cobaltstrike | 02e1f99a649c4369b935eec68ce78e0d6156d2f5ea5f70b8e522af285761497d

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-j2cn6aff8t
SHA256 02e1f99a649c4369b935eec68ce78e0d6156d2f5ea5f70b8e522af285761497d
MD5 8f4b5b3b1fade594badc0637a5fa88eb
SHA1 30b1f9849e49d6cae2caaa2ecef6db0f9bd7e134
SHA512 bdf7ce001b6ac19889bd1390073b20e7600f21c27414c8079fb0b4f0737e06bbe8c740fee7b37475cd0d2106868612c4e1c5d19e0591275da43861e48b70bfc6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0009000000023231-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023232-11.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023230-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023233-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023234-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023235-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023236-39.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023237-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023238-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023239-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323a-60.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323d-75.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323e-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023240-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023241-95.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023242-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023244-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023243-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323f-85.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323c-70.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002323b-65.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023231-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023232-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023230-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023233-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023234-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023235-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023236-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023237-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023238-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023239-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323a-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323d-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323e-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023240-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023241-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023242-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023244-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023243-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323f-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323c-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002323b-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1600-0-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	UPX
behavioral2/files/0x0009000000023231-5.dat	UPX
behavioral2/memory/2376-7-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023232-11.dat	UPX
behavioral2/files/0x0008000000023230-10.dat	UPX
behavioral2/memory/4344-16-0x00007FF759640000-0x00007FF759994000-memory.dmp	UPX
behavioral2/memory/4100-20-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023233-24.dat	UPX
behavioral2/files/0x0007000000023234-28.dat	UPX
behavioral2/files/0x0007000000023235-33.dat	UPX
behavioral2/memory/2432-34-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	UPX
behavioral2/files/0x0007000000023236-39.dat	UPX
behavioral2/files/0x0007000000023237-45.dat	UPX
behavioral2/files/0x0007000000023238-50.dat	UPX
behavioral2/files/0x0007000000023239-55.dat	UPX
behavioral2/files/0x000700000002323a-60.dat	UPX
behavioral2/files/0x000700000002323d-75.dat	UPX
behavioral2/files/0x000700000002323e-80.dat	UPX
behavioral2/files/0x0007000000023240-90.dat	UPX
behavioral2/files/0x0007000000023241-95.dat	UPX
behavioral2/files/0x0007000000023242-100.dat	UPX
behavioral2/files/0x0007000000023244-109.dat	UPX
behavioral2/files/0x0007000000023243-106.dat	UPX
behavioral2/files/0x000700000002323f-85.dat	UPX
behavioral2/files/0x000700000002323c-70.dat	UPX
behavioral2/files/0x000700000002323b-65.dat	UPX
behavioral2/memory/3908-111-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	UPX
behavioral2/memory/3160-112-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	UPX
behavioral2/memory/2116-113-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	UPX
behavioral2/memory/2344-114-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	UPX
behavioral2/memory/5056-115-0x00007FF791510000-0x00007FF791864000-memory.dmp	UPX
behavioral2/memory/2200-117-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	UPX
behavioral2/memory/5052-116-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	UPX
behavioral2/memory/4968-118-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	UPX
behavioral2/memory/3164-119-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	UPX
behavioral2/memory/2920-120-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	UPX
behavioral2/memory/1668-121-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	UPX
behavioral2/memory/1448-122-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	UPX
behavioral2/memory/4996-123-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	UPX
behavioral2/memory/4420-124-0x00007FF701B30000-0x00007FF701E84000-memory.dmp	UPX
behavioral2/memory/2900-125-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	UPX
behavioral2/memory/4176-126-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	UPX
behavioral2/memory/3904-127-0x00007FF751840000-0x00007FF751B94000-memory.dmp	UPX
behavioral2/memory/1600-128-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	UPX
behavioral2/memory/2376-129-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	UPX
behavioral2/memory/4344-130-0x00007FF759640000-0x00007FF759994000-memory.dmp	UPX
behavioral2/memory/4100-131-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	UPX
behavioral2/memory/2432-132-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	UPX
behavioral2/memory/3908-133-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	UPX
behavioral2/memory/2116-136-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	UPX
behavioral2/memory/3160-137-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	UPX
behavioral2/memory/4176-134-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	UPX
behavioral2/memory/2344-138-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	UPX
behavioral2/memory/3904-135-0x00007FF751840000-0x00007FF751B94000-memory.dmp	UPX
behavioral2/memory/4968-141-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	UPX
behavioral2/memory/2200-143-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	UPX
behavioral2/memory/1448-146-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	UPX
behavioral2/memory/3164-147-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	UPX
behavioral2/memory/1668-145-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	UPX
behavioral2/memory/5056-144-0x00007FF791510000-0x00007FF791864000-memory.dmp	UPX
behavioral2/memory/2920-142-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	UPX
behavioral2/memory/5052-140-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	UPX
behavioral2/memory/4996-139-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	UPX
behavioral2/memory/2900-148-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1600-0-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023231-5.dat	xmrig
behavioral2/memory/2376-7-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023232-11.dat	xmrig
behavioral2/files/0x0008000000023230-10.dat	xmrig
behavioral2/memory/4344-16-0x00007FF759640000-0x00007FF759994000-memory.dmp	xmrig
behavioral2/memory/4100-20-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023233-24.dat	xmrig
behavioral2/files/0x0007000000023234-28.dat	xmrig
behavioral2/files/0x0007000000023235-33.dat	xmrig
behavioral2/memory/2432-34-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023236-39.dat	xmrig
behavioral2/files/0x0007000000023237-45.dat	xmrig
behavioral2/files/0x0007000000023238-50.dat	xmrig
behavioral2/files/0x0007000000023239-55.dat	xmrig
behavioral2/files/0x000700000002323a-60.dat	xmrig
behavioral2/files/0x000700000002323d-75.dat	xmrig
behavioral2/files/0x000700000002323e-80.dat	xmrig
behavioral2/files/0x0007000000023240-90.dat	xmrig
behavioral2/files/0x0007000000023241-95.dat	xmrig
behavioral2/files/0x0007000000023242-100.dat	xmrig
behavioral2/files/0x0007000000023244-109.dat	xmrig
behavioral2/files/0x0007000000023243-106.dat	xmrig
behavioral2/files/0x000700000002323f-85.dat	xmrig
behavioral2/files/0x000700000002323c-70.dat	xmrig
behavioral2/files/0x000700000002323b-65.dat	xmrig
behavioral2/memory/3908-111-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	xmrig
behavioral2/memory/3160-112-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	xmrig
behavioral2/memory/2116-113-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	xmrig
behavioral2/memory/2344-114-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	xmrig
behavioral2/memory/5056-115-0x00007FF791510000-0x00007FF791864000-memory.dmp	xmrig
behavioral2/memory/2200-117-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	xmrig
behavioral2/memory/5052-116-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	xmrig
behavioral2/memory/4968-118-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	xmrig
behavioral2/memory/3164-119-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	xmrig
behavioral2/memory/2920-120-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	xmrig
behavioral2/memory/1668-121-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	xmrig
behavioral2/memory/1448-122-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	xmrig
behavioral2/memory/4996-123-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	xmrig
behavioral2/memory/4420-124-0x00007FF701B30000-0x00007FF701E84000-memory.dmp	xmrig
behavioral2/memory/2900-125-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	xmrig
behavioral2/memory/4176-126-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	xmrig
behavioral2/memory/3904-127-0x00007FF751840000-0x00007FF751B94000-memory.dmp	xmrig
behavioral2/memory/1600-128-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	xmrig
behavioral2/memory/2376-129-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	xmrig
behavioral2/memory/4344-130-0x00007FF759640000-0x00007FF759994000-memory.dmp	xmrig
behavioral2/memory/4100-131-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	xmrig
behavioral2/memory/2432-132-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	xmrig
behavioral2/memory/3908-133-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	xmrig
behavioral2/memory/2116-136-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	xmrig
behavioral2/memory/3160-137-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	xmrig
behavioral2/memory/4176-134-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	xmrig
behavioral2/memory/2344-138-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	xmrig
behavioral2/memory/3904-135-0x00007FF751840000-0x00007FF751B94000-memory.dmp	xmrig
behavioral2/memory/4968-141-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	xmrig
behavioral2/memory/2200-143-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	xmrig
behavioral2/memory/1448-146-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	xmrig
behavioral2/memory/3164-147-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	xmrig
behavioral2/memory/1668-145-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	xmrig
behavioral2/memory/5056-144-0x00007FF791510000-0x00007FF791864000-memory.dmp	xmrig
behavioral2/memory/2920-142-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	xmrig
behavioral2/memory/5052-140-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	xmrig
behavioral2/memory/4996-139-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	xmrig
behavioral2/memory/2900-148-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2376	NNluWON.exe
4344	wxiyvLW.exe
4100	rKqbbqD.exe
2432	BdVRThd.exe
3908	GjaGsiQ.exe
4176	zlfCEnh.exe
3904	aBLSHHR.exe
3160	ytVuAvs.exe
2116	qbzvSDN.exe
2344	jXhsMHf.exe
5056	eTySIAx.exe
5052	IKHdpAz.exe
2200	EfroWKv.exe
4968	POvGwMh.exe
3164	BgyHgTy.exe
2920	sopzAWR.exe
1668	BJHDssU.exe
1448	BxWQiOU.exe
4996	DibIrHG.exe
4420	NarRlfb.exe
2900	WTciDrw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1600-0-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	upx
behavioral2/files/0x0009000000023231-5.dat	upx
behavioral2/memory/2376-7-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	upx
behavioral2/files/0x0007000000023232-11.dat	upx
behavioral2/files/0x0008000000023230-10.dat	upx
behavioral2/memory/4344-16-0x00007FF759640000-0x00007FF759994000-memory.dmp	upx
behavioral2/memory/4100-20-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	upx
behavioral2/files/0x0007000000023233-24.dat	upx
behavioral2/files/0x0007000000023234-28.dat	upx
behavioral2/files/0x0007000000023235-33.dat	upx
behavioral2/memory/2432-34-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	upx
behavioral2/files/0x0007000000023236-39.dat	upx
behavioral2/files/0x0007000000023237-45.dat	upx
behavioral2/files/0x0007000000023238-50.dat	upx
behavioral2/files/0x0007000000023239-55.dat	upx
behavioral2/files/0x000700000002323a-60.dat	upx
behavioral2/files/0x000700000002323d-75.dat	upx
behavioral2/files/0x000700000002323e-80.dat	upx
behavioral2/files/0x0007000000023240-90.dat	upx
behavioral2/files/0x0007000000023241-95.dat	upx
behavioral2/files/0x0007000000023242-100.dat	upx
behavioral2/files/0x0007000000023244-109.dat	upx
behavioral2/files/0x0007000000023243-106.dat	upx
behavioral2/files/0x000700000002323f-85.dat	upx
behavioral2/files/0x000700000002323c-70.dat	upx
behavioral2/files/0x000700000002323b-65.dat	upx
behavioral2/memory/3908-111-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	upx
behavioral2/memory/3160-112-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	upx
behavioral2/memory/2116-113-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	upx
behavioral2/memory/2344-114-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	upx
behavioral2/memory/5056-115-0x00007FF791510000-0x00007FF791864000-memory.dmp	upx
behavioral2/memory/2200-117-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	upx
behavioral2/memory/5052-116-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	upx
behavioral2/memory/4968-118-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	upx
behavioral2/memory/3164-119-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	upx
behavioral2/memory/2920-120-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	upx
behavioral2/memory/1668-121-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	upx
behavioral2/memory/1448-122-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	upx
behavioral2/memory/4996-123-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	upx
behavioral2/memory/4420-124-0x00007FF701B30000-0x00007FF701E84000-memory.dmp	upx
behavioral2/memory/2900-125-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	upx
behavioral2/memory/4176-126-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	upx
behavioral2/memory/3904-127-0x00007FF751840000-0x00007FF751B94000-memory.dmp	upx
behavioral2/memory/1600-128-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp	upx
behavioral2/memory/2376-129-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp	upx
behavioral2/memory/4344-130-0x00007FF759640000-0x00007FF759994000-memory.dmp	upx
behavioral2/memory/4100-131-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp	upx
behavioral2/memory/2432-132-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp	upx
behavioral2/memory/3908-133-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp	upx
behavioral2/memory/2116-136-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	upx
behavioral2/memory/3160-137-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp	upx
behavioral2/memory/4176-134-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp	upx
behavioral2/memory/2344-138-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp	upx
behavioral2/memory/3904-135-0x00007FF751840000-0x00007FF751B94000-memory.dmp	upx
behavioral2/memory/4968-141-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp	upx
behavioral2/memory/2200-143-0x00007FF629080000-0x00007FF6293D4000-memory.dmp	upx
behavioral2/memory/1448-146-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	upx
behavioral2/memory/3164-147-0x00007FF64C620000-0x00007FF64C974000-memory.dmp	upx
behavioral2/memory/1668-145-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp	upx
behavioral2/memory/5056-144-0x00007FF791510000-0x00007FF791864000-memory.dmp	upx
behavioral2/memory/2920-142-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp	upx
behavioral2/memory/5052-140-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp	upx
behavioral2/memory/4996-139-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp	upx
behavioral2/memory/2900-148-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qbzvSDN.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EfroWKv.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\POvGwMh.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NarRlfb.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aBLSHHR.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ytVuAvs.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BdVRThd.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rKqbbqD.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GjaGsiQ.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zlfCEnh.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jXhsMHf.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eTySIAx.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IKHdpAz.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BgyHgTy.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NNluWON.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WTciDrw.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sopzAWR.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BJHDssU.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BxWQiOU.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DibIrHG.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wxiyvLW.exe	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2376	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	93
PID 1600 wrote to memory of 2376	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	93
PID 1600 wrote to memory of 4344	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	94
PID 1600 wrote to memory of 4344	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	94
PID 1600 wrote to memory of 4100	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	95
PID 1600 wrote to memory of 4100	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	95
PID 1600 wrote to memory of 2432	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	96
PID 1600 wrote to memory of 2432	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	96
PID 1600 wrote to memory of 3908	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	97
PID 1600 wrote to memory of 3908	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	97
PID 1600 wrote to memory of 4176	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	98
PID 1600 wrote to memory of 4176	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	98
PID 1600 wrote to memory of 3904	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	99
PID 1600 wrote to memory of 3904	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	99
PID 1600 wrote to memory of 3160	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	100
PID 1600 wrote to memory of 3160	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	100
PID 1600 wrote to memory of 2116	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	101
PID 1600 wrote to memory of 2116	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	101
PID 1600 wrote to memory of 2344	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	102
PID 1600 wrote to memory of 2344	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	102
PID 1600 wrote to memory of 5056	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	103
PID 1600 wrote to memory of 5056	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	103
PID 1600 wrote to memory of 5052	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	104
PID 1600 wrote to memory of 5052	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	104
PID 1600 wrote to memory of 2200	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	105
PID 1600 wrote to memory of 2200	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	105
PID 1600 wrote to memory of 4968	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	106
PID 1600 wrote to memory of 4968	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	106
PID 1600 wrote to memory of 3164	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	107
PID 1600 wrote to memory of 3164	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	107
PID 1600 wrote to memory of 2920	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	108
PID 1600 wrote to memory of 2920	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	108
PID 1600 wrote to memory of 1668	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	109
PID 1600 wrote to memory of 1668	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	109
PID 1600 wrote to memory of 1448	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	110
PID 1600 wrote to memory of 1448	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	110
PID 1600 wrote to memory of 4996	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	111
PID 1600 wrote to memory of 4996	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	111
PID 1600 wrote to memory of 4420	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	112
PID 1600 wrote to memory of 4420	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	112
PID 1600 wrote to memory of 2900	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	113
PID 1600 wrote to memory of 2900	1600	2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_8f4b5b3b1fade594badc0637a5fa88eb_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System\NNluWON.exe
  C:\Windows\System\NNluWON.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\wxiyvLW.exe
  C:\Windows\System\wxiyvLW.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\rKqbbqD.exe
  C:\Windows\System\rKqbbqD.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\BdVRThd.exe
  C:\Windows\System\BdVRThd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\GjaGsiQ.exe
  C:\Windows\System\GjaGsiQ.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\zlfCEnh.exe
  C:\Windows\System\zlfCEnh.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\aBLSHHR.exe
  C:\Windows\System\aBLSHHR.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\ytVuAvs.exe
  C:\Windows\System\ytVuAvs.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\qbzvSDN.exe
  C:\Windows\System\qbzvSDN.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\jXhsMHf.exe
  C:\Windows\System\jXhsMHf.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\eTySIAx.exe
  C:\Windows\System\eTySIAx.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\IKHdpAz.exe
  C:\Windows\System\IKHdpAz.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\EfroWKv.exe
  C:\Windows\System\EfroWKv.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\POvGwMh.exe
  C:\Windows\System\POvGwMh.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\BgyHgTy.exe
  C:\Windows\System\BgyHgTy.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\sopzAWR.exe
  C:\Windows\System\sopzAWR.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BJHDssU.exe
  C:\Windows\System\BJHDssU.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\BxWQiOU.exe
  C:\Windows\System\BxWQiOU.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\DibIrHG.exe
  C:\Windows\System\DibIrHG.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\NarRlfb.exe
  C:\Windows\System\NarRlfb.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\WTciDrw.exe
  C:\Windows\System\WTciDrw.exe
  2⤵
  - Executes dropped EXE
  PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BJHDssU.exe

Path C:\Windows\System\BJHDssU.exe
Size 5.9MB
SHA256 ee77a795746e1b24c4a4158c382d16f92befadff58526adc3a0caaed3d490c41
MD5 2c4b1f451f208be33f95b903a728b4d0
SHA1 04cd9f545090b040d2a9837743d826ded85a81c3
SHA512 51075dc37480be1ccae6d5ea7f1473ead0f31fb0d010072acda8d5d75e90feb4cb51ecff60877748c65d6ab6f233e591fa111593219d2fb5394f48e6ed73cf3e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

BdVRThd.exe

Path C:\Windows\System\BdVRThd.exe
Size 5.9MB
SHA256 4840a2cff28fc5fbe66d2f7181fe3e427dfb69149db939035f4b946e74bbb18c
MD5 e40ed943d8a5610ada0dbc86f8d0cc2e
SHA1 c0c0d0ec7a7a09974b6aed3a1d0d21f7d4cd46f1
SHA512 dee39754d863c4d90f559cdd39f029c11ff6fcafb6f005703b168403c7023ad7b364436115a9d6b984d4bb0eb0781f5d5bf662bfb1f3983897e877a120f0b0a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

BgyHgTy.exe

Path C:\Windows\System\BgyHgTy.exe
Size 5.9MB
SHA256 e8ed83947a3f1719671745c28999ce2023b099a4b8f8977a18fd1893093333ab
MD5 c1134e8461aa5333850b6bacb25eb1d7
SHA1 804dbe1750767f2c4a49446201f147e602d38160
SHA512 e9c7a3c9799c6f0b73a5713550fc7d717e65a1083857fb6b1f9aec65fe1ff15d68865fef0db52a38e666cb8f8b3e86fd7ef55acdac195266cc6c2be250b9cd6a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

BxWQiOU.exe

Path C:\Windows\System\BxWQiOU.exe
Size 5.9MB
SHA256 5b13096612d8b6b3566100c6546dffe05e2b919b1184dd786a4cae64148f4b04
MD5 abe5c3e7098c0795c2a376078fd9b8e4
SHA1 1d1e5aa2d51d5466fabf68d379b1b8eee6b52f49
SHA512 1a75b69a95c616c4b7f55b2b92dffae5cd88fb405be362b5bbf83db0f1c4fdeb4791c9d77b124f6d47c4ed5a11127e9ff2b66843d38769639d9f1ee675b6ba4a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

DibIrHG.exe

Path C:\Windows\System\DibIrHG.exe
Size 5.9MB
SHA256 8d188e2e89a79a48beead80513eb4adc9c8cdb2bd34e1257b46ec1883df2ab91
MD5 91791e2c4f64318746a186e72f84d4bd
SHA1 57871091fc616dddd6fdfb2da5a2f85aa35dc0bc
SHA512 32f42fa45977daeb2f0b736b09538aad44ed3de7aad70f55cff7b010b8c57731fe7ebcb2a4df1ac40a9aa740d3d0dbf60f74058947b0c53b5883aa6a524f66b8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

EfroWKv.exe

Path C:\Windows\System\EfroWKv.exe
Size 5.9MB
SHA256 c58e9b44b09658013b6bc6558c01e38be16591a35977cb19f7d88ac511d9f0ce
MD5 27838408cd8c840e5cc462645b37821c
SHA1 4578954d1346b24d25d4804c879c2bfbc7a46810
SHA512 4bf30b4b844fc786e7f5a46742e400896e1b535d2c8958f5f7facbb1aa5ec1b72a7848c0e9a08df8ade8375f723a70dced57df1b7b31a8e8852fff895b09260d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

GjaGsiQ.exe

Path C:\Windows\System\GjaGsiQ.exe
Size 5.9MB
SHA256 566b93f942d4f3c583541d77ab0b3980b3d58e4846fc053841dc9a2a00e41993
MD5 56fc0cd573397b87265bfdcd6be8518c
SHA1 20fbfdf53b92772ca2a70686137c015801d7666a
SHA512 c0fbb0c336eac4ed0080399659d33a67f31b0248f59936fa0e983aeeb11b28ddf0378683bd08936d921ac7b8660dcf9c8ceb31967982e31bcf3fef79b986b1f6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

IKHdpAz.exe

Path C:\Windows\System\IKHdpAz.exe
Size 5.9MB
SHA256 e1c426f258a0fb3d2e402d89592925c04a64cfab1e383c5fe6aec64a7a462e6b
MD5 e87aaf0d2b03c70d7b01a524008d01da
SHA1 87343af5dddc71e2d1f355e9fc91cbe1ba971b06
SHA512 0ec8da1495865c7d71229c9921f86e44c2fa734980bc57e6c76eee0f415659a34e20be06318f5f501e3d99d32f706f96937fd2d73a399a214a255981361a942d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNluWON.exe

Path C:\Windows\System\NNluWON.exe
Size 5.9MB
SHA256 ab83d90cb00a68e42490c049b6018f2d122576a7b85a94f71f1a771543ecd477
MD5 046b946632b08092437caa7bb0b4c7ff
SHA1 861eec7dbfd43518ab342ca30bd1bd8bb61954b5
SHA512 dcfd73a423105ec3e4e90301020e68acb2df5991f085ec882971e430863203d0ad04bbcdc0f96115498c70e1899a60f76e2d2f462e9453228657a3b2bc8e928b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

NarRlfb.exe

Path C:\Windows\System\NarRlfb.exe
Size 5.9MB
SHA256 245e2765e2992d85d9fe4670a1272ad928a3780ac73cbbcbfb7b3d524494de53
MD5 9f77d33c1c570e2e0e6cb9f53f35bf1f
SHA1 679cec4fe325982759bd964baa983a42f07d6f30
SHA512 84cd8ff5cc1e4254e63118f827b4db5edb4272c69c766cbe653f41daa18eeb880b3a84322169d5890abce293904a348465e42005b611280df99e0284abb3a98f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

POvGwMh.exe

Path C:\Windows\System\POvGwMh.exe
Size 5.9MB
SHA256 8a60268a3d09b76bcf3631a6d19074dce784a30f005c26f6e86121ef0b364074
MD5 7716c7f392022d2e3d7fda679e7b6fd3
SHA1 5196c11e2277e81d5266ce44b6a7cc688fda1536
SHA512 c83c05793995ca88604e77ba78e6d2614621f0c878fee295470f55deef382348f724d636f60b6a2340eb00cea73d752cf7390300f6ca5dc92a94219fc23e5df6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTciDrw.exe

Path C:\Windows\System\WTciDrw.exe
Size 5.9MB
SHA256 4b0c31b35a1ab253dea15bcefd253da96a7c885e8bc0075656873dc8e5dc1e68
MD5 d22dc21d8185b1dbc2818b561e10f97a
SHA1 cff662a6079a1f38b54d937968f531081ea56ca9
SHA512 1cb434cd2897943979c953d9acd235d49302df12092f22acca853b1543ec82485179ca430f751de80a9bed1550434ef1df52280705c51af82180994863db2f57
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

aBLSHHR.exe

Path C:\Windows\System\aBLSHHR.exe
Size 5.9MB
SHA256 6b34ca041195e72ea0b0dbadce418a01a24abaadfa1c2986cd9e82856a7b3e33
MD5 c70404865b083cec907e24b138a20200
SHA1 1472ef046c18a4e6d7525747d99944e6c26006ad
SHA512 5516dd668105c0b3c03632bf70a0503c20c8d7a53223b8b37ec914b9c83e6348bf69f813a2d0dc0875748af32a6f042fc05375cff0401d39c3205ac627f925b4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

eTySIAx.exe

Path C:\Windows\System\eTySIAx.exe
Size 5.9MB
SHA256 d62f2d7aaee7eda2aea491f129c24d1dc1cb6f80288e343836e7323dfd9560f3
MD5 ca01405113199d5a0cce0f0b60712c0a
SHA1 912f6e2ac8f058e2c0cf54c56b7db43f2920c824
SHA512 35cb9b35dcf4e17a5d2f53fb1962c02f36d46f9993f740bd59991448e4129c36c4a42923f3adaae352647cf96e969722d15b669cf7457143540d16e7dc3adace
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

jXhsMHf.exe

Path C:\Windows\System\jXhsMHf.exe
Size 5.9MB
SHA256 71499482b13e90c4f1eb91042413627197da996a486536bfb5d3cc2ed886eb09
MD5 058b94fc02d2f59e647ea8c4f29044d0
SHA1 eeb61e19f8ed5461429d93eb4b8ea729a9d658fa
SHA512 a8dcfefceb34feab9b086c376583f7d6ee3a37a66d8e4acde7e17c779d869d05849aceabbe6ac80f1d0de2eb38616f1ee016f7e5f98a7a02a6b41c86b6ea5c82
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

qbzvSDN.exe

Path C:\Windows\System\qbzvSDN.exe
Size 5.9MB
SHA256 69c837c8f100e7a2db4b709bcf4fb03d68fa6fdef42d2f01271fe0f172a96e00
MD5 4d27f4e8fcae17730598039cefc3783c
SHA1 cb805bf56f67eee42e7e7c8546d6fc18fd312989
SHA512 939618ba6b13205eb68cbc9e10886450462b4fe74e846792d7cec6af3c87dea697b59e8907aac9ca1f59cf5495236d39f833e3f58ff2504255a7e6841ac2918f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

rKqbbqD.exe

Path C:\Windows\System\rKqbbqD.exe
Size 5.9MB
SHA256 9919f2d4b5a76c562b09d2c1314f7425a6c33deb130ad76013d0c8a7d893a1de
MD5 694f83d155992630288de80ddcd8bfd2
SHA1 90404e16a28522ec595a18d0485eb7071ffe4b6e
SHA512 60227d675dc9612caaba7d37269a71bddf2c8b61e72ac4f38555c0d27e7c8056f97684a999aef1dda224043064614d90ce00c66e263fb0aeb8012981626729b9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

sopzAWR.exe

Path C:\Windows\System\sopzAWR.exe
Size 5.9MB
SHA256 5b982a5a9f7a6f5106bda24a1e0dd335f3858448d41e4e2314af3f53eee53f27
MD5 e502f179d8d3efbb883bd1f2713b811e
SHA1 85fcc091bed7353165dd20e1cb22239f70d8191f
SHA512 cbe5be94709a917bab8de6e2ffe420cc367236822b7f4245d1596fe6c266fda9b6824dd58682fe48e31371c27259ac0120b0323ccc9495ebc214d3ea5017bc4f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

wxiyvLW.exe

Path C:\Windows\System\wxiyvLW.exe
Size 5.9MB
SHA256 c282be12f4475e669296ed7c936b8210f1ea76bee14d219278909bd9e6b1e9fc
MD5 4eb6a046ffd5231a585608da88a2c8b7
SHA1 6f71132c8954af6473134d39857dceeaf3ca43a3
SHA512 80a452098600e1d5d0d42ab0f3905af7c662b9c1bfd3a6dd657857519c6c64532ffb9d522c2de3e1c4cc9bf5bef874160496ac2a0a1e0ea0179314062847b329
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

ytVuAvs.exe

Path C:\Windows\System\ytVuAvs.exe
Size 5.9MB
SHA256 dbb260507f0e1bfd9642fb92871c4c8c84fd9386ab76943ceb407b0d74e43ea7
MD5 1b0712d8f8baac5bdaba7366cd48e570
SHA1 f97f219e8539b31e2a79a6078553e4e530a98fbf
SHA512 d821f2f4c84000ec5bf11f3d05e1be6f43b2f4471d72ab055b01ef40877cd70b8c21aed8d5b6bc5e4c8ef7a94ffd711a11a765a2e3ac5968a8e75c1f88805e75
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlfCEnh.exe

Path C:\Windows\System\zlfCEnh.exe
Size 5.9MB
SHA256 44ebf8de5e5266d8cce2fae8c31b1aeda44fdaa1e2cd308215e2f2f8ac407413
MD5 d19999684d20796689929970b1752f4a
SHA1 298f1b589b1e27ae89900362bdba769bc583155e
SHA512 bddb3aee2c850a8c7d16bbf8edc299ed0a11b6907c43731552567150a11a2d33a270b11dbea644af8fa2edf1ad8492a61aebf262bde17d0b326e68e603c8cdfe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-146-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp

Download

memory/1448-122-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp

Download

memory/1600-1-0x000002B77F1F0000-0x000002B77F200000-memory.dmp

Download

memory/1600-128-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp

Download

memory/1600-0-0x00007FF6ABE60000-0x00007FF6AC1B4000-memory.dmp

Download

memory/1668-145-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp

Download

memory/1668-121-0x00007FF74D5A0000-0x00007FF74D8F4000-memory.dmp

Download

memory/2116-136-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp

Download

memory/2116-113-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp

Download

memory/2200-143-0x00007FF629080000-0x00007FF6293D4000-memory.dmp

Download

memory/2200-117-0x00007FF629080000-0x00007FF6293D4000-memory.dmp

Download

memory/2344-138-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp

Download

memory/2344-114-0x00007FF66F160000-0x00007FF66F4B4000-memory.dmp

Download

memory/2376-7-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp

Download

memory/2376-129-0x00007FF7C9170000-0x00007FF7C94C4000-memory.dmp

Download

memory/2432-132-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp

Download

memory/2432-34-0x00007FF7B8900000-0x00007FF7B8C54000-memory.dmp

Download

memory/2900-148-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp

Download

memory/2900-125-0x00007FF6DC910000-0x00007FF6DCC64000-memory.dmp

Download

memory/2920-142-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp

Download

memory/2920-120-0x00007FF7D2A10000-0x00007FF7D2D64000-memory.dmp

Download

memory/3160-112-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp

Download

memory/3160-137-0x00007FF7EBE60000-0x00007FF7EC1B4000-memory.dmp

Download

memory/3164-119-0x00007FF64C620000-0x00007FF64C974000-memory.dmp

Download

memory/3164-147-0x00007FF64C620000-0x00007FF64C974000-memory.dmp

Download

memory/3904-135-0x00007FF751840000-0x00007FF751B94000-memory.dmp

Download

memory/3904-127-0x00007FF751840000-0x00007FF751B94000-memory.dmp

Download

memory/3908-133-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp

Download

memory/3908-111-0x00007FF651D90000-0x00007FF6520E4000-memory.dmp

Download

memory/4100-131-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp

Download

memory/4100-20-0x00007FF731CA0000-0x00007FF731FF4000-memory.dmp

Download

memory/4176-126-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp

Download

memory/4176-134-0x00007FF63AF30000-0x00007FF63B284000-memory.dmp

Download

memory/4344-130-0x00007FF759640000-0x00007FF759994000-memory.dmp

Download

memory/4344-16-0x00007FF759640000-0x00007FF759994000-memory.dmp

Download

memory/4420-124-0x00007FF701B30000-0x00007FF701E84000-memory.dmp

Download

memory/4420-149-0x00007FF701B30000-0x00007FF701E84000-memory.dmp

Download

memory/4968-118-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp

Download

memory/4968-141-0x00007FF6B2920000-0x00007FF6B2C74000-memory.dmp

Download

memory/4996-139-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp

Download

memory/4996-123-0x00007FF6B86C0000-0x00007FF6B8A14000-memory.dmp

Download

memory/5052-116-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp

Download

memory/5052-140-0x00007FF7B5810000-0x00007FF7B5B64000-memory.dmp

Download

memory/5056-115-0x00007FF791510000-0x00007FF791864000-memory.dmp

Download

memory/5056-144-0x00007FF791510000-0x00007FF791864000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads