cobaltstrike | 24fd2571a99a520bc290f3744051a0c3b3fc0329d0aff3b8c07d7785fbcf44cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-mv6kfabf36
SHA256 24fd2571a99a520bc290f3744051a0c3b3fc0329d0aff3b8c07d7785fbcf44cb
MD5 22c7813159fdfcf132a716092dccb075
SHA1 10e539bb4d86b6fc2944a71dc6fa5678f0805fc6
SHA512 e3739f89a8c3143d22984d7196c81748fb0b4ccc673ab0d6403debed81c503f51500b6a85b653ac9543470a395dd46e261d7b3b89fe129b01a29a998302b522f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000b0000000232f0-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-10.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023419-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-25.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-37.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-55.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-68.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002341d-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-80.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-57.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-91.dat	cobalt_reflective_dll
behavioral2/files/0x0011000000023374-99.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023382-104.dat	cobalt_reflective_dll
behavioral2/files/0x000f000000023386-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-125.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-133.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-124.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000232f0-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023419-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002341d-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0011000000023374-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023382-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000f000000023386-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-133.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1976-0-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	UPX
behavioral2/files/0x000b0000000232f0-4.dat	UPX
behavioral2/memory/4192-8-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-10.dat	UPX
behavioral2/files/0x0009000000023419-11.dat	UPX
behavioral2/files/0x0007000000023422-25.dat	UPX
behavioral2/files/0x0007000000023423-30.dat	UPX
behavioral2/files/0x0007000000023421-35.dat	UPX
behavioral2/files/0x0007000000023424-37.dat	UPX
behavioral2/memory/4740-32-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-55.dat	UPX
behavioral2/files/0x0007000000023428-59.dat	UPX
behavioral2/files/0x0007000000023429-68.dat	UPX
behavioral2/files/0x000800000002341d-71.dat	UPX
behavioral2/files/0x000700000002342a-80.dat	UPX
behavioral2/memory/4916-85-0x00007FF725FF0000-0x00007FF726344000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-87.dat	UPX
behavioral2/memory/1684-86-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	UPX
behavioral2/memory/1844-74-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	UPX
behavioral2/memory/4192-73-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	UPX
behavioral2/memory/1976-70-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	UPX
behavioral2/memory/3704-69-0x00007FF7D8850000-0x00007FF7D8BA4000-memory.dmp	UPX
behavioral2/memory/4040-67-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	UPX
behavioral2/memory/3016-66-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023427-57.dat	UPX
behavioral2/memory/4608-53-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	UPX
behavioral2/memory/2988-49-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	UPX
behavioral2/memory/3920-31-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	UPX
behavioral2/memory/2444-29-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	UPX
behavioral2/memory/1392-26-0x00007FF799210000-0x00007FF799564000-memory.dmp	UPX
behavioral2/memory/3044-16-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-91.dat	UPX
behavioral2/memory/3504-97-0x00007FF716A60000-0x00007FF716DB4000-memory.dmp	UPX
behavioral2/files/0x0011000000023374-99.dat	UPX
behavioral2/memory/3044-95-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	UPX
behavioral2/memory/3920-101-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	UPX
behavioral2/memory/3252-102-0x00007FF6B5B40000-0x00007FF6B5E94000-memory.dmp	UPX
behavioral2/files/0x0009000000023382-104.dat	UPX
behavioral2/files/0x000f000000023386-112.dat	UPX
behavioral2/memory/4740-116-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	UPX
behavioral2/memory/4608-123-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	UPX
behavioral2/files/0x000700000002342e-125.dat	UPX
behavioral2/memory/1960-129-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	UPX
behavioral2/memory/4040-131-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-133.dat	UPX
behavioral2/memory/4944-132-0x00007FF622610000-0x00007FF622964000-memory.dmp	UPX
behavioral2/memory/3016-126-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-124.dat	UPX
behavioral2/memory/220-122-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	UPX
behavioral2/memory/3396-121-0x00007FF620180000-0x00007FF6204D4000-memory.dmp	UPX
behavioral2/memory/3260-109-0x00007FF66C6C0000-0x00007FF66CA14000-memory.dmp	UPX
behavioral2/memory/2444-108-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	UPX
behavioral2/memory/1684-138-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	UPX
behavioral2/memory/1844-137-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	UPX
behavioral2/memory/220-139-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	UPX
behavioral2/memory/1960-140-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	UPX
behavioral2/memory/4944-141-0x00007FF622610000-0x00007FF622964000-memory.dmp	UPX
behavioral2/memory/4192-142-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	UPX
behavioral2/memory/3044-143-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	UPX
behavioral2/memory/1392-144-0x00007FF799210000-0x00007FF799564000-memory.dmp	UPX
behavioral2/memory/3920-145-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	UPX
behavioral2/memory/2444-146-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	UPX
behavioral2/memory/2988-147-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	UPX
behavioral2/memory/4740-148-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1976-0-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	xmrig
behavioral2/files/0x000b0000000232f0-4.dat	xmrig
behavioral2/memory/4192-8-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-10.dat	xmrig
behavioral2/files/0x0009000000023419-11.dat	xmrig
behavioral2/files/0x0007000000023422-25.dat	xmrig
behavioral2/files/0x0007000000023423-30.dat	xmrig
behavioral2/files/0x0007000000023421-35.dat	xmrig
behavioral2/files/0x0007000000023424-37.dat	xmrig
behavioral2/memory/4740-32-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-55.dat	xmrig
behavioral2/files/0x0007000000023428-59.dat	xmrig
behavioral2/files/0x0007000000023429-68.dat	xmrig
behavioral2/files/0x000800000002341d-71.dat	xmrig
behavioral2/files/0x000700000002342a-80.dat	xmrig
behavioral2/memory/4916-85-0x00007FF725FF0000-0x00007FF726344000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-87.dat	xmrig
behavioral2/memory/1684-86-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	xmrig
behavioral2/memory/1844-74-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	xmrig
behavioral2/memory/4192-73-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	xmrig
behavioral2/memory/1976-70-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	xmrig
behavioral2/memory/3704-69-0x00007FF7D8850000-0x00007FF7D8BA4000-memory.dmp	xmrig
behavioral2/memory/4040-67-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	xmrig
behavioral2/memory/3016-66-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-57.dat	xmrig
behavioral2/memory/4608-53-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	xmrig
behavioral2/memory/2988-49-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	xmrig
behavioral2/memory/3920-31-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	xmrig
behavioral2/memory/2444-29-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	xmrig
behavioral2/memory/1392-26-0x00007FF799210000-0x00007FF799564000-memory.dmp	xmrig
behavioral2/memory/3044-16-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-91.dat	xmrig
behavioral2/memory/3504-97-0x00007FF716A60000-0x00007FF716DB4000-memory.dmp	xmrig
behavioral2/files/0x0011000000023374-99.dat	xmrig
behavioral2/memory/3044-95-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	xmrig
behavioral2/memory/3920-101-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	xmrig
behavioral2/memory/3252-102-0x00007FF6B5B40000-0x00007FF6B5E94000-memory.dmp	xmrig
behavioral2/files/0x0009000000023382-104.dat	xmrig
behavioral2/files/0x000f000000023386-112.dat	xmrig
behavioral2/memory/4740-116-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	xmrig
behavioral2/memory/4608-123-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-125.dat	xmrig
behavioral2/memory/1960-129-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	xmrig
behavioral2/memory/4040-131-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-133.dat	xmrig
behavioral2/memory/4944-132-0x00007FF622610000-0x00007FF622964000-memory.dmp	xmrig
behavioral2/memory/3016-126-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-124.dat	xmrig
behavioral2/memory/220-122-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	xmrig
behavioral2/memory/3396-121-0x00007FF620180000-0x00007FF6204D4000-memory.dmp	xmrig
behavioral2/memory/3260-109-0x00007FF66C6C0000-0x00007FF66CA14000-memory.dmp	xmrig
behavioral2/memory/2444-108-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	xmrig
behavioral2/memory/1684-138-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	xmrig
behavioral2/memory/1844-137-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	xmrig
behavioral2/memory/220-139-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	xmrig
behavioral2/memory/1960-140-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	xmrig
behavioral2/memory/4944-141-0x00007FF622610000-0x00007FF622964000-memory.dmp	xmrig
behavioral2/memory/4192-142-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	xmrig
behavioral2/memory/3044-143-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	xmrig
behavioral2/memory/1392-144-0x00007FF799210000-0x00007FF799564000-memory.dmp	xmrig
behavioral2/memory/3920-145-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	xmrig
behavioral2/memory/2444-146-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	xmrig
behavioral2/memory/2988-147-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	xmrig
behavioral2/memory/4740-148-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4192	oBRrzrd.exe
3044	DPmshLy.exe
1392	jwYKwzQ.exe
2444	YBdyxxu.exe
3920	PknsCbg.exe
4740	fQKHNrX.exe
2988	MJgUYhx.exe
4608	JLvXsnx.exe
3016	JyBlveN.exe
3704	ltQbMIJ.exe
4040	IbeZvvC.exe
1844	PjRJZOp.exe
4916	xhoAmAe.exe
1684	qJtcgzF.exe
3504	AhtcTOx.exe
3252	KlucRxB.exe
3260	lHaYOFt.exe
3396	nrfKLcv.exe
220	dMIRXCX.exe
1960	acGrYlR.exe
4944	sBdxZJR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1976-0-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	upx
behavioral2/files/0x000b0000000232f0-4.dat	upx
behavioral2/memory/4192-8-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	upx
behavioral2/files/0x0007000000023420-10.dat	upx
behavioral2/files/0x0009000000023419-11.dat	upx
behavioral2/files/0x0007000000023422-25.dat	upx
behavioral2/files/0x0007000000023423-30.dat	upx
behavioral2/files/0x0007000000023421-35.dat	upx
behavioral2/files/0x0007000000023424-37.dat	upx
behavioral2/memory/4740-32-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	upx
behavioral2/files/0x0007000000023425-55.dat	upx
behavioral2/files/0x0007000000023428-59.dat	upx
behavioral2/files/0x0007000000023429-68.dat	upx
behavioral2/files/0x000800000002341d-71.dat	upx
behavioral2/files/0x000700000002342a-80.dat	upx
behavioral2/memory/4916-85-0x00007FF725FF0000-0x00007FF726344000-memory.dmp	upx
behavioral2/files/0x000700000002342b-87.dat	upx
behavioral2/memory/1684-86-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	upx
behavioral2/memory/1844-74-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	upx
behavioral2/memory/4192-73-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	upx
behavioral2/memory/1976-70-0x00007FF6975E0000-0x00007FF697934000-memory.dmp	upx
behavioral2/memory/3704-69-0x00007FF7D8850000-0x00007FF7D8BA4000-memory.dmp	upx
behavioral2/memory/4040-67-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	upx
behavioral2/memory/3016-66-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	upx
behavioral2/files/0x0007000000023427-57.dat	upx
behavioral2/memory/4608-53-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	upx
behavioral2/memory/2988-49-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	upx
behavioral2/memory/3920-31-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	upx
behavioral2/memory/2444-29-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	upx
behavioral2/memory/1392-26-0x00007FF799210000-0x00007FF799564000-memory.dmp	upx
behavioral2/memory/3044-16-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	upx
behavioral2/files/0x000700000002342c-91.dat	upx
behavioral2/memory/3504-97-0x00007FF716A60000-0x00007FF716DB4000-memory.dmp	upx
behavioral2/files/0x0011000000023374-99.dat	upx
behavioral2/memory/3044-95-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	upx
behavioral2/memory/3920-101-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	upx
behavioral2/memory/3252-102-0x00007FF6B5B40000-0x00007FF6B5E94000-memory.dmp	upx
behavioral2/files/0x0009000000023382-104.dat	upx
behavioral2/files/0x000f000000023386-112.dat	upx
behavioral2/memory/4740-116-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	upx
behavioral2/memory/4608-123-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp	upx
behavioral2/files/0x000700000002342e-125.dat	upx
behavioral2/memory/1960-129-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	upx
behavioral2/memory/4040-131-0x00007FF6033E0000-0x00007FF603734000-memory.dmp	upx
behavioral2/files/0x000700000002342f-133.dat	upx
behavioral2/memory/4944-132-0x00007FF622610000-0x00007FF622964000-memory.dmp	upx
behavioral2/memory/3016-126-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp	upx
behavioral2/files/0x000700000002342d-124.dat	upx
behavioral2/memory/220-122-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	upx
behavioral2/memory/3396-121-0x00007FF620180000-0x00007FF6204D4000-memory.dmp	upx
behavioral2/memory/3260-109-0x00007FF66C6C0000-0x00007FF66CA14000-memory.dmp	upx
behavioral2/memory/2444-108-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	upx
behavioral2/memory/1684-138-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp	upx
behavioral2/memory/1844-137-0x00007FF62F610000-0x00007FF62F964000-memory.dmp	upx
behavioral2/memory/220-139-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp	upx
behavioral2/memory/1960-140-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp	upx
behavioral2/memory/4944-141-0x00007FF622610000-0x00007FF622964000-memory.dmp	upx
behavioral2/memory/4192-142-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp	upx
behavioral2/memory/3044-143-0x00007FF787DC0000-0x00007FF788114000-memory.dmp	upx
behavioral2/memory/1392-144-0x00007FF799210000-0x00007FF799564000-memory.dmp	upx
behavioral2/memory/3920-145-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp	upx
behavioral2/memory/2444-146-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp	upx
behavioral2/memory/2988-147-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp	upx
behavioral2/memory/4740-148-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fQKHNrX.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xhoAmAe.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qJtcgzF.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AhtcTOx.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oBRrzrd.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DPmshLy.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YBdyxxu.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JLvXsnx.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ltQbMIJ.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\acGrYlR.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MJgUYhx.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IbeZvvC.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PjRJZOp.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KlucRxB.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nrfKLcv.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dMIRXCX.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sBdxZJR.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jwYKwzQ.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PknsCbg.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JyBlveN.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lHaYOFt.exe	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4192	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	83
PID 1976 wrote to memory of 4192	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	83
PID 1976 wrote to memory of 3044	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	84
PID 1976 wrote to memory of 3044	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	84
PID 1976 wrote to memory of 1392	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	85
PID 1976 wrote to memory of 1392	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	85
PID 1976 wrote to memory of 2444	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	86
PID 1976 wrote to memory of 2444	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	86
PID 1976 wrote to memory of 3920	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	87
PID 1976 wrote to memory of 3920	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	87
PID 1976 wrote to memory of 4740	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	88
PID 1976 wrote to memory of 4740	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	88
PID 1976 wrote to memory of 2988	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	89
PID 1976 wrote to memory of 2988	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	89
PID 1976 wrote to memory of 4608	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	91
PID 1976 wrote to memory of 4608	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	91
PID 1976 wrote to memory of 3016	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	92
PID 1976 wrote to memory of 3016	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	92
PID 1976 wrote to memory of 3704	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	93
PID 1976 wrote to memory of 3704	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	93
PID 1976 wrote to memory of 4040	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	94
PID 1976 wrote to memory of 4040	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	94
PID 1976 wrote to memory of 1844	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	95
PID 1976 wrote to memory of 1844	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	95
PID 1976 wrote to memory of 4916	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	96
PID 1976 wrote to memory of 4916	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	96
PID 1976 wrote to memory of 1684	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	97
PID 1976 wrote to memory of 1684	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	97
PID 1976 wrote to memory of 3504	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	98
PID 1976 wrote to memory of 3504	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	98
PID 1976 wrote to memory of 3252	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	101
PID 1976 wrote to memory of 3252	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	101
PID 1976 wrote to memory of 3260	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	102
PID 1976 wrote to memory of 3260	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	102
PID 1976 wrote to memory of 3396	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	103
PID 1976 wrote to memory of 3396	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	103
PID 1976 wrote to memory of 220	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	104
PID 1976 wrote to memory of 220	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	104
PID 1976 wrote to memory of 1960	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	105
PID 1976 wrote to memory of 1960	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	105
PID 1976 wrote to memory of 4944	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	106
PID 1976 wrote to memory of 4944	1976	2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_22c7813159fdfcf132a716092dccb075_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\System\oBRrzrd.exe
  C:\Windows\System\oBRrzrd.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\DPmshLy.exe
  C:\Windows\System\DPmshLy.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\jwYKwzQ.exe
  C:\Windows\System\jwYKwzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\YBdyxxu.exe
  C:\Windows\System\YBdyxxu.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\PknsCbg.exe
  C:\Windows\System\PknsCbg.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\fQKHNrX.exe
  C:\Windows\System\fQKHNrX.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MJgUYhx.exe
  C:\Windows\System\MJgUYhx.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\JLvXsnx.exe
  C:\Windows\System\JLvXsnx.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\JyBlveN.exe
  C:\Windows\System\JyBlveN.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ltQbMIJ.exe
  C:\Windows\System\ltQbMIJ.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\IbeZvvC.exe
  C:\Windows\System\IbeZvvC.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\PjRJZOp.exe
  C:\Windows\System\PjRJZOp.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\xhoAmAe.exe
  C:\Windows\System\xhoAmAe.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\qJtcgzF.exe
  C:\Windows\System\qJtcgzF.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\AhtcTOx.exe
  C:\Windows\System\AhtcTOx.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\KlucRxB.exe
  C:\Windows\System\KlucRxB.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\lHaYOFt.exe
  C:\Windows\System\lHaYOFt.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\nrfKLcv.exe
  C:\Windows\System\nrfKLcv.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\dMIRXCX.exe
  C:\Windows\System\dMIRXCX.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\acGrYlR.exe
  C:\Windows\System\acGrYlR.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\sBdxZJR.exe
  C:\Windows\System\sBdxZJR.exe
  2⤵
  - Executes dropped EXE
  PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhtcTOx.exe

Path C:\Windows\System\AhtcTOx.exe
Size 5.9MB
SHA256 af1bc078aa7dcc38d5e15612fd9ecfc51800d665e9be6adb120e97eb51c31b75
MD5 3a069d03d7833a1684bdbdfb3c51c106
SHA1 364f1b5125ebd8fa95220e578e89e908ee35ef8c
SHA512 bc5c21dc7a11b44c5c720f18ec102d88cb565e332507065a236035dae40327f18ccf41e1823f07acb32dc3210c9dd9902e94359d13f14cc40726caa71065ecf3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

DPmshLy.exe

Path C:\Windows\System\DPmshLy.exe
Size 5.9MB
SHA256 980c88877eda5de12e18f98d9e1263bf9147e681c60ee7813c0bca62e1e758ce
MD5 77d93cfb6444fdbea03305b87e6a48ad
SHA1 cc90a04c0e425eef96a43362e561b7ee6b6179c1
SHA512 bd89ab4bdbbae05d10b05aff7f523e38d2ac258acdf912c1f686530c1a3318cb2492c64c3202836578f12e730f4b8dadf60926d21166fa6d22cdc7d7d7bda1b8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

IbeZvvC.exe

Path C:\Windows\System\IbeZvvC.exe
Size 5.9MB
SHA256 647284a34162be6b008c5cb8a8fb9c0a52d1b0684777da03c37a03bebe93cc68
MD5 012d9f031ef784c37ba2f429431ea520
SHA1 11dd10c1986e6d93a45eff5359cbbcb425fbe78e
SHA512 23f58587810debafadbed8b1db71ec538923743c4223eb96866de1afffe2a8ce80c7f6e00f48e31a1b864df84f069a092eb2e17b2ba840e90e3edc6eb902957b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLvXsnx.exe

Path C:\Windows\System\JLvXsnx.exe
Size 5.9MB
SHA256 96b6548890ec8ceba464d589199195a355b69e6dbd6142c1e5dfe29720840743
MD5 23916d82c8cf6b9d2a39fbabf83a44a7
SHA1 836a267334114152a01dbd78ac1574abd1125f87
SHA512 c0c49230a2995434a250f41d24d99541889d55b874d2b6967d5fe40c9576db530b6984586803898c822858ef54623d2161cbd8293334554e2c4b89390b7b392b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyBlveN.exe

Path C:\Windows\System\JyBlveN.exe
Size 5.9MB
SHA256 87bfa0b6eebf31600e7b5dda0fd731fbe6df193c71b102517e426c9fae61ea73
MD5 f02fbaad35ee5658b7f7dd2c2281141a
SHA1 8973e1c6aa0d0c41cd4a46dff5bfed1ae79e070c
SHA512 23106b57f00f60896373d659339f10f3617f32b1781b64f5e33aac08c898ade294c8803773401f0e3b5b84e81c1b9453d73087599b944c5dafc54a6275f70b2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

KlucRxB.exe

Path C:\Windows\System\KlucRxB.exe
Size 5.9MB
SHA256 4b5aa8b03afc7c711d8f6a666cbfbbb391faaad8e16731bb45c4d449083cb90b
MD5 8121cedf311e465824ee524dc53d0fab
SHA1 8d066a26de1bac284675831f1b60eb4a72815bdf
SHA512 3d6d959c9dfada055b3e971b97a999a83d9a279b021fb8fdb1d987f72039f1fb8a3c01be5d4ff6e7c6ef134277eeca4818d12b5b799c8e1c795ccafc52b22162
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJgUYhx.exe

Path C:\Windows\System\MJgUYhx.exe
Size 5.9MB
SHA256 67cac53b6b01a436a8054e3d3219a45285a36e8beb59dce1bf9f0ef7152cac56
MD5 bfaec5d6967955f749a67d5f069214dc
SHA1 440f44ef58f0f71b71d4105c76a4f9c16558ddce
SHA512 7ca997c74bcd1555722f99127ed8656fdc644c987dfb30b4967620a7de30e7d16d1c72b6e469b03faa5b765a218ec1e8b2be2d6a235f0c01c400afafd8c1067f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

PjRJZOp.exe

Path C:\Windows\System\PjRJZOp.exe
Size 5.9MB
SHA256 57febafa639c58f870cbb1fcd12e67c4dc74b2ebcdb20fb7827d2a397059047b
MD5 65f9a0f64542b9f580309f34f7c274a1
SHA1 11402ae6c454d0190c1c4e7cd0c39a158a3e9721
SHA512 6df37c672aa8f4d12028f972f731c847c70c82f4c7a9488991cad049cba76eceb90499e55c9fd36c9e3161db4a9bccfb0b63e90c329e7ffab93026c3cc72d7d1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

PknsCbg.exe

Path C:\Windows\System\PknsCbg.exe
Size 5.9MB
SHA256 10c4f6371d1ac5cd45d0f688056593ea8aeb4754109d9ae595f94c1277845e77
MD5 070621c0f6b6eb17928a3b21856d5a88
SHA1 c79f34e779812760f98710698873d150fb2777d8
SHA512 9e223255a0b3967311a6b5f65dc7652dc8c8122faa8f96d01d7bff21743027b72763f60a3178f60d1a20ad24e6a633d4de5a4b0bf6a9715a28759f5f402ba92a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBdyxxu.exe

Path C:\Windows\System\YBdyxxu.exe
Size 5.9MB
SHA256 f40ef6d2bfe1ff21c4646d5dab053a95766777d1652c99653c1506f9b1230411
MD5 fd6e267f0bcbd52c6fff62b165abe0e1
SHA1 bd5d667c74327a1c16d36b63c4e6d11b65d2c5bb
SHA512 0ed853568198752d089efd0410020692ad3802d61b26d7613ce1abfbf229cc137fbaff85a04c26a7ae544b3d33b136a8409a79ab32925a7c132cd5a06fa1f122
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

acGrYlR.exe

Path C:\Windows\System\acGrYlR.exe
Size 5.9MB
SHA256 a76077b8ecef122b87a5e63a9ecd6a9d00c6fe5d5944e560d1c5076cecaebd8c
MD5 160c507c542d620124416ab6125fbb4f
SHA1 66127ee08c2820657bf6a39918866b5cf0eb518b
SHA512 09f5281333b258910f70963291b537d0b207aa9929d0b6d70674518733e44e287dcb67a600289e00c1cab7dd50d809fb86b77bcfb827848ee87e5ab204e1dc40
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

dMIRXCX.exe

Path C:\Windows\System\dMIRXCX.exe
Size 5.9MB
SHA256 4dfd9c834e44a2db57fef388ee9874e73f6c299906b165622c2d06a75a167f40
MD5 7c1bde4b61faef98d1cc431237e9f21b
SHA1 b8511fe6c1a069b805bb6f1a1fa4b4cca785b844
SHA512 08b925e8b25273e4baaf3d02710b2e6a5600b8f86efd53d3ab250824db79138093f1f41c0405977ebad95af6a8026d5bffeecb9e51486c5f2ace42194c102c25
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

fQKHNrX.exe

Path C:\Windows\System\fQKHNrX.exe
Size 5.9MB
SHA256 3fa197f23da9bd90cea4baa1b586bc7527be7f76e7e5b994ea4e7b9950ed8662
MD5 fab322a1f1ca96d2c254bd6cf879b3a2
SHA1 0f4bda38403256647d6dbae52c1f55c5f0b1cf45
SHA512 687909bf571b07ce74ba20b306dedff93afd06bc45adc2cdf63e5243074670a4c2d85ac16ea25ca885c4ea7a84fada4dd05fad8f4715f3bcbb62dd700d08b1d3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jwYKwzQ.exe

Path C:\Windows\System\jwYKwzQ.exe
Size 5.9MB
SHA256 87d7b17ac4f868e14262c1d32d04a42145f3c805acdee8231149cccebaaa6937
MD5 1dabbe3cbb0e51ae5035d0c8108b87b3
SHA1 b78332433ede8011d11f3407c523c9044b2baf3e
SHA512 bd1675acbb45dec941c3f5cd57b97283b8a38ad1b1fd4f2978686e6810c72ed0d5f1b3c686f5538f5d13c343ef76013127c064755669ea0becd11d38dbd8ef26
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

lHaYOFt.exe

Path C:\Windows\System\lHaYOFt.exe
Size 5.9MB
SHA256 620f399abf1a5bfbaba35961c2699843f7156757caa651eebbb5a73319138f33
MD5 9ae76f9b1dc591c3249bfe8985468875
SHA1 e8eecdcec1f9d10fc4bcd61330866c50d3acdcfc
SHA512 b19f40a2b92c87b45f124114cbeb8c75ed4d7ae56b61df96b03f19bfd9d235e1d38de704ad1e49bc115b93b22c321af7040540aab90a409fcfc000c94d2940dc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ltQbMIJ.exe

Path C:\Windows\System\ltQbMIJ.exe
Size 5.9MB
SHA256 f77fb61a5cd669b7a0b5f07e33c3b811b7b7c5be13cdc94a94eee96f0b4717e8
MD5 0081df392cf8d67a3bab4811a65bd0ad
SHA1 eb95437df56f563ad92184a28f6135a2e38f00c3
SHA512 b2d09daad673c38cc97b2394155e393730057572f33ed74ca26a6c4673cfb6ccab5e9f442a8f6695bc41845d0ab8b89150fbfce1bd41f52fd19fdfe65a5c47cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrfKLcv.exe

Path C:\Windows\System\nrfKLcv.exe
Size 5.9MB
SHA256 551b5ae70e262fbb6167caee5ebe8b37645d360ac5b1cf9ca15a451e97c37744
MD5 079aba88152b8ea1473b1fe835d9f3dc
SHA1 575bd308e3992d73d04fcdbcb9f189a6c7eb7581
SHA512 238a01e1df23fcde9684958f3058dad490813eed0bac4bc9f8e4760ece76ef3bec55202eacd97752090bfe231907454c6badb56b4c8d732a20cb05a7bfbadad1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

oBRrzrd.exe

Path C:\Windows\System\oBRrzrd.exe
Size 5.9MB
SHA256 39d96b470aa0610410c6f82a563121e926f20cb90aa1e5a3aa613c397e0ed1b3
MD5 795d9153e788f56cbe5658303a370b05
SHA1 6e56c6a3d3cc155c52e4d6a08eca090deb9f6a41
SHA512 64959c00315ea46c5fdfd075eda63092e0ab594337a84ac05688cc2a87ebf948845acfb4cd986851407147d1f9b7b4e5ff2c988645ea8cd6be7cb0eeea741d3b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

qJtcgzF.exe

Path C:\Windows\System\qJtcgzF.exe
Size 5.9MB
SHA256 bbf345780c37b9e37269f077d0afd4628d011f6c67412b14d34401925d3308bf
MD5 4f6131c760fa39d57e8cfdf1a463c6ff
SHA1 916f58a6fcbb9a450848ef862d392fc51bcbbb1d
SHA512 440fef5cc2a05cc9b8dcc48d749bc54fc9f3a81e25f964955ab1598f1e7e41828aea40adaed64d9d6a640b35be400f4a112196ab18c4712ccf300eeb1d774117
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBdxZJR.exe

Path C:\Windows\System\sBdxZJR.exe
Size 5.9MB
SHA256 88885fd8128f7999fae799d6dab6993f46658af42abb86040d3e53078edac82a
MD5 b4681c8ab93a27038f8157cd50b910d9
SHA1 aeb35cd24173f0954548dbbf27b701a6048bcc23
SHA512 7fc9233df44600ac4c0f6d20b0be0d6c3702ad26fbebebf5afc5d156fc98cef012f96b624f25ba2c4464ae24f42f10772597b98a3414f38b3ff97665bb8d9c0f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xhoAmAe.exe

Path C:\Windows\System\xhoAmAe.exe
Size 5.9MB
SHA256 f796160a962e7e94e311ff17a33ce5a0e4dbc3acd77505dd8f591ebe4b963b48
MD5 16275a8668980be2a38989ee582dc89b
SHA1 b486715019a5d0ace727143d6413b048995828b5
SHA512 62c05f7b562ec0b263dd5064b79ace1a45bac0d575f6ddbe523b5a364e2a7ad0d1f56e75c9c2757b97ca753a2155e552c4059738ca52021f86797dd6e1d27dbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-139-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp

Download

memory/220-122-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp

Download

memory/220-160-0x00007FF71CA10000-0x00007FF71CD64000-memory.dmp

Download

memory/1392-26-0x00007FF799210000-0x00007FF799564000-memory.dmp

Download

memory/1392-144-0x00007FF799210000-0x00007FF799564000-memory.dmp

Download

memory/1684-138-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp

Download

memory/1684-155-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp

Download

memory/1684-86-0x00007FF6A9630000-0x00007FF6A9984000-memory.dmp

Download

memory/1844-74-0x00007FF62F610000-0x00007FF62F964000-memory.dmp

Download

memory/1844-137-0x00007FF62F610000-0x00007FF62F964000-memory.dmp

Download

memory/1844-153-0x00007FF62F610000-0x00007FF62F964000-memory.dmp

Download

memory/1960-162-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp

Download

memory/1960-140-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp

Download

memory/1960-129-0x00007FF7692A0000-0x00007FF7695F4000-memory.dmp

Download

memory/1976-1-0x0000028B21770000-0x0000028B21780000-memory.dmp

Download

memory/1976-0-0x00007FF6975E0000-0x00007FF697934000-memory.dmp

Download

memory/1976-70-0x00007FF6975E0000-0x00007FF697934000-memory.dmp

Download

memory/2444-29-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp

Download

memory/2444-146-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp

Download

memory/2444-108-0x00007FF6EACE0000-0x00007FF6EB034000-memory.dmp

Download

memory/2988-49-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp

Download

memory/2988-147-0x00007FF6D1310000-0x00007FF6D1664000-memory.dmp

Download

memory/3016-150-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp

Download

memory/3016-66-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp

Download

memory/3016-126-0x00007FF64BE80000-0x00007FF64C1D4000-memory.dmp

Download

memory/3044-95-0x00007FF787DC0000-0x00007FF788114000-memory.dmp

Download

memory/3044-16-0x00007FF787DC0000-0x00007FF788114000-memory.dmp

Download

memory/3044-143-0x00007FF787DC0000-0x00007FF788114000-memory.dmp

Download

memory/3252-102-0x00007FF6B5B40000-0x00007FF6B5E94000-memory.dmp

Download

memory/3252-157-0x00007FF6B5B40000-0x00007FF6B5E94000-memory.dmp

Download

memory/3260-158-0x00007FF66C6C0000-0x00007FF66CA14000-memory.dmp

Download

memory/3260-109-0x00007FF66C6C0000-0x00007FF66CA14000-memory.dmp

Download

memory/3396-159-0x00007FF620180000-0x00007FF6204D4000-memory.dmp

Download

memory/3396-121-0x00007FF620180000-0x00007FF6204D4000-memory.dmp

Download

memory/3504-97-0x00007FF716A60000-0x00007FF716DB4000-memory.dmp

Download

memory/3504-156-0x00007FF716A60000-0x00007FF716DB4000-memory.dmp

Download

memory/3704-151-0x00007FF7D8850000-0x00007FF7D8BA4000-memory.dmp

Download

memory/3704-69-0x00007FF7D8850000-0x00007FF7D8BA4000-memory.dmp

Download

memory/3920-101-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp

Download

memory/3920-31-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp

Download

memory/3920-145-0x00007FF7EAC00000-0x00007FF7EAF54000-memory.dmp

Download

memory/4040-152-0x00007FF6033E0000-0x00007FF603734000-memory.dmp

Download

memory/4040-67-0x00007FF6033E0000-0x00007FF603734000-memory.dmp

Download

memory/4040-131-0x00007FF6033E0000-0x00007FF603734000-memory.dmp

Download

memory/4192-8-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp

Download

memory/4192-73-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp

Download

memory/4192-142-0x00007FF6CBB40000-0x00007FF6CBE94000-memory.dmp

Download

memory/4608-123-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp

Download

memory/4608-149-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp

Download

memory/4608-53-0x00007FF602E60000-0x00007FF6031B4000-memory.dmp

Download

memory/4740-148-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp

Download

memory/4740-32-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp

Download

memory/4740-116-0x00007FF7B5220000-0x00007FF7B5574000-memory.dmp

Download

memory/4916-154-0x00007FF725FF0000-0x00007FF726344000-memory.dmp

Download

memory/4916-85-0x00007FF725FF0000-0x00007FF726344000-memory.dmp

Download

memory/4944-141-0x00007FF622610000-0x00007FF622964000-memory.dmp

Download

memory/4944-161-0x00007FF622610000-0x00007FF622964000-memory.dmp

Download

memory/4944-132-0x00007FF622610000-0x00007FF622964000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads