cobaltstrike | a174c4d047964959f39b4a8a48c2fe60b3c850d3718c616aa90d9df0459cdf1b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-p71wtsdg72
SHA256 a174c4d047964959f39b4a8a48c2fe60b3c850d3718c616aa90d9df0459cdf1b
MD5 bc3479ba05efb1bf7760b4353b6506d3
SHA1 e8e5986f34318dabcc0d0acbea34cd37be78be5d
SHA512 5251ed0544087a20e82446c7a7899879024458fc4580e10ec0efbac292d17aa9bd9ecc3f40884bf1dfd3ac9911d869481e54bef88c4e8312e15270a473071ead
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023245-3.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023249-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324b-12.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324c-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324d-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324e-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324f-40.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023250-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023251-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023253-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023254-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023255-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023256-75.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023258-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023259-90.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325a-95.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325c-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325e-114.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325d-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325b-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023257-80.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023245-3.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023249-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324b-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324c-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324d-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324e-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324f-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023250-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023251-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023253-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023254-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023255-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023256-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023258-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023259-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325a-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325c-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325e-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325d-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325b-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023257-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4068-0-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	UPX
behavioral2/files/0x0008000000023245-3.dat	UPX
behavioral2/memory/1116-7-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	UPX
behavioral2/files/0x0008000000023249-10.dat	UPX
behavioral2/files/0x000700000002324b-12.dat	UPX
behavioral2/memory/2612-14-0x00007FF648600000-0x00007FF648954000-memory.dmp	UPX
behavioral2/memory/4012-20-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	UPX
behavioral2/files/0x000700000002324c-23.dat	UPX
behavioral2/files/0x000700000002324d-28.dat	UPX
behavioral2/memory/412-30-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	UPX
behavioral2/memory/2576-26-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	UPX
behavioral2/files/0x000700000002324e-34.dat	UPX
behavioral2/memory/2716-37-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	UPX
behavioral2/files/0x000700000002324f-40.dat	UPX
behavioral2/memory/2084-44-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	UPX
behavioral2/files/0x0007000000023250-48.dat	UPX
behavioral2/files/0x0007000000023251-53.dat	UPX
behavioral2/memory/2564-55-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	UPX
behavioral2/memory/3336-56-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	UPX
behavioral2/files/0x0007000000023253-60.dat	UPX
behavioral2/files/0x0007000000023254-64.dat	UPX
behavioral2/files/0x0007000000023255-70.dat	UPX
behavioral2/files/0x0007000000023256-75.dat	UPX
behavioral2/files/0x0007000000023258-85.dat	UPX
behavioral2/files/0x0007000000023259-90.dat	UPX
behavioral2/files/0x000700000002325a-95.dat	UPX
behavioral2/files/0x000700000002325c-105.dat	UPX
behavioral2/files/0x000700000002325e-114.dat	UPX
behavioral2/files/0x000700000002325d-112.dat	UPX
behavioral2/files/0x000700000002325b-100.dat	UPX
behavioral2/files/0x0007000000023257-80.dat	UPX
behavioral2/memory/4068-116-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	UPX
behavioral2/memory/4088-118-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	UPX
behavioral2/memory/440-119-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	UPX
behavioral2/memory/2156-120-0x00007FF689940000-0x00007FF689C94000-memory.dmp	UPX
behavioral2/memory/1580-121-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	UPX
behavioral2/memory/3892-122-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	UPX
behavioral2/memory/4596-123-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	UPX
behavioral2/memory/1648-117-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	UPX
behavioral2/memory/4336-126-0x00007FF66E9E0000-0x00007FF66ED34000-memory.dmp	UPX
behavioral2/memory/2816-127-0x00007FF611AF0000-0x00007FF611E44000-memory.dmp	UPX
behavioral2/memory/4844-125-0x00007FF7F1FD0000-0x00007FF7F2324000-memory.dmp	UPX
behavioral2/memory/4184-124-0x00007FF7BADA0000-0x00007FF7BB0F4000-memory.dmp	UPX
behavioral2/memory/4708-128-0x00007FF70E530000-0x00007FF70E884000-memory.dmp	UPX
behavioral2/memory/1116-129-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	UPX
behavioral2/memory/412-130-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	UPX
behavioral2/memory/2716-131-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	UPX
behavioral2/memory/2084-132-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	UPX
behavioral2/memory/1116-133-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	UPX
behavioral2/memory/2612-134-0x00007FF648600000-0x00007FF648954000-memory.dmp	UPX
behavioral2/memory/4012-135-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	UPX
behavioral2/memory/2576-136-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	UPX
behavioral2/memory/412-137-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	UPX
behavioral2/memory/2716-138-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	UPX
behavioral2/memory/2084-139-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	UPX
behavioral2/memory/2564-140-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	UPX
behavioral2/memory/3336-141-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	UPX
behavioral2/memory/1648-142-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	UPX
behavioral2/memory/4088-143-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	UPX
behavioral2/memory/440-144-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	UPX
behavioral2/memory/2156-145-0x00007FF689940000-0x00007FF689C94000-memory.dmp	UPX
behavioral2/memory/1580-146-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	UPX
behavioral2/memory/3892-147-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	UPX
behavioral2/memory/4596-148-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4068-0-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	xmrig
behavioral2/files/0x0008000000023245-3.dat	xmrig
behavioral2/memory/1116-7-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	xmrig
behavioral2/files/0x0008000000023249-10.dat	xmrig
behavioral2/files/0x000700000002324b-12.dat	xmrig
behavioral2/memory/2612-14-0x00007FF648600000-0x00007FF648954000-memory.dmp	xmrig
behavioral2/memory/4012-20-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	xmrig
behavioral2/files/0x000700000002324c-23.dat	xmrig
behavioral2/files/0x000700000002324d-28.dat	xmrig
behavioral2/memory/412-30-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	xmrig
behavioral2/memory/2576-26-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002324e-34.dat	xmrig
behavioral2/memory/2716-37-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	xmrig
behavioral2/files/0x000700000002324f-40.dat	xmrig
behavioral2/memory/2084-44-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023250-48.dat	xmrig
behavioral2/files/0x0007000000023251-53.dat	xmrig
behavioral2/memory/2564-55-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	xmrig
behavioral2/memory/3336-56-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023253-60.dat	xmrig
behavioral2/files/0x0007000000023254-64.dat	xmrig
behavioral2/files/0x0007000000023255-70.dat	xmrig
behavioral2/files/0x0007000000023256-75.dat	xmrig
behavioral2/files/0x0007000000023258-85.dat	xmrig
behavioral2/files/0x0007000000023259-90.dat	xmrig
behavioral2/files/0x000700000002325a-95.dat	xmrig
behavioral2/files/0x000700000002325c-105.dat	xmrig
behavioral2/files/0x000700000002325e-114.dat	xmrig
behavioral2/files/0x000700000002325d-112.dat	xmrig
behavioral2/files/0x000700000002325b-100.dat	xmrig
behavioral2/files/0x0007000000023257-80.dat	xmrig
behavioral2/memory/4068-116-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	xmrig
behavioral2/memory/4088-118-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	xmrig
behavioral2/memory/440-119-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	xmrig
behavioral2/memory/2156-120-0x00007FF689940000-0x00007FF689C94000-memory.dmp	xmrig
behavioral2/memory/1580-121-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	xmrig
behavioral2/memory/3892-122-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	xmrig
behavioral2/memory/4596-123-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	xmrig
behavioral2/memory/1648-117-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	xmrig
behavioral2/memory/4336-126-0x00007FF66E9E0000-0x00007FF66ED34000-memory.dmp	xmrig
behavioral2/memory/2816-127-0x00007FF611AF0000-0x00007FF611E44000-memory.dmp	xmrig
behavioral2/memory/4844-125-0x00007FF7F1FD0000-0x00007FF7F2324000-memory.dmp	xmrig
behavioral2/memory/4184-124-0x00007FF7BADA0000-0x00007FF7BB0F4000-memory.dmp	xmrig
behavioral2/memory/4708-128-0x00007FF70E530000-0x00007FF70E884000-memory.dmp	xmrig
behavioral2/memory/1116-129-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	xmrig
behavioral2/memory/412-130-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	xmrig
behavioral2/memory/2716-131-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	xmrig
behavioral2/memory/2084-132-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	xmrig
behavioral2/memory/1116-133-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	xmrig
behavioral2/memory/2612-134-0x00007FF648600000-0x00007FF648954000-memory.dmp	xmrig
behavioral2/memory/4012-135-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	xmrig
behavioral2/memory/2576-136-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	xmrig
behavioral2/memory/412-137-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	xmrig
behavioral2/memory/2716-138-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	xmrig
behavioral2/memory/2084-139-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	xmrig
behavioral2/memory/2564-140-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	xmrig
behavioral2/memory/3336-141-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	xmrig
behavioral2/memory/1648-142-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	xmrig
behavioral2/memory/4088-143-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	xmrig
behavioral2/memory/440-144-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	xmrig
behavioral2/memory/2156-145-0x00007FF689940000-0x00007FF689C94000-memory.dmp	xmrig
behavioral2/memory/1580-146-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	xmrig
behavioral2/memory/3892-147-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	xmrig
behavioral2/memory/4596-148-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1116	sZbRGPf.exe
2612	OLmaFnh.exe
4012	NjUXiFr.exe
2576	eopYwqj.exe
412	TXsdpug.exe
2716	SJZLetr.exe
2084	YqYXvHS.exe
2564	BHfdQzo.exe
3336	qkXUhrS.exe
1648	LbTqgHD.exe
4088	lQqUVKV.exe
440	uOkvRmp.exe
2156	UrXtFNW.exe
1580	JSTtWRZ.exe
3892	LLhpHkB.exe
4596	xMXfeBu.exe
4184	oMbyGAT.exe
4844	NUYQDYV.exe
4336	ngIpZep.exe
2816	ElYhFXM.exe
4708	MXClFIE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4068-0-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	upx
behavioral2/files/0x0008000000023245-3.dat	upx
behavioral2/memory/1116-7-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	upx
behavioral2/files/0x0008000000023249-10.dat	upx
behavioral2/files/0x000700000002324b-12.dat	upx
behavioral2/memory/2612-14-0x00007FF648600000-0x00007FF648954000-memory.dmp	upx
behavioral2/memory/4012-20-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	upx
behavioral2/files/0x000700000002324c-23.dat	upx
behavioral2/files/0x000700000002324d-28.dat	upx
behavioral2/memory/412-30-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	upx
behavioral2/memory/2576-26-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	upx
behavioral2/files/0x000700000002324e-34.dat	upx
behavioral2/memory/2716-37-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	upx
behavioral2/files/0x000700000002324f-40.dat	upx
behavioral2/memory/2084-44-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	upx
behavioral2/files/0x0007000000023250-48.dat	upx
behavioral2/files/0x0007000000023251-53.dat	upx
behavioral2/memory/2564-55-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	upx
behavioral2/memory/3336-56-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	upx
behavioral2/files/0x0007000000023253-60.dat	upx
behavioral2/files/0x0007000000023254-64.dat	upx
behavioral2/files/0x0007000000023255-70.dat	upx
behavioral2/files/0x0007000000023256-75.dat	upx
behavioral2/files/0x0007000000023258-85.dat	upx
behavioral2/files/0x0007000000023259-90.dat	upx
behavioral2/files/0x000700000002325a-95.dat	upx
behavioral2/files/0x000700000002325c-105.dat	upx
behavioral2/files/0x000700000002325e-114.dat	upx
behavioral2/files/0x000700000002325d-112.dat	upx
behavioral2/files/0x000700000002325b-100.dat	upx
behavioral2/files/0x0007000000023257-80.dat	upx
behavioral2/memory/4068-116-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp	upx
behavioral2/memory/4088-118-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	upx
behavioral2/memory/440-119-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	upx
behavioral2/memory/2156-120-0x00007FF689940000-0x00007FF689C94000-memory.dmp	upx
behavioral2/memory/1580-121-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	upx
behavioral2/memory/3892-122-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	upx
behavioral2/memory/4596-123-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	upx
behavioral2/memory/1648-117-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	upx
behavioral2/memory/4336-126-0x00007FF66E9E0000-0x00007FF66ED34000-memory.dmp	upx
behavioral2/memory/2816-127-0x00007FF611AF0000-0x00007FF611E44000-memory.dmp	upx
behavioral2/memory/4844-125-0x00007FF7F1FD0000-0x00007FF7F2324000-memory.dmp	upx
behavioral2/memory/4184-124-0x00007FF7BADA0000-0x00007FF7BB0F4000-memory.dmp	upx
behavioral2/memory/4708-128-0x00007FF70E530000-0x00007FF70E884000-memory.dmp	upx
behavioral2/memory/1116-129-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	upx
behavioral2/memory/412-130-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	upx
behavioral2/memory/2716-131-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	upx
behavioral2/memory/2084-132-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	upx
behavioral2/memory/1116-133-0x00007FF742B10000-0x00007FF742E64000-memory.dmp	upx
behavioral2/memory/2612-134-0x00007FF648600000-0x00007FF648954000-memory.dmp	upx
behavioral2/memory/4012-135-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp	upx
behavioral2/memory/2576-136-0x00007FF795680000-0x00007FF7959D4000-memory.dmp	upx
behavioral2/memory/412-137-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp	upx
behavioral2/memory/2716-138-0x00007FF776ED0000-0x00007FF777224000-memory.dmp	upx
behavioral2/memory/2084-139-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp	upx
behavioral2/memory/2564-140-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp	upx
behavioral2/memory/3336-141-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp	upx
behavioral2/memory/1648-142-0x00007FF6632F0000-0x00007FF663644000-memory.dmp	upx
behavioral2/memory/4088-143-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp	upx
behavioral2/memory/440-144-0x00007FF607080000-0x00007FF6073D4000-memory.dmp	upx
behavioral2/memory/2156-145-0x00007FF689940000-0x00007FF689C94000-memory.dmp	upx
behavioral2/memory/1580-146-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp	upx
behavioral2/memory/3892-147-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp	upx
behavioral2/memory/4596-148-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qkXUhrS.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ngIpZep.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MXClFIE.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oMbyGAT.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sZbRGPf.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TXsdpug.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JSTtWRZ.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xMXfeBu.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lQqUVKV.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uOkvRmp.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UrXtFNW.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LLhpHkB.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OLmaFnh.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NjUXiFr.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YqYXvHS.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LbTqgHD.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NUYQDYV.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ElYhFXM.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eopYwqj.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SJZLetr.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BHfdQzo.exe	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1116	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	91
PID 4068 wrote to memory of 1116	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	91
PID 4068 wrote to memory of 2612	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	92
PID 4068 wrote to memory of 2612	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	92
PID 4068 wrote to memory of 4012	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	93
PID 4068 wrote to memory of 4012	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	93
PID 4068 wrote to memory of 2576	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	94
PID 4068 wrote to memory of 2576	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	94
PID 4068 wrote to memory of 412	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	95
PID 4068 wrote to memory of 412	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	95
PID 4068 wrote to memory of 2716	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	96
PID 4068 wrote to memory of 2716	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	96
PID 4068 wrote to memory of 2084	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	97
PID 4068 wrote to memory of 2084	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	97
PID 4068 wrote to memory of 2564	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	98
PID 4068 wrote to memory of 2564	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	98
PID 4068 wrote to memory of 3336	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	99
PID 4068 wrote to memory of 3336	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	99
PID 4068 wrote to memory of 1648	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	100
PID 4068 wrote to memory of 1648	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	100
PID 4068 wrote to memory of 4088	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	101
PID 4068 wrote to memory of 4088	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	101
PID 4068 wrote to memory of 440	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	102
PID 4068 wrote to memory of 440	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	102
PID 4068 wrote to memory of 2156	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	103
PID 4068 wrote to memory of 2156	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	103
PID 4068 wrote to memory of 1580	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	104
PID 4068 wrote to memory of 1580	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	104
PID 4068 wrote to memory of 3892	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	105
PID 4068 wrote to memory of 3892	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	105
PID 4068 wrote to memory of 4596	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	106
PID 4068 wrote to memory of 4596	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	106
PID 4068 wrote to memory of 4184	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	107
PID 4068 wrote to memory of 4184	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	107
PID 4068 wrote to memory of 4844	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	108
PID 4068 wrote to memory of 4844	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	108
PID 4068 wrote to memory of 4336	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	109
PID 4068 wrote to memory of 4336	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	109
PID 4068 wrote to memory of 2816	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	110
PID 4068 wrote to memory of 2816	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	110
PID 4068 wrote to memory of 4708	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	111
PID 4068 wrote to memory of 4708	4068	2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe	111

C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_bc3479ba05efb1bf7760b4353b6506d3_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\System\sZbRGPf.exe
  C:\Windows\System\sZbRGPf.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\OLmaFnh.exe
  C:\Windows\System\OLmaFnh.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\NjUXiFr.exe
  C:\Windows\System\NjUXiFr.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\eopYwqj.exe
  C:\Windows\System\eopYwqj.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\TXsdpug.exe
  C:\Windows\System\TXsdpug.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\SJZLetr.exe
  C:\Windows\System\SJZLetr.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\YqYXvHS.exe
  C:\Windows\System\YqYXvHS.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\BHfdQzo.exe
  C:\Windows\System\BHfdQzo.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\qkXUhrS.exe
  C:\Windows\System\qkXUhrS.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\LbTqgHD.exe
  C:\Windows\System\LbTqgHD.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\lQqUVKV.exe
  C:\Windows\System\lQqUVKV.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\uOkvRmp.exe
  C:\Windows\System\uOkvRmp.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\UrXtFNW.exe
  C:\Windows\System\UrXtFNW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\JSTtWRZ.exe
  C:\Windows\System\JSTtWRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\LLhpHkB.exe
  C:\Windows\System\LLhpHkB.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\xMXfeBu.exe
  C:\Windows\System\xMXfeBu.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\oMbyGAT.exe
  C:\Windows\System\oMbyGAT.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\NUYQDYV.exe
  C:\Windows\System\NUYQDYV.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\ngIpZep.exe
  C:\Windows\System\ngIpZep.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ElYhFXM.exe
  C:\Windows\System\ElYhFXM.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\MXClFIE.exe
  C:\Windows\System\MXClFIE.exe
  2⤵
  - Executes dropped EXE
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BHfdQzo.exe

Path C:\Windows\System\BHfdQzo.exe
Size 5.9MB
SHA256 f53b00884c9a70f9d2f16e0b892a0d1eaaa8cdc086a20676bbf6819333949c4e
MD5 7feae844e29e24955fd88371b275ce0b
SHA1 95a4466b8a1c2a186d610bdc79853d652199dcee
SHA512 a03dd8bb61e9ecfc6f69b477322635fc83a4492172ccc6f7e57cdd19222c507a1878c84850c872826de19da2266a9fd9ae784e63ebcb2269069ffc64856bdf8f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

ElYhFXM.exe

Path C:\Windows\System\ElYhFXM.exe
Size 5.9MB
SHA256 7079ffd511c9021539c14dccbb4562056f1d1d37e9397a70118fb62fd52f6016
MD5 0ab83a20f9b529476d6e005a22c6b458
SHA1 4072a157b25e7388c696de927509d355467958a8
SHA512 405a8fb925ad554d24eab63e61d5d568d2ea38da4e5bb06d756b1e2289e275209fbee925d10f7382ef47e139a1d77e3e63b1cfa99ef12f376f756124dcf3a707
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

JSTtWRZ.exe

Path C:\Windows\System\JSTtWRZ.exe
Size 5.9MB
SHA256 ec3d677b846a95b53f6b94910a5f9e57fc08d904fac65f42d24763099efc444d
MD5 03beb6f23add356492a13fc24cdff181
SHA1 db3baabb01b13ff2dd9dac37075ec6ae474fcaae
SHA512 2ed0a6174a5fa81977880712cf6d7da983cdd448e90be41b64f90a399248960b426d41966fd42feff9d56c74158f926ec51282067d3787be51abede356087175
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

LLhpHkB.exe

Path C:\Windows\System\LLhpHkB.exe
Size 5.9MB
SHA256 cd4e3f3513335047087c2c34fe5925fc0fd65c00d29374028499a7cb8f8f884a
MD5 e7ed27f7a927a6a35181205a5b4bffa5
SHA1 628fa14fde9ad620c2b5d16434806d946a2dff83
SHA512 a6e7355a4bc3e2df59a16fbdf57f3a7958955f0be8665bc2dfc30552a8e9650b661b54e203139e45469b57a6eb6298128858d86c63a24956991bdf4c5b2c1c89
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

LbTqgHD.exe

Path C:\Windows\System\LbTqgHD.exe
Size 5.9MB
SHA256 a340c9b59e4ddccbcf2d6217a1934c34926e54979d158922d35820e8e1a172ba
MD5 22632b14d41c1034cb1f9e4764e2dcd9
SHA1 3a834280b68e967d9d1848d72360d3788810cad4
SHA512 8eac3d9cc671c417c976d14feef8550dd2329e0ed4a427993fdd1327cd246bac8a8e72a932fbcfa581c6bd7ce1313087fa756cdf8a07f0d3c0f9e936b34ffbb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXClFIE.exe

Path C:\Windows\System\MXClFIE.exe
Size 5.9MB
SHA256 fbc41f744a8b84c500cc5edbd25c14d0c705a2c7dd2c84e56c94202ac1a04368
MD5 7a4e5c2535222bbebbc37a9b654cc1d4
SHA1 3bfb33eb41062262a659e19a039548d17b0a2f02
SHA512 295ba40b6e53156c0b739a88f3db1cfef8efc474e491550d32d4c94fffec82d53b42666c444ccbb4bc4b2b44fb9d1f91ae45916dcf0eef181500540b812b8c45
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

NUYQDYV.exe

Path C:\Windows\System\NUYQDYV.exe
Size 5.9MB
SHA256 6bdba07e87a8c529c1f670eebb9d3bf05712df91baa384a6e21f86b2c2f55760
MD5 2869a3fd51ea5d94ab9d49cc585140e2
SHA1 894bc08ffeef2aae1d050e272d97b05586b429fa
SHA512 1bb95e5f01fb91b2eb5cd5563f9f234c0ddbee76e1ed7d69995e9197fe708d860f9401e272aae118d7d740296d20d2c32afdfa36d5e05b9115ff3e1e0e3c9d87
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

NjUXiFr.exe

Path C:\Windows\System\NjUXiFr.exe
Size 5.9MB
SHA256 58186f47b6eba58012cc43cced4417e6cea73d006790ff6a84728ff970bfc255
MD5 de6cc824f0c497d1cd0a968d5ebe1fe6
SHA1 5d97d99636010b9b38bde280fe57f196f127f045
SHA512 18a74d556b4ea46c08068f1735d038e2f4decdf396d384c5184f45b578c1fd7b316d917904e5534bcdee1249fca21afd37bbd7098830db879f8f7930366182ae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

OLmaFnh.exe

Path C:\Windows\System\OLmaFnh.exe
Size 5.9MB
SHA256 f00355fc62459221fa115281e7db28c587ec03b7fb200b09f63d20a81987da3c
MD5 7acca3ad542d51330b856588053074ac
SHA1 338c97e3831fab8ad0db6896751a833782d6bc5c
SHA512 627ec396fa6ab7ac854591136103c486ef836597c058201cb00ae0642061a796599b24c2201ebe50ec03f9b5cee8df7023a64ec98512b22356aa6b9f4f3d41f8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

SJZLetr.exe

Path C:\Windows\System\SJZLetr.exe
Size 5.9MB
SHA256 5b41890245b391a4a58f39442060a614af6c2be1aed8508efd6101fce7dcc696
MD5 00290ebaa08b760cbd19b719d5659967
SHA1 5edcc524371674ad49c8ff6c884725367cf4bdb2
SHA512 d4aaf662f0e309062f5a26eb3064b797c758c9edd1642e8ed3945ef28711bd8cbe6ec1bb6b5c2714b4e9f69860d6a25a5d83c4942079c1100c859e474f1706d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

TXsdpug.exe

Path C:\Windows\System\TXsdpug.exe
Size 5.9MB
SHA256 0a8a40d2a17f93d043e5417508154f8cf8e9dc3b82c929f4200e6522e5495c66
MD5 25d028955ae1d9ddf018caca788fc5d8
SHA1 72a0439a268e72648c1c44e3cb678c53acd143fd
SHA512 b2fb047ab4f5c07bc8b70540388dd2c901903fef6e801526721512fbd12816007fcbc1f989a6c780af7dcce1e46b0c4d10dbcca266bbf382b68e99d242d87b04
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

UrXtFNW.exe

Path C:\Windows\System\UrXtFNW.exe
Size 5.9MB
SHA256 b0f917fba07aaf7aa8a722385e1c17f876f911fe1d63efe5ef624034e2854e1a
MD5 e819a04495cb70563375b30f9b8e5209
SHA1 21acdf085e50b5897eb163bc70ac4c1654975eef
SHA512 1eff4299c6b37bb24e24ba1a9b918dc3320850cecee786e17dec5ea334d025854ae2b1cfa698dd1114650664d26222f117d2175c41c4344b19617468a4b8068b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

YqYXvHS.exe

Path C:\Windows\System\YqYXvHS.exe
Size 5.9MB
SHA256 8924985f4985c60f04264aafea85d38ecdd67c1c255e01736b9300ef3dd4fdd7
MD5 7202600899f5ae82fca75330c9ff0512
SHA1 c362e9360dd862919b10028d30a6ed4f9a609527
SHA512 f1df4b91f1977c0d0ed38dd286542b150400668403686a1ba9f4b8a27e8d2228e807a6b572f29acc88afa3c1d53d24e9ab1ca333bcb57c946f5a9b9b6a235a88
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

eopYwqj.exe

Path C:\Windows\System\eopYwqj.exe
Size 5.9MB
SHA256 82eeb1f28a8ebbe18451f5ab943a81bbd893b27574a496aef214936194d1a494
MD5 aa045a8eaa9ed061d0a04ba36a82f007
SHA1 0bb983512261b99ffa60039d3df23de74b15d87b
SHA512 36ff2ccf6d03cd149787a09f67a756a9485b59d4dff8d7c9f3a6cfd5fc5ba67bd7b63d979ab616bdf8b9812a28161b1b52b192b7ac47f597f848fc98a99bd85c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

lQqUVKV.exe

Path C:\Windows\System\lQqUVKV.exe
Size 5.9MB
SHA256 61f038c2cfb1e11bfca1d4b72f1af388f6e62a7aaad4dd0a87e52c402a9ec29e
MD5 4fd6482638a2deba7f79f0eba0bc853a
SHA1 62c8ca04e3ed2b4a4d5cbfd723e465704c4d673e
SHA512 bdf40f694a4e6784726220d760448b9a04d129416d0544122b71ad1660e61a0994abffb7bed6573eeca3d2d7f3ebd7285fde870cbb9178601ded32521f485d72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngIpZep.exe

Path C:\Windows\System\ngIpZep.exe
Size 5.9MB
SHA256 db6026ca85927682e2a2f050a99953dccaae8c9122c2758477a303721d43a732
MD5 d84c5c76a842f7e183815c5596c34d8b
SHA1 6d0672a2c8cafb04c7cc1f34bd6d252d1b365d26
SHA512 1ae8d77469f18ce244b8cf12b95f0041ee1dcd735d64807204b3af799d746d526fdafeaf4f594791327b08d2b1f9881e5035647fadb187bcee37448e21300725
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

oMbyGAT.exe

Path C:\Windows\System\oMbyGAT.exe
Size 5.9MB
SHA256 820965ec0ff30416ca53a120b591d3ae66bb8319704f827dd0d278bb0a3e12fb
MD5 7572cfee03cd82b5086ec562913b3399
SHA1 44c5aa38b9c56acd0cba29cfc55b7234dc783b8a
SHA512 c4a438a3824b4f3868ae37e37fdafe19d824343e5db651c861b9218ce358937f633cc165f92c8403f62665a03beaba28ef5be3fcf2a51f2e0062aa63e05e3636
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkXUhrS.exe

Path C:\Windows\System\qkXUhrS.exe
Size 5.9MB
SHA256 289e6b642724c238a2a744f61d7eaedcfdbdcf7902b96c758caf0c71c51c4d6f
MD5 fa72a744b7f6de237031e0bfb06192d4
SHA1 d36ac542a72e2f7c78d42400626bd0ea40cdd10a
SHA512 0fc32b3ab9d8a8d60370d1dbfe89abd06901aebc66526c9cf19a3e5c36ddfe9bbdf5a93cce170d52c8f2270922107aecfd34832d0dc0eda786af5a46432d6ea0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

sZbRGPf.exe

Path C:\Windows\System\sZbRGPf.exe
Size 5.9MB
SHA256 aee07e2a927886bab902ad5d66d6954a0d6464897ed136c886c7aa97af778510
MD5 735750714982e2774368ee2d444658b0
SHA1 a612439e2ca3d29e16a050b0928a67d3e0a7d1f7
SHA512 60c5b5ecc04158b478043f8f82f08e98cf037114132dcc564513e4b8fe008f191212414a7cd5a6e52fba237589f90c13b4480cf3bd6384e565cd5e0263f34656
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

uOkvRmp.exe

Path C:\Windows\System\uOkvRmp.exe
Size 5.9MB
SHA256 69ad4d2ed9def7199b1a8998da7d1a478f8878a21c25f3eb0eac25b2fd7f1040
MD5 a06661b63311bc09f256f5fc7a80e6d5
SHA1 00ea566448a23a5512adabec35f879b2b46f4f44
SHA512 13b6d11f80273fef56f4421ae1dbf550e23f1562872139766c6f84ea2143346af03d4601fd07376f4b950287af44c2be8e9c89de1496887be784d23b6e6dc8ed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

xMXfeBu.exe

Path C:\Windows\System\xMXfeBu.exe
Size 5.9MB
SHA256 581a1855e09192110d57d0034d07c957a4d558063f142b5358f7a6081aa1f773
MD5 bcda70122b83323c7c29fb2a9d317c83
SHA1 3df20724a07e293550a82b02ec5e59bdfb647497
SHA512 5a03ac1f6e712aecaa3372dd3197da286b30f20995a28b455f11a9875fafc1d7865e9e5301abaa460217da420f2a1bbb4e3d1c255ec43ac59f75ce6076d141f9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-137-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp

Download

memory/412-30-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp

Download

memory/412-130-0x00007FF6B0C40000-0x00007FF6B0F94000-memory.dmp

Download

memory/440-119-0x00007FF607080000-0x00007FF6073D4000-memory.dmp

Download

memory/440-144-0x00007FF607080000-0x00007FF6073D4000-memory.dmp

Download

memory/1116-129-0x00007FF742B10000-0x00007FF742E64000-memory.dmp

Download

memory/1116-7-0x00007FF742B10000-0x00007FF742E64000-memory.dmp

Download

memory/1116-133-0x00007FF742B10000-0x00007FF742E64000-memory.dmp

Download

memory/1580-146-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp

Download

memory/1580-121-0x00007FF6CAD40000-0x00007FF6CB094000-memory.dmp

Download

memory/1648-142-0x00007FF6632F0000-0x00007FF663644000-memory.dmp

Download

memory/1648-117-0x00007FF6632F0000-0x00007FF663644000-memory.dmp

Download

memory/2084-44-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp

Download

memory/2084-139-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp

Download

memory/2084-132-0x00007FF6FE730000-0x00007FF6FEA84000-memory.dmp

Download

memory/2156-120-0x00007FF689940000-0x00007FF689C94000-memory.dmp

Download

memory/2156-145-0x00007FF689940000-0x00007FF689C94000-memory.dmp

Download

memory/2564-55-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp

Download

memory/2564-140-0x00007FF64FDB0000-0x00007FF650104000-memory.dmp

Download

memory/2576-26-0x00007FF795680000-0x00007FF7959D4000-memory.dmp

Download

memory/2576-136-0x00007FF795680000-0x00007FF7959D4000-memory.dmp

Download

memory/2612-14-0x00007FF648600000-0x00007FF648954000-memory.dmp

Download

memory/2612-134-0x00007FF648600000-0x00007FF648954000-memory.dmp

Download

memory/2716-37-0x00007FF776ED0000-0x00007FF777224000-memory.dmp

Download

memory/2716-138-0x00007FF776ED0000-0x00007FF777224000-memory.dmp

Download

memory/2716-131-0x00007FF776ED0000-0x00007FF777224000-memory.dmp

Download

memory/2816-153-0x00007FF611AF0000-0x00007FF611E44000-memory.dmp

Download

memory/2816-127-0x00007FF611AF0000-0x00007FF611E44000-memory.dmp

Download

memory/3336-56-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp

Download

memory/3336-141-0x00007FF7F3AD0000-0x00007FF7F3E24000-memory.dmp

Download

memory/3892-147-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp

Download

memory/3892-122-0x00007FF7C5120000-0x00007FF7C5474000-memory.dmp

Download

memory/4012-135-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp

Download

memory/4012-20-0x00007FF6DFDB0000-0x00007FF6E0104000-memory.dmp

Download

memory/4068-1-0x000001E172100000-0x000001E172110000-memory.dmp

Download

memory/4068-116-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp

Download

memory/4068-0-0x00007FF75CD30000-0x00007FF75D084000-memory.dmp

Download

memory/4088-143-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp

Download

memory/4088-118-0x00007FF7CD430000-0x00007FF7CD784000-memory.dmp

Download

memory/4184-124-0x00007FF7BADA0000-0x00007FF7BB0F4000-memory.dmp

Download

memory/4184-149-0x00007FF7BADA0000-0x00007FF7BB0F4000-memory.dmp

Download

memory/4336-126-0x00007FF66E9E0000-0x00007FF66ED34000-memory.dmp

Download

memory/4336-152-0x00007FF66E9E0000-0x00007FF66ED34000-memory.dmp

Download

memory/4596-123-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp

Download

memory/4596-148-0x00007FF6F7B20000-0x00007FF6F7E74000-memory.dmp

Download

memory/4708-128-0x00007FF70E530000-0x00007FF70E884000-memory.dmp

Download

memory/4708-151-0x00007FF70E530000-0x00007FF70E884000-memory.dmp

Download

memory/4844-150-0x00007FF7F1FD0000-0x00007FF7F2324000-memory.dmp

Download

memory/4844-125-0x00007FF7F1FD0000-0x00007FF7F2324000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads