ee3a3563d8a31
MD5 8c36a6229b23bce98d946ef9b6863d38
SHA1 8ae66ef0dcfa72242c33e50d4ea212eeec6da814
SHA512 6cea2a1d709687398ec98992ea29d9381d8bdd92b6658fcdcf7836533424aff74bc1f7d2153ad13c8c5b1073db36502abd78eaa735d0bf847189719c06e49775
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibC56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFpesiY.exe

Path C:\Windows\System\HFpesiY.exe
Size 5.2MB
SHA256 393aa400df163a67215bc485d504bc66785d58665721f2b2b786bb5f00a9a557
MD5 fd7ca22c3614f7d0fb7b006b001bf313
SHA1 db4d6adc131328c06e139cd108b9e4e212a6bc19
SHA512 d6a4a3effc250159af8ce4fadcecceadb9b93835313b239605a523bf275c113689ff281609ac2c5cc3bc99a7078953d88d707144f71858eb82f42a66499f96e5
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibC56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IHCvwjo.exe

Path C:\Windows\System\IHCvwjo.exe
Size 5.2MB
SHA256 6265b4d1635a20ce5b9a51faca5d9ef2f357aebc3c7e88d277c1627797a9d1f2
MD5 4af60eb4f36d11420d19d7d36795211f
SHA1 a7a4364c468f5baf23d3483b2c88e94b74f471eb
SHA512 2c0d298b431f1ce0be562135e3be54565d4bf3e0956309a55fa0450f4192a5e7c5659bff6920e7e66ec6c4ba72443df3e004bfe1388c68e979e68aeadb6cd973
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibC56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

IfafHMS.exe

Path C:\Windows\System\IfafHMS.exe
Size 5.2MB
SHA256 85ab9953c14a68a8e7b66adc9ea58d94164eb83bc632571f6677471909ad4d63
MD5 64957808ba7e5c76906e37f27d21c478
SHA1 a8d47bb969a4ff1233a70df508c43c634b070190
SHA512 b8950e76b66651996e3e5ba5ce8ea7720ec198f676652de899273771fe7c54a9ba56cca58fc9d99e4cc07f0fd6e5ab159141039013298e05514cbfd8da3814dd
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibC56utgpPFotBER/mQ32lUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NXLhwPs.exe

Path C:\Windows\System\NXLhwPs.exe
Size 5.2MB
SHA256 8bd4ae7bf29f535bf60b6b76046a569842f6f98a5fb2a4c1bac323ccf62ebc5c
MD5 4560d0e2dc6d9e31df1a910d62ca498c
SHA1 50f7f1b8a6cda83026bc48db637cc41d5ae97b6a
SHA512 570e94d164fb8cfd6db9b6d6f49c9e352210d20d470f00b6f18978bf10cb4d69fa9f934c515ee214a0e858e9390302c7b4c5d9673a119f8249d3554912385443
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibC56utgpPFotBER/mQ32lU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

OefaPNE.exe

Path C:\Windows\System\OefaPNE.exe
Size 5.2MB
SHA256 7e0f4aac193ec53180c41048cb5390cef191e5dd8019e075e2d6e046fc638cc7
MD5 e55ffa43b4696e15052d6e376761ac73
SHA1 3d1b56a167c84e8612d2486b3604d6a775c9abeb
SHA512 803e3392debc1a3078ca670ef3308640c89d1a362ebd6ec38177930198895aaf0921c87fbf1e557b0681b4bdd6915ef83ea280393561ef51ca7a124d0b421f29
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibC56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ThzIGsn.exe

Path C:\Windows\System\ThzIGsn.exe
Size 5.2MB
SHA256 5d54cfae8bcedb9ed1b55dfe2a033ef6ee4c2eeef23845e9f4f8982b0a16daa6
MD5 f2946f73ba54186d6658d86ca6a9bdc9
SHA1 d2b82e1d4f441d2cc19a49c7bd29fbb26ec10bb8
SHA512 55470f112cb33f7264ca381229fa981a8af04ec40f4df9c97124d6d31ed70997026888b5fd03415e6a5fe5a8ce09997874a10802acb81216f7fef45dd0886ef6
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibC56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bOpClfr.exe

Path C:\Windows\System\bOpClfr.exe
Size 5.2MB
SHA256 aa1457ee91e79e9ec914316f0dee36ad16fc99708478bfdee8abf823ce273609
MD5 948a995c3dbb80ba00d0b3a9e1713118
SHA1 4438654c56c1dd9fb8455a0e35ae83fbf7205534
SHA512 8d3a1296464f1f99212e6d7a162aafe6fbf33cfb3103baf4f0f43503b36425e68e6da8a1e5cbfca082f2edbb375e2ccfb780ab2614ed677c266c69d703403c02
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibC56utgpPFotBER/mQ32lUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

fSLdOBQ.exe

Path C:\Windows\System\fSLdOBQ.exe
Size 5.2MB
SHA256 9324f926b7eebe2ad063c919412c1e8f19befe091d10e5dae8ae8bb866fa80ea
MD5 2643df2d1140a40a368ddc38a43f5372
SHA1 b2620c29fb9327ca188d869efee7ec8a3181423a
SHA512 3361e02ab760b4a096c4d3e32d3fca2a10ef8ae58ce35fd5e079f87fec0724ff3fb5b8bac4df05da84c54a368e22e64c8295c9798c757a5df7fb24489c2838d7
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibC56utgpPFotBER/mQ32lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jKzxBma.exe

Path C:\Windows\System\jKzxBma.exe
Size 5.2MB
SHA256 a0741478fe31f0ad7b360abf24b4f2053bfa12236cd08491ebc0b491e874496c
MD5 9d5340a86b15dad4070d1f910a319773
SHA1 7b23052a16b58eb15fc8c9ec66a9e2b72570b84a
SHA512 98722b50032894ef5905e54f3b1ce2ff26c3865ee97953c36f7f0124581fa0b609b162865d874e7083e66fa0453ee0b8d7cc763b9bc31b37a2688b0ee8103fff
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibC56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGNkhgl.exe

Path C:\Windows\System\oGNkhgl.exe
Size 5.2MB
SHA256 86ec9c45681a3362eda970d7c20f7f4050848b8bc580bb58705d297cd3cf1e4b
MD5 c5659da409bf5023284db233b11c355a
SHA1 e1f765b1dac0b4ac70ddcf509c979e00ad7f91ea
SHA512 f5044cea46db3c668410925cb7f5511929b37b4dda3fbecb46c79e3886daedadf268500d2d20e1ce298c8c2e1b2a655a992a5ac13c3b2527cd7f8cee67f13f9b
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibC56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qTgTZkC.exe

Path C:\Windows\System\qTgTZkC.exe
Size 5.2MB
SHA256 ffdd90212591541ac67cdef9a3e4fdb4e400b736ce228adc864a60f26e2317fa
MD5 d07b0dec2bb19f1c2a77be20eb385cce
SHA1 0d8ba907f1ca0f646d97755dffedf172507982af
SHA512 5f5344a18e6e48cb45efdd94f30956626765491a06fb8ef4e443028a7ee9e9cd6e192d012d96a73f50f2d70835230fb2ebfd663dc1c06124f6e4f2e5d4f94278
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibC56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

rZriQhA.exe

Path C:\Windows\System\rZriQhA.exe
Size 5.2MB
SHA256 70bf60b37ba3363a8a7a0800518ff6465e61b027024d3dd8c9a89bd99dd08b2a
MD5 be80dc17041202b8a2954e1841f8ba84
SHA1 19472b25b3e14f679e2f36621a7035600dc42304
SHA512 cc4a0ae946ef348b40158c3b0527d4b9eb9f14c2777e8184565a09a407058e45d06f203aac826fb492e414cee10a46748cf1cceaddb100ff367d9334434c811b
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibC56utgpPFotBER/mQ32lUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

uTRiIGK.exe

Path C:\Windows\System\uTRiIGK.exe
Size 5.2MB
SHA256 f08264640d032445b03dc5650f3d41c799826a749df40a9fb9eaff3bdf2371a9
MD5 e80d4ed479b84fff0b86571fa3ca369f
SHA1 3e969d2a5a2f699a488550d70903a26898c9a147
SHA512 25f7db643239c0503852597cb87fce6817c39651cfe326687c408ce63ad9e8bc6ad42c724d550f96caefaf6a34998894d47c4497128318f997eb707e1d027e9f
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibC56utgpPFotBER/mQ32lUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVjpjuq.exe

Path C:\Windows\System\vVjpjuq.exe
Size 5.2MB
SHA256 1895ae4007e1f378f269615c6677d58ecfb32aadd8c127597348afe5bf7d9a16
MD5 732343a2d1eaf18d265a2a4269f120c5
SHA1 0bba7722cee659e4a3ddd02bb938e277d04fbcaf
SHA512 193177a8d66f6c31f56c27ef72ec59878caa85959b0decf1ebd2135618b58cf4b2de0d0db33c3e528acf08e8e43215153b8ec59355ad208a979cd7193f320c44
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibC56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpPIxkj.exe

Path C:\Windows\System\xpPIxkj.exe
Size 5.2MB
SHA256 07a9a829b64f4f3d3fb5481a793e5ae911dd6ba967b25a8d78eb9a57b824b53a
MD5 24fa7886f8c96b0f8f6a2249e4cba0ee
SHA1 bcc3f9c865e35becc6ea0146d74e39f8e2adb48f
SHA512 3774fe9cba5ae20deaeb408b94a0f387c56fb17ed45b533b755913188f1477b3762c6337152f92224fa956de5f43beb6cbba93cbca69b0d211190844c0c7707d
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibC56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-32-0x00007FF782470000-0x00007FF7827C1000-memory.dmp

Download

memory/552-218-0x00007FF782470000-0x00007FF7827C1000-memory.dmp

Download

memory/552-113-0x00007FF782470000-0x00007FF7827C1000-memory.dmp

Download

memory/872-49-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp

Download

memory/872-228-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp

Download

memory/872-142-0x00007FF7D47E0000-0x00007FF7D4B31000-memory.dmp

Download

memory/892-65-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp

Download

memory/892-145-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp

Download

memory/892-239-0x00007FF6FDB70000-0x00007FF6FDEC1000-memory.dmp

Download

memory/1520-23-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp

Download

memory/1520-94-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp

Download

memory/1520-216-0x00007FF6A68B0000-0x00007FF6A6C01000-memory.dmp

Download

memory/2236-237-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp

Download

memory/2236-61-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp

Download

memory/2236-144-0x00007FF6EEFA0000-0x00007FF6EF2F1000-memory.dmp

Download

memory/2592-122-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp

Download

memory/2592-37-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp

Download

memory/2592-222-0x00007FF7B14A0000-0x00007FF7B17F1000-memory.dmp

Download

memory/2952-43-0x00007FF774800000-0x00007FF774B51000-memory.dmp

Download

memory/2952-127-0x00007FF774800000-0x00007FF774B51000-memory.dmp

Download

memory/2952-224-0x00007FF774800000-0x00007FF774B51000-memory.dmp

Download

memory/3040-153-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp

Download

memory/3040-259-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp

Download

memory/3040-121-0x00007FF7AD720000-0x00007FF7ADA71000-memory.dmp

Download

memory/3116-212-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp

Download

memory/3116-13-0x00007FF600AD0000-0x00007FF600E21000-memory.dmp

Download

memory/3168-214-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp

Download

memory/3168-29-0x00007FF747F90000-0x00007FF7482E1000-memory.dmp

Download

memory/3292-251-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp

Download

memory/3292-117-0x00007FF7F4E80000-0x00007FF7F51D1000-memory.dmp

Download

memory/3368-125-0x00007FF672940000-0x00007FF672C91000-memory.dmp

Download

memory/3368-36-0x00007FF672940000-0x00007FF672C91000-memory.dmp

Download

memory/3368-220-0x00007FF672940000-0x00007FF672C91000-memory.dmp

Download

memory/3604-146-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp

Download

memory/3604-70-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp

Download

memory/3604-243-0x00007FF76F8F0000-0x00007FF76FC41000-memory.dmp

Download

memory/4496-95-0x00007FF649550000-0x00007FF6498A1000-memory.dmp

Download

memory/4496-242-0x00007FF649550000-0x00007FF6498A1000-memory.dmp

Download

memory/4536-255-0x00007FF72D030000-0x00007FF72D381000-memory.dmp

Download

memory/4536-152-0x00007FF72D030000-0x00007FF72D381000-memory.dmp

Download

memory/4536-124-0x00007FF72D030000-0x00007FF72D381000-memory.dmp

Download

memory/4564-96-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp

Download

memory/4564-246-0x00007FF639B60000-0x00007FF639EB1000-memory.dmp

Download

memory/4632-126-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp

Download

memory/4632-155-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp

Download

memory/4632-258-0x00007FF746A80000-0x00007FF746DD1000-memory.dmp

Download

memory/4784-123-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp

Download

memory/4784-250-0x00007FF75B180000-0x00007FF75B4D1000-memory.dmp

Download

memory/4816-101-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp

Download

memory/4816-150-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp

Download

memory/4816-253-0x00007FF6C5190000-0x00007FF6C54E1000-memory.dmp

Download

memory/4936-156-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp

Download

memory/4936-134-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp

Download

memory/4936-92-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp

Download

memory/4936-0-0x00007FF6DB8B0000-0x00007FF6DBC01000-memory.dmp

Download

memory/4936-1-0x000001FEACB00000-0x000001FEACB10000-memory.dmp

Download

memory/5076-247-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp

Download

memory/5076-107-0x00007FF63AF60000-0x00007FF63B2B1000-memory.dmp

Download

memory/5092-226-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp

Download

memory/5092-143-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp

Download

memory/5092-52-0x00007FF7D7EF0000-0x00007FF7D8241000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads