cobaltstrike | ce28e1acff585be36672b4a1d54263353009003bc796cb01bd61a51877c45036

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-j23kksff91
SHA256 ce28e1acff585be36672b4a1d54263353009003bc796cb01bd61a51877c45036
MD5 ccf3d8f2f8809a56b49cb6beacee586a
SHA1 198d113024b8a8592b0171dadece5c4ae45aed6e
SHA512 747a11b29d767815da7fbdd62648a2d2f89070b3c7a068fc22c0ff34fc4941a0c47d6e66c92fcf483d4718cf6b86d88827d48b4f73bb687912bd0ff40da4a1af
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0003000000022aa2-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023426-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-20.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-31.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-35.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-113.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-80.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-125.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0003000000022aa2-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023426-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	UPX
behavioral2/files/0x0003000000022aa2-4.dat	UPX
behavioral2/memory/4200-8-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	UPX
behavioral2/files/0x0008000000023426-11.dat	UPX
behavioral2/files/0x0007000000023427-10.dat	UPX
behavioral2/files/0x0007000000023428-20.dat	UPX
behavioral2/memory/4624-25-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	UPX
behavioral2/memory/8-29-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023429-31.dat	UPX
behavioral2/files/0x000700000002342a-35.dat	UPX
behavioral2/memory/2952-37-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-40.dat	UPX
behavioral2/files/0x000700000002342e-60.dat	UPX
behavioral2/files/0x0007000000023431-70.dat	UPX
behavioral2/files/0x0007000000023433-93.dat	UPX
behavioral2/memory/4104-98-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023434-96.dat	UPX
behavioral2/memory/1544-109-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	UPX
behavioral2/memory/4092-115-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	UPX
behavioral2/memory/4156-121-0x00007FF6265E0000-0x00007FF626934000-memory.dmp	UPX
behavioral2/files/0x0007000000023437-119.dat	UPX
behavioral2/files/0x0007000000023436-117.dat	UPX
behavioral2/memory/540-116-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	UPX
behavioral2/files/0x0007000000023438-113.dat	UPX
behavioral2/memory/4372-112-0x00007FF79A050000-0x00007FF79A3A4000-memory.dmp	UPX
behavioral2/memory/3524-110-0x00007FF682180000-0x00007FF6824D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023435-107.dat	UPX
behavioral2/memory/5088-101-0x00007FF713510000-0x00007FF713864000-memory.dmp	UPX
behavioral2/memory/388-95-0x00007FF7C1A20000-0x00007FF7C1D74000-memory.dmp	UPX
behavioral2/memory/1112-91-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	UPX
behavioral2/memory/5044-90-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-80.dat	UPX
behavioral2/files/0x000700000002342f-73.dat	UPX
behavioral2/files/0x0007000000023430-71.dat	UPX
behavioral2/memory/3612-67-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	UPX
behavioral2/memory/4604-59-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	UPX
behavioral2/memory/1332-58-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-55.dat	UPX
behavioral2/files/0x000700000002342d-50.dat	UPX
behavioral2/files/0x0007000000023439-125.dat	UPX
behavioral2/memory/3764-38-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	UPX
behavioral2/memory/624-16-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	UPX
behavioral2/memory/2780-127-0x00007FF6CECF0000-0x00007FF6CF044000-memory.dmp	UPX
behavioral2/memory/3460-128-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	UPX
behavioral2/memory/624-129-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	UPX
behavioral2/memory/2952-130-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	UPX
behavioral2/memory/4604-131-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	UPX
behavioral2/memory/1332-132-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	UPX
behavioral2/memory/4104-133-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	UPX
behavioral2/memory/4092-134-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	UPX
behavioral2/memory/540-135-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	UPX
behavioral2/memory/4200-136-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	UPX
behavioral2/memory/624-137-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	UPX
behavioral2/memory/4624-138-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	UPX
behavioral2/memory/8-139-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	UPX
behavioral2/memory/2952-140-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	UPX
behavioral2/memory/3764-141-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	UPX
behavioral2/memory/3612-142-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	UPX
behavioral2/memory/5044-144-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	UPX
behavioral2/memory/1332-143-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	UPX
behavioral2/memory/4604-145-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	UPX
behavioral2/memory/1112-147-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	UPX
behavioral2/memory/1544-146-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	UPX
behavioral2/memory/5088-148-0x00007FF713510000-0x00007FF713864000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	xmrig
behavioral2/files/0x0003000000022aa2-4.dat	xmrig
behavioral2/memory/4200-8-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	xmrig
behavioral2/files/0x0008000000023426-11.dat	xmrig
behavioral2/files/0x0007000000023427-10.dat	xmrig
behavioral2/files/0x0007000000023428-20.dat	xmrig
behavioral2/memory/4624-25-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	xmrig
behavioral2/memory/8-29-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-31.dat	xmrig
behavioral2/files/0x000700000002342a-35.dat	xmrig
behavioral2/memory/2952-37-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-40.dat	xmrig
behavioral2/files/0x000700000002342e-60.dat	xmrig
behavioral2/files/0x0007000000023431-70.dat	xmrig
behavioral2/files/0x0007000000023433-93.dat	xmrig
behavioral2/memory/4104-98-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-96.dat	xmrig
behavioral2/memory/1544-109-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	xmrig
behavioral2/memory/4092-115-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	xmrig
behavioral2/memory/4156-121-0x00007FF6265E0000-0x00007FF626934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023437-119.dat	xmrig
behavioral2/files/0x0007000000023436-117.dat	xmrig
behavioral2/memory/540-116-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-113.dat	xmrig
behavioral2/memory/4372-112-0x00007FF79A050000-0x00007FF79A3A4000-memory.dmp	xmrig
behavioral2/memory/3524-110-0x00007FF682180000-0x00007FF6824D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-107.dat	xmrig
behavioral2/memory/5088-101-0x00007FF713510000-0x00007FF713864000-memory.dmp	xmrig
behavioral2/memory/388-95-0x00007FF7C1A20000-0x00007FF7C1D74000-memory.dmp	xmrig
behavioral2/memory/1112-91-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	xmrig
behavioral2/memory/5044-90-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-80.dat	xmrig
behavioral2/files/0x000700000002342f-73.dat	xmrig
behavioral2/files/0x0007000000023430-71.dat	xmrig
behavioral2/memory/3612-67-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	xmrig
behavioral2/memory/4604-59-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	xmrig
behavioral2/memory/1332-58-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-55.dat	xmrig
behavioral2/files/0x000700000002342d-50.dat	xmrig
behavioral2/files/0x0007000000023439-125.dat	xmrig
behavioral2/memory/3764-38-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	xmrig
behavioral2/memory/624-16-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	xmrig
behavioral2/memory/2780-127-0x00007FF6CECF0000-0x00007FF6CF044000-memory.dmp	xmrig
behavioral2/memory/3460-128-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	xmrig
behavioral2/memory/624-129-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	xmrig
behavioral2/memory/2952-130-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	xmrig
behavioral2/memory/4604-131-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	xmrig
behavioral2/memory/1332-132-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	xmrig
behavioral2/memory/4104-133-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	xmrig
behavioral2/memory/4092-134-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	xmrig
behavioral2/memory/540-135-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	xmrig
behavioral2/memory/4200-136-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	xmrig
behavioral2/memory/624-137-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	xmrig
behavioral2/memory/4624-138-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	xmrig
behavioral2/memory/8-139-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	xmrig
behavioral2/memory/2952-140-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	xmrig
behavioral2/memory/3764-141-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	xmrig
behavioral2/memory/3612-142-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	xmrig
behavioral2/memory/5044-144-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	xmrig
behavioral2/memory/1332-143-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	xmrig
behavioral2/memory/4604-145-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	xmrig
behavioral2/memory/1112-147-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	xmrig
behavioral2/memory/1544-146-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	xmrig
behavioral2/memory/5088-148-0x00007FF713510000-0x00007FF713864000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4200	imhqCtA.exe
624	ktHPAVN.exe
4624	QBLdXad.exe
8	RgRufQh.exe
2952	aihbjBj.exe
3764	OpfxsZs.exe
1332	vcKJTGv.exe
4604	Hbluplz.exe
3612	VuxxfeP.exe
5044	nUWIGEC.exe
5088	MMDPjDX.exe
1544	fLdNebr.exe
1112	AhZcdBy.exe
388	qQdPSZw.exe
3524	EUDOUCR.exe
4104	NWsUvUS.exe
4372	kvmccSR.exe
540	dREzQxO.exe
4092	jOeocjW.exe
4156	DPbKNcM.exe
2780	tIsWuPq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3460-0-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	upx
behavioral2/files/0x0003000000022aa2-4.dat	upx
behavioral2/memory/4200-8-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	upx
behavioral2/files/0x0008000000023426-11.dat	upx
behavioral2/files/0x0007000000023427-10.dat	upx
behavioral2/files/0x0007000000023428-20.dat	upx
behavioral2/memory/4624-25-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	upx
behavioral2/memory/8-29-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	upx
behavioral2/files/0x0007000000023429-31.dat	upx
behavioral2/files/0x000700000002342a-35.dat	upx
behavioral2/memory/2952-37-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	upx
behavioral2/files/0x000700000002342b-40.dat	upx
behavioral2/files/0x000700000002342e-60.dat	upx
behavioral2/files/0x0007000000023431-70.dat	upx
behavioral2/files/0x0007000000023433-93.dat	upx
behavioral2/memory/4104-98-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	upx
behavioral2/files/0x0007000000023434-96.dat	upx
behavioral2/memory/1544-109-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	upx
behavioral2/memory/4092-115-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	upx
behavioral2/memory/4156-121-0x00007FF6265E0000-0x00007FF626934000-memory.dmp	upx
behavioral2/files/0x0007000000023437-119.dat	upx
behavioral2/files/0x0007000000023436-117.dat	upx
behavioral2/memory/540-116-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	upx
behavioral2/files/0x0007000000023438-113.dat	upx
behavioral2/memory/4372-112-0x00007FF79A050000-0x00007FF79A3A4000-memory.dmp	upx
behavioral2/memory/3524-110-0x00007FF682180000-0x00007FF6824D4000-memory.dmp	upx
behavioral2/files/0x0007000000023435-107.dat	upx
behavioral2/memory/5088-101-0x00007FF713510000-0x00007FF713864000-memory.dmp	upx
behavioral2/memory/388-95-0x00007FF7C1A20000-0x00007FF7C1D74000-memory.dmp	upx
behavioral2/memory/1112-91-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	upx
behavioral2/memory/5044-90-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	upx
behavioral2/files/0x0007000000023432-80.dat	upx
behavioral2/files/0x000700000002342f-73.dat	upx
behavioral2/files/0x0007000000023430-71.dat	upx
behavioral2/memory/3612-67-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	upx
behavioral2/memory/4604-59-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	upx
behavioral2/memory/1332-58-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	upx
behavioral2/files/0x000700000002342c-55.dat	upx
behavioral2/files/0x000700000002342d-50.dat	upx
behavioral2/files/0x0007000000023439-125.dat	upx
behavioral2/memory/3764-38-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	upx
behavioral2/memory/624-16-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	upx
behavioral2/memory/2780-127-0x00007FF6CECF0000-0x00007FF6CF044000-memory.dmp	upx
behavioral2/memory/3460-128-0x00007FF63A340000-0x00007FF63A694000-memory.dmp	upx
behavioral2/memory/624-129-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	upx
behavioral2/memory/2952-130-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	upx
behavioral2/memory/4604-131-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	upx
behavioral2/memory/1332-132-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	upx
behavioral2/memory/4104-133-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp	upx
behavioral2/memory/4092-134-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp	upx
behavioral2/memory/540-135-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp	upx
behavioral2/memory/4200-136-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp	upx
behavioral2/memory/624-137-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp	upx
behavioral2/memory/4624-138-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp	upx
behavioral2/memory/8-139-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp	upx
behavioral2/memory/2952-140-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp	upx
behavioral2/memory/3764-141-0x00007FF680570000-0x00007FF6808C4000-memory.dmp	upx
behavioral2/memory/3612-142-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp	upx
behavioral2/memory/5044-144-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp	upx
behavioral2/memory/1332-143-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp	upx
behavioral2/memory/4604-145-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp	upx
behavioral2/memory/1112-147-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp	upx
behavioral2/memory/1544-146-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp	upx
behavioral2/memory/5088-148-0x00007FF713510000-0x00007FF713864000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\Hbluplz.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MMDPjDX.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EUDOUCR.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vcKJTGv.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aihbjBj.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kvmccSR.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dREzQxO.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RgRufQh.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nUWIGEC.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AhZcdBy.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qQdPSZw.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NWsUvUS.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jOeocjW.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tIsWuPq.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OpfxsZs.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ktHPAVN.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QBLdXad.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VuxxfeP.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fLdNebr.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DPbKNcM.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\imhqCtA.exe	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4200	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	86
PID 3460 wrote to memory of 4200	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	86
PID 3460 wrote to memory of 624	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	87
PID 3460 wrote to memory of 624	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	87
PID 3460 wrote to memory of 4624	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	88
PID 3460 wrote to memory of 4624	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	88
PID 3460 wrote to memory of 8	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	89
PID 3460 wrote to memory of 8	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	89
PID 3460 wrote to memory of 2952	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	90
PID 3460 wrote to memory of 2952	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	90
PID 3460 wrote to memory of 3764	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	91
PID 3460 wrote to memory of 3764	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	91
PID 3460 wrote to memory of 1332	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	92
PID 3460 wrote to memory of 1332	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	92
PID 3460 wrote to memory of 4604	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	93
PID 3460 wrote to memory of 4604	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	93
PID 3460 wrote to memory of 3612	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	94
PID 3460 wrote to memory of 3612	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	94
PID 3460 wrote to memory of 5044	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	95
PID 3460 wrote to memory of 5044	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	95
PID 3460 wrote to memory of 1544	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	96
PID 3460 wrote to memory of 1544	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	96
PID 3460 wrote to memory of 5088	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	97
PID 3460 wrote to memory of 5088	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	97
PID 3460 wrote to memory of 1112	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	98
PID 3460 wrote to memory of 1112	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	98
PID 3460 wrote to memory of 388	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	99
PID 3460 wrote to memory of 388	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	99
PID 3460 wrote to memory of 3524	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	100
PID 3460 wrote to memory of 3524	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	100
PID 3460 wrote to memory of 4104	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	101
PID 3460 wrote to memory of 4104	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	101
PID 3460 wrote to memory of 4372	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	102
PID 3460 wrote to memory of 4372	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	102
PID 3460 wrote to memory of 540	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	103
PID 3460 wrote to memory of 540	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	103
PID 3460 wrote to memory of 4092	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	104
PID 3460 wrote to memory of 4092	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	104
PID 3460 wrote to memory of 4156	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	105
PID 3460 wrote to memory of 4156	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	105
PID 3460 wrote to memory of 2780	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	106
PID 3460 wrote to memory of 2780	3460	2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ccf3d8f2f8809a56b49cb6beacee586a_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\System\imhqCtA.exe
  C:\Windows\System\imhqCtA.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\ktHPAVN.exe
  C:\Windows\System\ktHPAVN.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\QBLdXad.exe
  C:\Windows\System\QBLdXad.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\RgRufQh.exe
  C:\Windows\System\RgRufQh.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\aihbjBj.exe
  C:\Windows\System\aihbjBj.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\OpfxsZs.exe
  C:\Windows\System\OpfxsZs.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\vcKJTGv.exe
  C:\Windows\System\vcKJTGv.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\Hbluplz.exe
  C:\Windows\System\Hbluplz.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\VuxxfeP.exe
  C:\Windows\System\VuxxfeP.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\nUWIGEC.exe
  C:\Windows\System\nUWIGEC.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\fLdNebr.exe
  C:\Windows\System\fLdNebr.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\MMDPjDX.exe
  C:\Windows\System\MMDPjDX.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\AhZcdBy.exe
  C:\Windows\System\AhZcdBy.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\qQdPSZw.exe
  C:\Windows\System\qQdPSZw.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\EUDOUCR.exe
  C:\Windows\System\EUDOUCR.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\NWsUvUS.exe
  C:\Windows\System\NWsUvUS.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\kvmccSR.exe
  C:\Windows\System\kvmccSR.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\dREzQxO.exe
  C:\Windows\System\dREzQxO.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\jOeocjW.exe
  C:\Windows\System\jOeocjW.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\DPbKNcM.exe
  C:\Windows\System\DPbKNcM.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\tIsWuPq.exe
  C:\Windows\System\tIsWuPq.exe
  2⤵
  - Executes dropped EXE
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhZcdBy.exe

Path C:\Windows\System\AhZcdBy.exe
Size 5.9MB
SHA256 c03d3b8483edfef6f578d5d8593556ff4aeef16c2c8ab71d9217e36e0f1a6a31
MD5 9c132b6075e1d79f3ccbfa1b7a1b38f0
SHA1 9276c80e699382552c52af259d88fce64901392d
SHA512 9c6be996878ec2d527451484ee50bfe116f21ad0d64ae0b56d3625c5eb73e6dea144c178a5c225626516a94e0f96dc16b0d2dfd20ae206e5a17e853f209564df
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

DPbKNcM.exe

Path C:\Windows\System\DPbKNcM.exe
Size 5.9MB
SHA256 833c8e0dc7958381f3bafbcd7a45cfc8a4dc6f4f5fc8a97639ebecaf7da0d774
MD5 4b5bfd5e3bee52bb78edf864327ae694
SHA1 de9e73739ed9a6ff08d2b9dd676aaea02dfbe79d
SHA512 680be28360ace709dda31e0fea6ffc20c408347193b38559c1d6580764814fe73d8a54cbe4d6eb4b0514d6d288fcf6bcee6a09eae75eb62c5b9264768e20303f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

EUDOUCR.exe

Path C:\Windows\System\EUDOUCR.exe
Size 5.9MB
SHA256 302489628a1d039f7f5744c18a3c823ebce9c39cfc88e36b89a87e8f284db89d
MD5 1330353f7320d3152c85445719f8e2b9
SHA1 621f5d37bf472f8c76abfe8c02c874a3741bb1d7
SHA512 357e93ddd91c6737e8574116f2ec514695149bc158a36c2d07826a523778698527e3d378092d8ca7624f99c9874aa80b30cf78749ff74c691acc4e94b488bc33
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbluplz.exe

Path C:\Windows\System\Hbluplz.exe
Size 5.9MB
SHA256 5bb46402f096b60a7ac3891416703e66373aea17e0a860c06d2bc3b4d53b9cd5
MD5 5afd5f24f1d54f9fc1002d11c91da9e4
SHA1 513394aac82a81a8c3d154aabab814fb91cb5a24
SHA512 9c198080d16f446f27eb24200756a1e4ad2da130c1c175f7ec76909084f7e0b6121165435d34c247105354b34624901cddb217f8f2981256f663c602afb2f878
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMDPjDX.exe

Path C:\Windows\System\MMDPjDX.exe
Size 5.9MB
SHA256 8d6d21dfb3475fc3043db532443aa1b827b2eab5d9598d06ba7bf58abd48a811
MD5 c60f22cc1802e06e68220555ef71cea2
SHA1 8e4a513b4370ee97275164a52ecbcda19c48a72c
SHA512 168d8073fd06136dd81ba0f0fef556fe0d47490c6294b9a73bacf1713b605e5dabe45333e6e5ec9666be3320ae1b5912f564370a784de5daa563848a81038b4c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

NWsUvUS.exe

Path C:\Windows\System\NWsUvUS.exe
Size 5.9MB
SHA256 888d958cd59282edfccd193e675b83d63996b7d8b9507bd3d7fa1e1d0323e2a2
MD5 18cceba0655609ba4ed888d6b9b580f6
SHA1 25bcfe3a93acac992458760bce9e8edd8e6732f1
SHA512 44cc0059547d9aebc51f2caa74cda7bc1cbf09d6d098d494059dc5e136ac2cf2f10bee003d5ca34432efe2bbd1596f824e1f7f245c22bfa9327a3bc29096f64a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

OpfxsZs.exe

Path C:\Windows\System\OpfxsZs.exe
Size 5.9MB
SHA256 edf21cf4b9082c2eb023d564f82d4fd7833e521964eae4e1fc6f76ae381bd70c
MD5 8d43496179362ed8af156ef683630c6b
SHA1 5aea0f3b498bc9f82736ca92f935dd4a06e14250
SHA512 fea676675c1b64484af490455547bac8fe93e26bc6456a1ed05248298df22cc6dcc4e834530fdc0581aa1e1f109c45b57a0e8431bb3433549bbb71e0d08b79cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

QBLdXad.exe

Path C:\Windows\System\QBLdXad.exe
Size 5.9MB
SHA256 c2308ff8caccc5861a01f7197fa7e56c9bb65072b4e7cae13f348d54b1ee9fe4
MD5 a1db094fc867c8f37b959d81792ec7fd
SHA1 35f6a274e5f8711d7141529cad6a9e331418df66
SHA512 879b29f051eae0326f081acca8da6a363678cc2e46faaac89868946bd010aae808806d929b2aa144e4bec98d43fbe07de48a2f7fc7dc3d6ff1f3d2b2b362043c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

RgRufQh.exe

Path C:\Windows\System\RgRufQh.exe
Size 5.9MB
SHA256 023f343ae5b6b167dcf67551cf3caaaea511b578afa3bf1eb9e76f7903bb0eb3
MD5 46a13a2d2c0f4f530845e2599e36c644
SHA1 e38c32262b5d4435f00bc890b949564e7a489fd1
SHA512 a5792b15b6ccb389cf3db8433f9c83268f0ba3c3f5bc0d827d0504057d4107e7eab4a004d740d921d98d1f44a749c22a4fd544ce61e095e941fede8ca51d47d9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

VuxxfeP.exe

Path C:\Windows\System\VuxxfeP.exe
Size 5.9MB
SHA256 dca1746c2a4a747d1a5b17de10efeeae5b4231b9e7f4b2b74aeaf30ea5f17006
MD5 67d9a4533fd9d4a44e9f24d2726b2eea
SHA1 4ccac88a5051f13815a0bb9cc0ec8b99e74f1e85
SHA512 ca1101b8079d970d6e85d87bec8d17016bf096851f3199309b7e718be996c4eccf56cdd776fa02982ea47c6295a29752be716d180fb875da25e97ebd428f9209
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

aihbjBj.exe

Path C:\Windows\System\aihbjBj.exe
Size 5.9MB
SHA256 dd1541dcbebad2ff567fcd1978d337338297792a28192ce3d0e86303d1aa5904
MD5 c5e5751711e9a06dadca893f7ce3abb2
SHA1 7bb8d00a2e132e8fc42ae39f6a6f447cbbb705cc
SHA512 f0a771d45b6e79dafdee521d098098404ddf4cb6987c526ca675cd275c1f291af992e1de709ea80a8865cee1bf3066c3cbb6caae0ab651b3770dd28c8a830b57
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

dREzQxO.exe

Path C:\Windows\System\dREzQxO.exe
Size 5.9MB
SHA256 9b9f9855a70b146fc66139b75893f5a7183d46321822c1f6aefff98d964f3c93
MD5 6c89d9ed11c44cd70231924172ba4935
SHA1 a3a33c8c24af9233d0372a9f6a2c2816fc37ef00
SHA512 04bfbe4031966ae3f3050550add6222399f1cde9de153a5662b9a89c07cd18f00a96308fe4149e311ab6cf04165d3568d604f047c7b8863f0f42d852837872d3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLdNebr.exe

Path C:\Windows\System\fLdNebr.exe
Size 5.9MB
SHA256 2509b906907c7f4a537b45aafc77a70c078c1d005e3321f1d0ad9efd4734389b
MD5 834896f16f16e65a19d77ba800c124f3
SHA1 63b5560d52baaaacd53a4a1e03cbc62e1a7451bb
SHA512 00830a34a46eb6ac24636e08d233b6bf0ecfb4594cbebcaf3145bc02b97f37586da72442de8345f3f7256d2fa9a66541ac7e0774cf75fc9041e810d5b106fc18
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

imhqCtA.exe

Path C:\Windows\System\imhqCtA.exe
Size 5.9MB
SHA256 bdcd392da04b40e634d697c26bc41c7fd3dfb2b3c0eee80fefd09eb8b57ce120
MD5 e2194147ceea36c2fcaec7fea5477e5a
SHA1 164d17c341767087aba8a872b2803f79a4819856
SHA512 d7b9e60158f46a5281c7306ecc26a04e5493f9bad267f93b2762b21e0549fba65d7e57c55e2640d40b75562ed6ec9738da1f8838e627f9f1a66b7f36ddb8d0ec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

jOeocjW.exe

Path C:\Windows\System\jOeocjW.exe
Size 5.9MB
SHA256 bf9e1e90f2392243a118b1d4ccd2d8e8bb4aaf07d1ecb466d3b30972102e74fc
MD5 5123d66aecf664baf8710a3d4b87549d
SHA1 e13ea456117673bf2db7e33a04e397e5c33cb3e1
SHA512 2e4a5a98f235f4562899fdcc2d1201236734a37133d2e0b4726f6ff7f7916e7fac5fe44547a967bf26cc0cc145a2aac4eb14938436534849d685d44ac5e22cf2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

ktHPAVN.exe

Path C:\Windows\System\ktHPAVN.exe
Size 5.9MB
SHA256 0d79115a2a8efb310cf5f52e897f0ea006461a620a8f1be1e1f684ac936c2e0f
MD5 b4005d4e410dd66b8452e17d8dc7d311
SHA1 6e03bfa41ab689cb1e206094916e0a3902f74bbe
SHA512 b46c25ed988694b3e6ac4782172201d022a220504111d0b0edb51eeb4cfcad484bdd5bb5723575843dbd31c71fd076ef00d2fca5427c5ea7638baa4b9ef705da
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvmccSR.exe

Path C:\Windows\System\kvmccSR.exe
Size 5.9MB
SHA256 4648618a75802d155103962f48a17f77266263aca91a1cf5adec199bc1a31373
MD5 a37f78ab3311a711025bbd54c7b46b9f
SHA1 e7dc15561b10a2fdeb58e730b3137ef1d27e08cd
SHA512 30a660d0a6b6e238f08bab5650f30bb9038e54bb31e7b04bbe0389f56f1ecfd824a6195bbcd5425a93788398162ee4b64234d04726e9816fed0131548d5fed78
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

nUWIGEC.exe

Path C:\Windows\System\nUWIGEC.exe
Size 5.9MB
SHA256 ab59f04288355668ad57b92afd4f51d06b0234909784868d3420a40898f1b843
MD5 4186709e467b8af81e9edff1e3694a84
SHA1 4ff0702f66b5c6cff8dac115479804bad3a78d10
SHA512 06f4e833037b9f1f2f7dedad930f22553df6e1c5baefd2f710de87183b57298c0370a6c2a7aeb5946686605b1a85c6fc9d1d4d87ee55e6f31ea9d38e94c86455
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qQdPSZw.exe

Path C:\Windows\System\qQdPSZw.exe
Size 5.9MB
SHA256 85b81af69902eca561dfc6b8fcba8f0575570fbb7bf936f242b9aa1f5a8a0f52
MD5 284b05f80ccac5778c0d1b67eae1194a
SHA1 4b39ccab0d6be3bc36777d907c62e35548534613
SHA512 7abdd7f38ebb2b34587e473356f1c4d3a8742980530d5a3e12dfc52c19b13718ca2f9e8469302135d61806cceb02c3fb71e4ce0fff0190b1df665c21302846e4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

tIsWuPq.exe

Path C:\Windows\System\tIsWuPq.exe
Size 5.9MB
SHA256 876dec8164b25d96e11eb83a2e159182b49d7411a899b25d9e104dcd7e83d9e3
MD5 8b1a34a7d975199bba5ddc511954a40d
SHA1 501353d226d969a94db039cf5879032ae6804edc
SHA512 cdd9c2098f932c807c5bfd147d0ed2925cb290cd4b3b99ee8996082dffb9f936147312e1f690910c80990aef6125bcd66a7874a5d141443e0224eece57ed9287
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcKJTGv.exe

Path C:\Windows\System\vcKJTGv.exe
Size 5.9MB
SHA256 dc6a643a4d0245a30c9061f7e2d0d65d0aad1e6aa47af100f7503b4b39a9880b
MD5 e69e2889f270a21f8ab4218dc62074ca
SHA1 bf72bbfcb0ec15c086c260efc99a1c29a59e938d
SHA512 efda2981381d7757dbd7f8f98174c823a14da5c3bc87d6205e71385c6a40c2081d27d5ce16695b52a0bf46abd5e16ac636c83b220176180686c4a1e1836a91d2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-29-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp

Download

memory/8-139-0x00007FF6D3090000-0x00007FF6D33E4000-memory.dmp

Download

memory/388-95-0x00007FF7C1A20000-0x00007FF7C1D74000-memory.dmp

Download

memory/388-149-0x00007FF7C1A20000-0x00007FF7C1D74000-memory.dmp

Download

memory/540-116-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp

Download

memory/540-135-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp

Download

memory/540-154-0x00007FF74C6E0000-0x00007FF74CA34000-memory.dmp

Download

memory/624-129-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp

Download

memory/624-16-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp

Download

memory/624-137-0x00007FF71FCA0000-0x00007FF71FFF4000-memory.dmp

Download

memory/1112-91-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp

Download

memory/1112-147-0x00007FF6B9050000-0x00007FF6B93A4000-memory.dmp

Download

memory/1332-143-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp

Download

memory/1332-58-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp

Download

memory/1332-132-0x00007FF74F4B0000-0x00007FF74F804000-memory.dmp

Download

memory/1544-109-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp

Download

memory/1544-146-0x00007FF74E280000-0x00007FF74E5D4000-memory.dmp

Download

memory/2780-127-0x00007FF6CECF0000-0x00007FF6CF044000-memory.dmp

Download

memory/2780-156-0x00007FF6CECF0000-0x00007FF6CF044000-memory.dmp

Download

memory/2952-37-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp

Download

memory/2952-130-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp

Download

memory/2952-140-0x00007FF6069F0000-0x00007FF606D44000-memory.dmp

Download

memory/3460-1-0x0000026797440000-0x0000026797450000-memory.dmp

Download

memory/3460-128-0x00007FF63A340000-0x00007FF63A694000-memory.dmp

Download

memory/3460-0-0x00007FF63A340000-0x00007FF63A694000-memory.dmp

Download

memory/3524-110-0x00007FF682180000-0x00007FF6824D4000-memory.dmp

Download

memory/3524-150-0x00007FF682180000-0x00007FF6824D4000-memory.dmp

Download

memory/3612-67-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp

Download

memory/3612-142-0x00007FF68DBF0000-0x00007FF68DF44000-memory.dmp

Download

memory/3764-38-0x00007FF680570000-0x00007FF6808C4000-memory.dmp

Download

memory/3764-141-0x00007FF680570000-0x00007FF6808C4000-memory.dmp

Download

memory/4092-155-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp

Download

memory/4092-134-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp

Download

memory/4092-115-0x00007FF64A2A0000-0x00007FF64A5F4000-memory.dmp

Download

memory/4104-98-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp

Download

memory/4104-151-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp

Download

memory/4104-133-0x00007FF74AF80000-0x00007FF74B2D4000-memory.dmp

Download

memory/4156-121-0x00007FF6265E0000-0x00007FF626934000-memory.dmp

Download

memory/4156-153-0x00007FF6265E0000-0x00007FF626934000-memory.dmp

Download

memory/4200-136-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp

Download

memory/4200-8-0x00007FF624AB0000-0x00007FF624E04000-memory.dmp

Download

memory/4372-152-0x00007FF79A050000-0x00007FF79A3A4000-memory.dmp

Download

memory/4372-112-0x00007FF79A050000-0x00007FF79A3A4000-memory.dmp

Download

memory/4604-145-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp

Download

memory/4604-131-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp

Download

memory/4604-59-0x00007FF66D800000-0x00007FF66DB54000-memory.dmp

Download

memory/4624-25-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp

Download

memory/4624-138-0x00007FF734DA0000-0x00007FF7350F4000-memory.dmp

Download

memory/5044-144-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp

Download

memory/5044-90-0x00007FF6AF810000-0x00007FF6AFB64000-memory.dmp

Download

memory/5088-148-0x00007FF713510000-0x00007FF713864000-memory.dmp

Download

memory/5088-101-0x00007FF713510000-0x00007FF713864000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads