cobaltstrike | 5dc81df51489be776eae2617bc2295757cab331ec278493a0801342de1948b82

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-jl2ncafc3v
SHA256 5dc81df51489be776eae2617bc2295757cab331ec278493a0801342de1948b82
MD5 643e51f930928cfa958356b8601631f5
SHA1 81b919deae4316cfebbeb3c98bbc45cb1e8aab86
SHA512 8a99434a297cbd06dbb787e13beba77cdc05b6cf6d043d26203155b21badb408313a65f56750811b0acf43cc2718da45ffaf7fe27b63b6d9dc98c192f4070813
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023247-4.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002324d-12.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002324c-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324f-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023250-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023252-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023253-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023255-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023257-62.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023256-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023254-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023258-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023259-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325a-83.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325b-88.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325c-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325d-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325e-103.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325f-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023261-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023260-115.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023247-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002324d-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002324c-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324f-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023250-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023252-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023253-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023255-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023257-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023256-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023254-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023258-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023259-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325a-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325b-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325c-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325d-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325e-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325f-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023261-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023260-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1844-0-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	UPX
behavioral2/files/0x0008000000023247-4.dat	UPX
behavioral2/memory/3360-8-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	UPX
behavioral2/files/0x000900000002324d-12.dat	UPX
behavioral2/memory/4712-14-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	UPX
behavioral2/files/0x000800000002324c-10.dat	UPX
behavioral2/memory/4624-19-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	UPX
behavioral2/files/0x000700000002324f-22.dat	UPX
behavioral2/memory/3772-26-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023250-29.dat	UPX
behavioral2/memory/4952-32-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023252-35.dat	UPX
behavioral2/files/0x0007000000023253-41.dat	UPX
behavioral2/memory/1492-40-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	UPX
behavioral2/memory/3688-47-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	UPX
behavioral2/memory/1872-50-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	UPX
behavioral2/files/0x0007000000023255-53.dat	UPX
behavioral2/files/0x0007000000023257-62.dat	UPX
behavioral2/files/0x0007000000023256-59.dat	UPX
behavioral2/memory/1844-63-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	UPX
behavioral2/memory/400-65-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	UPX
behavioral2/memory/2916-66-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	UPX
behavioral2/memory/3732-58-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023254-46.dat	UPX
behavioral2/files/0x0007000000023258-73.dat	UPX
behavioral2/files/0x0007000000023259-78.dat	UPX
behavioral2/files/0x000700000002325a-83.dat	UPX
behavioral2/files/0x000700000002325b-88.dat	UPX
behavioral2/files/0x000700000002325c-93.dat	UPX
behavioral2/files/0x000700000002325d-98.dat	UPX
behavioral2/files/0x000700000002325e-103.dat	UPX
behavioral2/files/0x000700000002325f-108.dat	UPX
behavioral2/files/0x0007000000023261-117.dat	UPX
behavioral2/files/0x0007000000023260-115.dat	UPX
behavioral2/memory/3360-119-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	UPX
behavioral2/memory/2492-120-0x00007FF659CB0000-0x00007FF65A004000-memory.dmp	UPX
behavioral2/memory/1600-121-0x00007FF6D6FF0000-0x00007FF6D7344000-memory.dmp	UPX
behavioral2/memory/3464-122-0x00007FF7209B0000-0x00007FF720D04000-memory.dmp	UPX
behavioral2/memory/852-123-0x00007FF6EB720000-0x00007FF6EBA74000-memory.dmp	UPX
behavioral2/memory/2420-124-0x00007FF61A4D0000-0x00007FF61A824000-memory.dmp	UPX
behavioral2/memory/1968-125-0x00007FF719E80000-0x00007FF71A1D4000-memory.dmp	UPX
behavioral2/memory/1824-126-0x00007FF6ABF50000-0x00007FF6AC2A4000-memory.dmp	UPX
behavioral2/memory/3428-127-0x00007FF6369E0000-0x00007FF636D34000-memory.dmp	UPX
behavioral2/memory/2204-128-0x00007FF71A290000-0x00007FF71A5E4000-memory.dmp	UPX
behavioral2/memory/1388-129-0x00007FF7FDB80000-0x00007FF7FDED4000-memory.dmp	UPX
behavioral2/memory/4712-130-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	UPX
behavioral2/memory/4624-131-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	UPX
behavioral2/memory/3772-132-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	UPX
behavioral2/memory/4952-133-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	UPX
behavioral2/memory/1492-134-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	UPX
behavioral2/memory/3688-135-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	UPX
behavioral2/memory/3360-136-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	UPX
behavioral2/memory/4712-137-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	UPX
behavioral2/memory/4624-138-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	UPX
behavioral2/memory/3772-139-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	UPX
behavioral2/memory/400-140-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	UPX
behavioral2/memory/2916-141-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	UPX
behavioral2/memory/4952-142-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	UPX
behavioral2/memory/1492-143-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	UPX
behavioral2/memory/1872-144-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	UPX
behavioral2/memory/3688-145-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	UPX
behavioral2/memory/3732-146-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	UPX
behavioral2/memory/400-147-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	UPX
behavioral2/memory/2916-148-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1844-0-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	xmrig
behavioral2/files/0x0008000000023247-4.dat	xmrig
behavioral2/memory/3360-8-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	xmrig
behavioral2/files/0x000900000002324d-12.dat	xmrig
behavioral2/memory/4712-14-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	xmrig
behavioral2/files/0x000800000002324c-10.dat	xmrig
behavioral2/memory/4624-19-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002324f-22.dat	xmrig
behavioral2/memory/3772-26-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023250-29.dat	xmrig
behavioral2/memory/4952-32-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-35.dat	xmrig
behavioral2/files/0x0007000000023253-41.dat	xmrig
behavioral2/memory/1492-40-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	xmrig
behavioral2/memory/3688-47-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	xmrig
behavioral2/memory/1872-50-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023255-53.dat	xmrig
behavioral2/files/0x0007000000023257-62.dat	xmrig
behavioral2/files/0x0007000000023256-59.dat	xmrig
behavioral2/memory/1844-63-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	xmrig
behavioral2/memory/400-65-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	xmrig
behavioral2/memory/2916-66-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	xmrig
behavioral2/memory/3732-58-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-46.dat	xmrig
behavioral2/files/0x0007000000023258-73.dat	xmrig
behavioral2/files/0x0007000000023259-78.dat	xmrig
behavioral2/files/0x000700000002325a-83.dat	xmrig
behavioral2/files/0x000700000002325b-88.dat	xmrig
behavioral2/files/0x000700000002325c-93.dat	xmrig
behavioral2/files/0x000700000002325d-98.dat	xmrig
behavioral2/files/0x000700000002325e-103.dat	xmrig
behavioral2/files/0x000700000002325f-108.dat	xmrig
behavioral2/files/0x0007000000023261-117.dat	xmrig
behavioral2/files/0x0007000000023260-115.dat	xmrig
behavioral2/memory/3360-119-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	xmrig
behavioral2/memory/2492-120-0x00007FF659CB0000-0x00007FF65A004000-memory.dmp	xmrig
behavioral2/memory/1600-121-0x00007FF6D6FF0000-0x00007FF6D7344000-memory.dmp	xmrig
behavioral2/memory/3464-122-0x00007FF7209B0000-0x00007FF720D04000-memory.dmp	xmrig
behavioral2/memory/852-123-0x00007FF6EB720000-0x00007FF6EBA74000-memory.dmp	xmrig
behavioral2/memory/2420-124-0x00007FF61A4D0000-0x00007FF61A824000-memory.dmp	xmrig
behavioral2/memory/1968-125-0x00007FF719E80000-0x00007FF71A1D4000-memory.dmp	xmrig
behavioral2/memory/1824-126-0x00007FF6ABF50000-0x00007FF6AC2A4000-memory.dmp	xmrig
behavioral2/memory/3428-127-0x00007FF6369E0000-0x00007FF636D34000-memory.dmp	xmrig
behavioral2/memory/2204-128-0x00007FF71A290000-0x00007FF71A5E4000-memory.dmp	xmrig
behavioral2/memory/1388-129-0x00007FF7FDB80000-0x00007FF7FDED4000-memory.dmp	xmrig
behavioral2/memory/4712-130-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	xmrig
behavioral2/memory/4624-131-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	xmrig
behavioral2/memory/3772-132-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	xmrig
behavioral2/memory/4952-133-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	xmrig
behavioral2/memory/1492-134-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	xmrig
behavioral2/memory/3688-135-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	xmrig
behavioral2/memory/3360-136-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	xmrig
behavioral2/memory/4712-137-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	xmrig
behavioral2/memory/4624-138-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	xmrig
behavioral2/memory/3772-139-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	xmrig
behavioral2/memory/400-140-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	xmrig
behavioral2/memory/2916-141-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	xmrig
behavioral2/memory/4952-142-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	xmrig
behavioral2/memory/1492-143-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	xmrig
behavioral2/memory/1872-144-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	xmrig
behavioral2/memory/3688-145-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	xmrig
behavioral2/memory/3732-146-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	xmrig
behavioral2/memory/400-147-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	xmrig
behavioral2/memory/2916-148-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3360	lfObCVw.exe
4712	bYmYzjB.exe
4624	lUZcLhx.exe
3772	pjtWXlL.exe
4952	zyqNgPP.exe
1492	QBqvfqR.exe
3688	RkJgLHu.exe
1872	AoZBpWm.exe
3732	zDEecei.exe
400	zKHNRri.exe
2916	nPQTvMH.exe
2492	wVCqOTM.exe
1600	YPXpQhR.exe
3464	JkpcOSV.exe
852	maCZpsk.exe
2420	zKbwWyX.exe
1968	jQjBhsN.exe
1824	xXTHDiM.exe
3428	svbTJyA.exe
2204	YSjYEfa.exe
1388	ozlAkgI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1844-0-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	upx
behavioral2/files/0x0008000000023247-4.dat	upx
behavioral2/memory/3360-8-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	upx
behavioral2/files/0x000900000002324d-12.dat	upx
behavioral2/memory/4712-14-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	upx
behavioral2/files/0x000800000002324c-10.dat	upx
behavioral2/memory/4624-19-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	upx
behavioral2/files/0x000700000002324f-22.dat	upx
behavioral2/memory/3772-26-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	upx
behavioral2/files/0x0007000000023250-29.dat	upx
behavioral2/memory/4952-32-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	upx
behavioral2/files/0x0007000000023252-35.dat	upx
behavioral2/files/0x0007000000023253-41.dat	upx
behavioral2/memory/1492-40-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	upx
behavioral2/memory/3688-47-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	upx
behavioral2/memory/1872-50-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	upx
behavioral2/files/0x0007000000023255-53.dat	upx
behavioral2/files/0x0007000000023257-62.dat	upx
behavioral2/files/0x0007000000023256-59.dat	upx
behavioral2/memory/1844-63-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp	upx
behavioral2/memory/400-65-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	upx
behavioral2/memory/2916-66-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	upx
behavioral2/memory/3732-58-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	upx
behavioral2/files/0x0007000000023254-46.dat	upx
behavioral2/files/0x0007000000023258-73.dat	upx
behavioral2/files/0x0007000000023259-78.dat	upx
behavioral2/files/0x000700000002325a-83.dat	upx
behavioral2/files/0x000700000002325b-88.dat	upx
behavioral2/files/0x000700000002325c-93.dat	upx
behavioral2/files/0x000700000002325d-98.dat	upx
behavioral2/files/0x000700000002325e-103.dat	upx
behavioral2/files/0x000700000002325f-108.dat	upx
behavioral2/files/0x0007000000023261-117.dat	upx
behavioral2/files/0x0007000000023260-115.dat	upx
behavioral2/memory/3360-119-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	upx
behavioral2/memory/2492-120-0x00007FF659CB0000-0x00007FF65A004000-memory.dmp	upx
behavioral2/memory/1600-121-0x00007FF6D6FF0000-0x00007FF6D7344000-memory.dmp	upx
behavioral2/memory/3464-122-0x00007FF7209B0000-0x00007FF720D04000-memory.dmp	upx
behavioral2/memory/852-123-0x00007FF6EB720000-0x00007FF6EBA74000-memory.dmp	upx
behavioral2/memory/2420-124-0x00007FF61A4D0000-0x00007FF61A824000-memory.dmp	upx
behavioral2/memory/1968-125-0x00007FF719E80000-0x00007FF71A1D4000-memory.dmp	upx
behavioral2/memory/1824-126-0x00007FF6ABF50000-0x00007FF6AC2A4000-memory.dmp	upx
behavioral2/memory/3428-127-0x00007FF6369E0000-0x00007FF636D34000-memory.dmp	upx
behavioral2/memory/2204-128-0x00007FF71A290000-0x00007FF71A5E4000-memory.dmp	upx
behavioral2/memory/1388-129-0x00007FF7FDB80000-0x00007FF7FDED4000-memory.dmp	upx
behavioral2/memory/4712-130-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	upx
behavioral2/memory/4624-131-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	upx
behavioral2/memory/3772-132-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	upx
behavioral2/memory/4952-133-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	upx
behavioral2/memory/1492-134-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	upx
behavioral2/memory/3688-135-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	upx
behavioral2/memory/3360-136-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp	upx
behavioral2/memory/4712-137-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp	upx
behavioral2/memory/4624-138-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp	upx
behavioral2/memory/3772-139-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp	upx
behavioral2/memory/400-140-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	upx
behavioral2/memory/2916-141-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	upx
behavioral2/memory/4952-142-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp	upx
behavioral2/memory/1492-143-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp	upx
behavioral2/memory/1872-144-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp	upx
behavioral2/memory/3688-145-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp	upx
behavioral2/memory/3732-146-0x00007FF703480000-0x00007FF7037D4000-memory.dmp	upx
behavioral2/memory/400-147-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp	upx
behavioral2/memory/2916-148-0x00007FF631DD0000-0x00007FF632124000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\lUZcLhx.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zyqNgPP.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QBqvfqR.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\maCZpsk.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lfObCVw.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JkpcOSV.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\svbTJyA.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YSjYEfa.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ozlAkgI.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zDEecei.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nPQTvMH.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wVCqOTM.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zKbwWyX.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jQjBhsN.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xXTHDiM.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AoZBpWm.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pjtWXlL.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RkJgLHu.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zKHNRri.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YPXpQhR.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bYmYzjB.exe	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 3360	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	92
PID 1844 wrote to memory of 3360	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	92
PID 1844 wrote to memory of 4712	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	93
PID 1844 wrote to memory of 4712	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	93
PID 1844 wrote to memory of 4624	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	94
PID 1844 wrote to memory of 4624	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	94
PID 1844 wrote to memory of 3772	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	95
PID 1844 wrote to memory of 3772	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	95
PID 1844 wrote to memory of 4952	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	96
PID 1844 wrote to memory of 4952	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	96
PID 1844 wrote to memory of 1492	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	97
PID 1844 wrote to memory of 1492	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	97
PID 1844 wrote to memory of 3688	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	98
PID 1844 wrote to memory of 3688	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	98
PID 1844 wrote to memory of 1872	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	99
PID 1844 wrote to memory of 1872	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	99
PID 1844 wrote to memory of 3732	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	100
PID 1844 wrote to memory of 3732	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	100
PID 1844 wrote to memory of 400	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	101
PID 1844 wrote to memory of 400	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	101
PID 1844 wrote to memory of 2916	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	102
PID 1844 wrote to memory of 2916	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	102
PID 1844 wrote to memory of 2492	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	103
PID 1844 wrote to memory of 2492	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	103
PID 1844 wrote to memory of 1600	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	104
PID 1844 wrote to memory of 1600	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	104
PID 1844 wrote to memory of 3464	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	105
PID 1844 wrote to memory of 3464	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	105
PID 1844 wrote to memory of 852	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	106
PID 1844 wrote to memory of 852	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	106
PID 1844 wrote to memory of 2420	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	107
PID 1844 wrote to memory of 2420	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	107
PID 1844 wrote to memory of 1968	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	108
PID 1844 wrote to memory of 1968	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	108
PID 1844 wrote to memory of 1824	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	109
PID 1844 wrote to memory of 1824	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	109
PID 1844 wrote to memory of 3428	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	110
PID 1844 wrote to memory of 3428	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	110
PID 1844 wrote to memory of 2204	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	111
PID 1844 wrote to memory of 2204	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	111
PID 1844 wrote to memory of 1388	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	112
PID 1844 wrote to memory of 1388	1844	2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_643e51f930928cfa958356b8601631f5_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System\lfObCVw.exe
  C:\Windows\System\lfObCVw.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\bYmYzjB.exe
  C:\Windows\System\bYmYzjB.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\lUZcLhx.exe
  C:\Windows\System\lUZcLhx.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\pjtWXlL.exe
  C:\Windows\System\pjtWXlL.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\zyqNgPP.exe
  C:\Windows\System\zyqNgPP.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\QBqvfqR.exe
  C:\Windows\System\QBqvfqR.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\RkJgLHu.exe
  C:\Windows\System\RkJgLHu.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\AoZBpWm.exe
  C:\Windows\System\AoZBpWm.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\zDEecei.exe
  C:\Windows\System\zDEecei.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\zKHNRri.exe
  C:\Windows\System\zKHNRri.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\nPQTvMH.exe
  C:\Windows\System\nPQTvMH.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\wVCqOTM.exe
  C:\Windows\System\wVCqOTM.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\YPXpQhR.exe
  C:\Windows\System\YPXpQhR.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\JkpcOSV.exe
  C:\Windows\System\JkpcOSV.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\maCZpsk.exe
  C:\Windows\System\maCZpsk.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\zKbwWyX.exe
  C:\Windows\System\zKbwWyX.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\jQjBhsN.exe
  C:\Windows\System\jQjBhsN.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\xXTHDiM.exe
  C:\Windows\System\xXTHDiM.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\svbTJyA.exe
  C:\Windows\System\svbTJyA.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\YSjYEfa.exe
  C:\Windows\System\YSjYEfa.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ozlAkgI.exe
  C:\Windows\System\ozlAkgI.exe
  2⤵
  - Executes dropped EXE
  PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AoZBpWm.exe

Path C:\Windows\System\AoZBpWm.exe
Size 5.9MB
SHA256 68108380fe6671e431016bfdb7077eb32c3cc7d03bb67ef4d7d507373c3646d9
MD5 d70b64a9494f603d4c0ad3147b9e9ea1
SHA1 8a66ac43b71f6b2148e701fd1f2fc9d8f570090b
SHA512 755322d19e5c05d3ae83fa0f79ca7cd92d2fbe94643fc1ce78904152ab682df5988e1f4836725053fea2fb2e02208db3513f09ca08f4cf4dc89e34d1970493cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkpcOSV.exe

Path C:\Windows\System\JkpcOSV.exe
Size 5.9MB
SHA256 bdc00420345a22e2e9ea2843835e610d021084a85160e167c72a5fd0f7b3460d
MD5 677fcbb4ff657adb6157220ab84b79ba
SHA1 17843f8564ab7e14a7395d98bba0d6bf91838c07
SHA512 b70f35ca5ab7f9c1411dba2f2c51594a5a2f17e616d1ca4cb47cfce2359cf9d388888bf3182371c19e4cbab6ab8965bf8f4483754052c66e46e9c8ba7ac3e90c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

QBqvfqR.exe

Path C:\Windows\System\QBqvfqR.exe
Size 5.9MB
SHA256 f486cf9dd959fa6e7d240634a3704dcb56724559cc4dc896fae6cf90db439bf8
MD5 4b8e892b863ebcd3beaf18f0b17d4309
SHA1 7a36f65945d1e1584e9c917f08c7666cec0b3b70
SHA512 77e77a4fe0dab8a7f771747e951cf072bd14fdd1a3cf2115d9a0fa3493ba43547337c2a80cbe150ec1165510594ebb49a25afd6d7d0db9f01e31202fe590dbc8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

RkJgLHu.exe

Path C:\Windows\System\RkJgLHu.exe
Size 5.9MB
SHA256 0db7aa9214007bdf1d9f0ee88f2ce38630997c1e53eb626ac58df5dc2148a137
MD5 7e7ed4ad1b3d410f1f3e6be166d4a260
SHA1 c43e383062653f25fdd89d206fa28be5cdcd1b67
SHA512 78212a9e1948bfd32c545f9caead3c6f9b0121925adc22c22b3ed8f84a32335cee5d69d2f8c4803af6976a8ecaea8f66dd0f89d024c06f20d499ff9a6f9a92c8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

YPXpQhR.exe

Path C:\Windows\System\YPXpQhR.exe
Size 5.9MB
SHA256 732825e8b5cbf2d27bb1105dee38109bdd69fed3ad603766b64ab370f28647d6
MD5 d8006bcda9cd08d608a14bd34f95e936
SHA1 9c36c63eec9582e34ea2303412fe273d14c4e5e1
SHA512 f316211c68cc1eea5d5f68769ae3a2d04c71b3f679e58e0696c54bf476d712211c0693ed8e7517a14b8a1406a7ea179e9faa31a9c3c955a6603151ee2a614d79
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

YSjYEfa.exe

Path C:\Windows\System\YSjYEfa.exe
Size 5.9MB
SHA256 9af1fbc68650175f00e7dbc460cdb9ac355a40c2cca09b644631b041daf82dcf
MD5 58835262970fd3b04213477162945db1
SHA1 8b0b6483a7938b4240c1202c306624819cad35cd
SHA512 950aaee7c1379727cc73bb584a9e23857a064d80284db441652c84a63bc5142ebb5267a0e8f2aa3301d671ba1c29fd2da7673ca6a9d5d1e9d1907ceb44c09807
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

bYmYzjB.exe

Path C:\Windows\System\bYmYzjB.exe
Size 5.9MB
SHA256 20f0f2e0472adbbd74cf5eeffca3ee5b1666adf8e385ff831857b2388ea4aad8
MD5 8bffd33dae7630d63351fb801a0edd23
SHA1 fbdbd788c50659107664b21e8d85b5a39b1d40ae
SHA512 bfdd645fa5e5b2173df89aff0b5954cfc61b08fa0b5e97b479266947a9f4a541c6bb4ec0f66aa0622f7c12fbf0048527aafec6bb04b067eff8bdd9f9e14758a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQjBhsN.exe

Path C:\Windows\System\jQjBhsN.exe
Size 5.9MB
SHA256 67c9ff8a919551113ecdcad1e375040d170a7a2688be2683b3f943a154c4bf5b
MD5 6fceb0c8423c11fbd0017ec833afd7c0
SHA1 8e4ff5ae7cb9282806388ecb61ca3675db024f85
SHA512 eca4a88590facc41117f8ad5ae896768367dbf0c439699372fc9461fd21619f92f38fc4ca6d693b334b7d5d5c1b1108d814826d53ec388fbc8f72f840644ddc3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUZcLhx.exe

Path C:\Windows\System\lUZcLhx.exe
Size 5.9MB
SHA256 8323ef83986433f01bc9d3a981153c1d198752a04eb7df4b55b78ec3fab28a5d
MD5 7becde29a2f1b789a3ca51e8315da952
SHA1 66a18d0f7ad37a7b83b6a5c1b3a3d01a02bca222
SHA512 cd508a9cf1640a2082e1451eacffc2ed09112e2959fa85a35b377858c24c8bcde40e934e10c6438f09012d592881dffe0a2162eb7f8920047de968c52239bc48
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfObCVw.exe

Path C:\Windows\System\lfObCVw.exe
Size 5.9MB
SHA256 2fa753674e381d002ad1c6ce7486cb5df319362714c08f22964ce3a47e9b9d6c
MD5 1a3d3d49af6044186d4531e3c040ca49
SHA1 c86ddb1a6717ab14ae6cc89f4d70e5de8b93a721
SHA512 7d6f89e310a33c21017a8a5d1f466f39dfbeec8fd2504df7a858871529b89d34e96b0586e0c9ff5352d41f85a062017b2fd7ff6129cd3c1dcbe95e5df9f56d8a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

maCZpsk.exe

Path C:\Windows\System\maCZpsk.exe
Size 5.9MB
SHA256 955ab99f11566e4ecf0ed34524075e80eb7e23ceec39c9b7b4f3d1fd807a2bfd
MD5 7a512562f04a50bd307573aca26e6880
SHA1 b70cd85d6d7f9ef8c54f0400ba5565e68cf90d4a
SHA512 1a46b942354d3c761297ccff665fc7279140990f39baf650a58e36d053f94d5e3a37a2580c7e2a599505dce239a9e10eea9549d64d1bd131cc9e6d7a3ddbac2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPQTvMH.exe

Path C:\Windows\System\nPQTvMH.exe
Size 5.9MB
SHA256 4f62439b94c879bf94106b3cc70d9ad1d6e3f0d395f8d9f6cbd06ab4ac4e4c60
MD5 63e2676a481ad4fa41a585ecf1f15830
SHA1 77e740754e3a13ee93973a1b17d26cd98b6c6fcc
SHA512 d3cee8c98580f76a569b77d44233578dae20c0fcf97db5a21210d52e1306ce355d0424060cc89a9c0998f3cac6bc120d7279fea48c4f1b58bc7164012e284dbb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

ozlAkgI.exe

Path C:\Windows\System\ozlAkgI.exe
Size 5.9MB
SHA256 92389f43b021a4765f56b932fd6bdf2e8fb907cc16d72d08990b538a1d343d2d
MD5 38cc52afebbccae0f2f5b7bedc76a712
SHA1 45cc541c41ead70fa8569af4e6ec512f38ec52e5
SHA512 81bcb3e231cbfa9d3d3fc4a895522e794608458f50363564ceaae25de9ed8f3c725248e8ac4abeb2ba75feaeb2e88cf81ba3505363d59ff276b40b02403552e9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjtWXlL.exe

Path C:\Windows\System\pjtWXlL.exe
Size 5.9MB
SHA256 3cfb3ddb4172a4bee6b3b79cb956630c5c81a4960b26e6a3ca2236ec50fd770b
MD5 fe4271b43eeefc0afa040f9a213ec512
SHA1 1c461b5c91427ae969517594e7657dfec8d22aa9
SHA512 75ca15e9f04f71ed91d224a5142ffad42f38930e69bebf3147df935773cd7958c3632bc34885fcea5b5160fbbdcd89bd038229ff5d1a6abd41ed6ec1942b40db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

svbTJyA.exe

Path C:\Windows\System\svbTJyA.exe
Size 5.9MB
SHA256 3942b172403b3d4350ae54dbb3b845d31910a3a5cc1d5cdfa8f45b73244fe310
MD5 64b7fe0513fd3ed6b6017829023cf416
SHA1 7a37a21173b146535be97d11561c63606031013a
SHA512 954715a10ce77c80593b1dd21678814f84594ffb91f3ab62a2c9b6c7bd5ea82d2d8fedd1683a2341729ddf12c538df0d227d9ba4c83bdedb46eef95a14644cb7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

wVCqOTM.exe

Path C:\Windows\System\wVCqOTM.exe
Size 5.9MB
SHA256 84396a24fa3a771f1bfb96a1c1b132f5936b7794618d5a036fbb4712cc1eb428
MD5 9e3aeb2ea447f6e6793e4c0bfb192486
SHA1 43ce79dfc1a8e6f842c951c89413694cca31d326
SHA512 1b6aebc96390c9d22636ca1fc0bc471d021940f1dc3760df12babd49dd8986667942981b9d5e354e88dafa76388e0ad23ede0072c229bf993d54dd896965278e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

xXTHDiM.exe

Path C:\Windows\System\xXTHDiM.exe
Size 5.9MB
SHA256 b0ca5af9dee3d091c5bef8beba6ecfa27be45638337ca469a02df3a1d6420597
MD5 e4c8f21e0f3f4191b37ee9a5fd3b3602
SHA1 d6457bd683bbad3c0167aa2777a985ab1577b2d0
SHA512 322e13a3c3a2371b05a8f18a34bfd45b30d5af341b62a32e951a3f6fcfab9d5442cdf4a94ec4d8a9caca6e5620aafcdfff7d96e310da37243804284b351895d7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

zDEecei.exe

Path C:\Windows\System\zDEecei.exe
Size 5.9MB
SHA256 cc67ae02b7b8ce7e7c2729581fefd25c9ed1c09e15a9ca68e566ff5dec1d915a
MD5 e96e1fa9be80e65d21b1a0a299b24e72
SHA1 59b4eb83f2f5f83b39e64beed6b7933156c3bc8b
SHA512 da908ef5698c692b86c9c2438cba1b59acf32f07d1e34d9e4e09b63be59d6e3fa98dbe95f58271252009d88c25d8aac55df7f01d063b40fb5340944d92ebcaa4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

zKHNRri.exe

Path C:\Windows\System\zKHNRri.exe
Size 5.9MB
SHA256 1c2cde48e3f00517fe1cac5683efd39815933d7145f4371e587ce4e67c2fb519
MD5 28e3cab74f30be6004b0c4e5ad507d6b
SHA1 f56a71344ab88a12b538150b46edc15a31a27b32
SHA512 d0190d45620a457879cd33e3157e275fafea498beea7ebb2df96e285be1b0f095c0d147744907fc50f538794ddaaef493896e43f68923e3d0167d4af38bb35f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

zKbwWyX.exe

Path C:\Windows\System\zKbwWyX.exe
Size 5.9MB
SHA256 b34ba243b48aaae9abfa8f4d1f57846f62f20c95e057207b6ab90eca73ef7737
MD5 071907c1d57fb7410225f955e36595ca
SHA1 a731feaee9ab15f8d9728949ccb72bdca30a76d3
SHA512 bbec1ef8c89a27dd5d12d324debd999c1c7dcbe4c09b4473fea81ba9c9505b13a9a45a6156b9389d80e3c0eb9f0f1bd0cfa5ece7649790428886141a466e9248
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

zyqNgPP.exe

Path C:\Windows\System\zyqNgPP.exe
Size 5.9MB
SHA256 ec0d7dfa4efab0f9589aa56d79b9fddf79ffd2a364a67405d6996961de77298a
MD5 5e856ee25370f68ba0f4d32b84dc822e
SHA1 eae544f5d9cb4f3131e8e87015f2decab4b79d31
SHA512 36b2e95a711d482564ba444b245ef7918a0739e2e41e30b3807d2216358b501ff58793ca79c9b7c211a50da4cbd360746c8047ea75abd02fe6a9d23da48f43cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-140-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp

Download

memory/400-65-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp

Download

memory/400-147-0x00007FF7A9B80000-0x00007FF7A9ED4000-memory.dmp

Download

memory/852-123-0x00007FF6EB720000-0x00007FF6EBA74000-memory.dmp

Download

memory/852-152-0x00007FF6EB720000-0x00007FF6EBA74000-memory.dmp

Download

memory/1388-158-0x00007FF7FDB80000-0x00007FF7FDED4000-memory.dmp

Download

memory/1388-129-0x00007FF7FDB80000-0x00007FF7FDED4000-memory.dmp

Download

memory/1492-134-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp

Download

memory/1492-40-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp

Download

memory/1492-143-0x00007FF78F780000-0x00007FF78FAD4000-memory.dmp

Download

memory/1600-150-0x00007FF6D6FF0000-0x00007FF6D7344000-memory.dmp

Download

memory/1600-121-0x00007FF6D6FF0000-0x00007FF6D7344000-memory.dmp

Download

memory/1824-126-0x00007FF6ABF50000-0x00007FF6AC2A4000-memory.dmp

Download

memory/1824-155-0x00007FF6ABF50000-0x00007FF6AC2A4000-memory.dmp

Download

memory/1844-1-0x000002C2102B0000-0x000002C2102C0000-memory.dmp

Download

memory/1844-0-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp

Download

memory/1844-63-0x00007FF6DF9C0000-0x00007FF6DFD14000-memory.dmp

Download

memory/1872-50-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp

Download

memory/1872-144-0x00007FF7276C0000-0x00007FF727A14000-memory.dmp

Download

memory/1968-154-0x00007FF719E80000-0x00007FF71A1D4000-memory.dmp

Download

memory/1968-125-0x00007FF719E80000-0x00007FF71A1D4000-memory.dmp

Download

memory/2204-157-0x00007FF71A290000-0x00007FF71A5E4000-memory.dmp

Download

memory/2204-128-0x00007FF71A290000-0x00007FF71A5E4000-memory.dmp

Download

memory/2420-124-0x00007FF61A4D0000-0x00007FF61A824000-memory.dmp

Download

memory/2420-153-0x00007FF61A4D0000-0x00007FF61A824000-memory.dmp

Download

memory/2492-120-0x00007FF659CB0000-0x00007FF65A004000-memory.dmp

Download

memory/2492-149-0x00007FF659CB0000-0x00007FF65A004000-memory.dmp

Download

memory/2916-66-0x00007FF631DD0000-0x00007FF632124000-memory.dmp

Download

memory/2916-148-0x00007FF631DD0000-0x00007FF632124000-memory.dmp

Download

memory/2916-141-0x00007FF631DD0000-0x00007FF632124000-memory.dmp

Download

memory/3360-8-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp

Download

memory/3360-136-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp

Download

memory/3360-119-0x00007FF66BAE0000-0x00007FF66BE34000-memory.dmp

Download

memory/3428-156-0x00007FF6369E0000-0x00007FF636D34000-memory.dmp

Download

memory/3428-127-0x00007FF6369E0000-0x00007FF636D34000-memory.dmp

Download

memory/3464-122-0x00007FF7209B0000-0x00007FF720D04000-memory.dmp

Download

memory/3464-151-0x00007FF7209B0000-0x00007FF720D04000-memory.dmp

Download

memory/3688-47-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp

Download

memory/3688-135-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp

Download

memory/3688-145-0x00007FF7277C0000-0x00007FF727B14000-memory.dmp

Download

memory/3732-146-0x00007FF703480000-0x00007FF7037D4000-memory.dmp

Download

memory/3732-58-0x00007FF703480000-0x00007FF7037D4000-memory.dmp

Download

memory/3772-139-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp

Download

memory/3772-132-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp

Download

memory/3772-26-0x00007FF671DA0000-0x00007FF6720F4000-memory.dmp

Download

memory/4624-19-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp

Download

memory/4624-131-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp

Download

memory/4624-138-0x00007FF6D6F80000-0x00007FF6D72D4000-memory.dmp

Download

memory/4712-130-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp

Download

memory/4712-137-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp

Download

memory/4712-14-0x00007FF62C0A0000-0x00007FF62C3F4000-memory.dmp

Download

memory/4952-32-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp

Download

memory/4952-142-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp

Download

memory/4952-133-0x00007FF63F360000-0x00007FF63F6B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads