cobaltstrike | 94426f44e9dc893beffb71fa4d845656e54919ffb25e39eefbe709fc1ba776b5

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-y16ceaef46
SHA256 94426f44e9dc893beffb71fa4d845656e54919ffb25e39eefbe709fc1ba776b5
MD5 ce10b479c08cb69a92adfc5080ae62f2
SHA1 5dcf4d17eb80af7b6c89adf365fcd7910b98b009
SHA512 d38c38130e3026bd9302636b66e344fa422635e2b16972e593d3103fbf9dca9798e5cab0e12c89ba28475bf631d1d97e12a98cab0c4554fa1c8a540dd3de337e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:T+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023305-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023466-11.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023462-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023468-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023469-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346b-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346e-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346f-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346d-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346c-49.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346a-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023470-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000022b21-77.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233dc-84.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233e0-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023471-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023472-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023473-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023474-126.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023475-130.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233e1-99.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023305-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023466-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023462-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023468-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023469-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346b-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346e-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346f-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346d-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346c-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346a-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023470-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000022b21-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233dc-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233e0-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023471-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023472-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023473-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023474-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023475-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233e1-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2692-0-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023305-5.dat	UPX
behavioral2/memory/4744-6-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	UPX
behavioral2/files/0x0007000000023466-11.dat	UPX
behavioral2/files/0x0008000000023462-10.dat	UPX
behavioral2/memory/2124-14-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	UPX
behavioral2/memory/3644-18-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023468-23.dat	UPX
behavioral2/memory/2288-26-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023469-28.dat	UPX
behavioral2/memory/2328-31-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	UPX
behavioral2/memory/2876-37-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	UPX
behavioral2/files/0x000700000002346b-42.dat	UPX
behavioral2/files/0x000700000002346e-55.dat	UPX
behavioral2/memory/4356-54-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	UPX
behavioral2/memory/704-62-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	UPX
behavioral2/files/0x000700000002346f-65.dat	UPX
behavioral2/memory/2096-64-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	UPX
behavioral2/memory/1640-63-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	UPX
behavioral2/files/0x000700000002346d-59.dat	UPX
behavioral2/memory/1192-58-0x00007FF6C6650000-0x00007FF6C69A4000-memory.dmp	UPX
behavioral2/files/0x000700000002346c-49.dat	UPX
behavioral2/files/0x000700000002346a-32.dat	UPX
behavioral2/files/0x0007000000023470-71.dat	UPX
behavioral2/memory/3104-74-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	UPX
behavioral2/files/0x0007000000022b21-77.dat	UPX
behavioral2/files/0x000a0000000233dc-84.dat	UPX
behavioral2/memory/1836-81-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	UPX
behavioral2/memory/2692-78-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	UPX
behavioral2/memory/4744-86-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	UPX
behavioral2/files/0x000a0000000233e0-92.dat	UPX
behavioral2/memory/5080-90-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023471-103.dat	UPX
behavioral2/files/0x0007000000023472-107.dat	UPX
behavioral2/memory/180-111-0x00007FF6650E0000-0x00007FF665434000-memory.dmp	UPX
behavioral2/memory/1800-119-0x00007FF68F560000-0x00007FF68F8B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023473-123.dat	UPX
behavioral2/files/0x0007000000023474-126.dat	UPX
behavioral2/files/0x0007000000023475-130.dat	UPX
behavioral2/memory/3628-125-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	UPX
behavioral2/memory/2328-122-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	UPX
behavioral2/memory/3600-121-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	UPX
behavioral2/memory/1064-112-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	UPX
behavioral2/memory/3644-108-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	UPX
behavioral2/files/0x000a0000000233e1-99.dat	UPX
behavioral2/memory/2688-95-0x00007FF759900000-0x00007FF759C54000-memory.dmp	UPX
behavioral2/memory/2124-94-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	UPX
behavioral2/memory/2876-132-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	UPX
behavioral2/memory/3156-134-0x00007FF706900000-0x00007FF706C54000-memory.dmp	UPX
behavioral2/memory/704-133-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	UPX
behavioral2/memory/2096-135-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	UPX
behavioral2/memory/1640-136-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	UPX
behavioral2/memory/3104-137-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	UPX
behavioral2/memory/1836-138-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	UPX
behavioral2/memory/1064-139-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	UPX
behavioral2/memory/3600-140-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	UPX
behavioral2/memory/3628-141-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	UPX
behavioral2/memory/4744-142-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	UPX
behavioral2/memory/2124-143-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	UPX
behavioral2/memory/3644-144-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	UPX
behavioral2/memory/2288-145-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	UPX
behavioral2/memory/2876-146-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	UPX
behavioral2/memory/2328-147-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	UPX
behavioral2/memory/4356-148-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2692-0-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023305-5.dat	xmrig
behavioral2/memory/4744-6-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-11.dat	xmrig
behavioral2/files/0x0008000000023462-10.dat	xmrig
behavioral2/memory/2124-14-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	xmrig
behavioral2/memory/3644-18-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-23.dat	xmrig
behavioral2/memory/2288-26-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023469-28.dat	xmrig
behavioral2/memory/2328-31-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	xmrig
behavioral2/memory/2876-37-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002346b-42.dat	xmrig
behavioral2/files/0x000700000002346e-55.dat	xmrig
behavioral2/memory/4356-54-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	xmrig
behavioral2/memory/704-62-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	xmrig
behavioral2/files/0x000700000002346f-65.dat	xmrig
behavioral2/memory/2096-64-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	xmrig
behavioral2/memory/1640-63-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	xmrig
behavioral2/files/0x000700000002346d-59.dat	xmrig
behavioral2/memory/1192-58-0x00007FF6C6650000-0x00007FF6C69A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002346c-49.dat	xmrig
behavioral2/files/0x000700000002346a-32.dat	xmrig
behavioral2/files/0x0007000000023470-71.dat	xmrig
behavioral2/memory/3104-74-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000022b21-77.dat	xmrig
behavioral2/files/0x000a0000000233dc-84.dat	xmrig
behavioral2/memory/1836-81-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	xmrig
behavioral2/memory/2692-78-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	xmrig
behavioral2/memory/4744-86-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233e0-92.dat	xmrig
behavioral2/memory/5080-90-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-103.dat	xmrig
behavioral2/files/0x0007000000023472-107.dat	xmrig
behavioral2/memory/180-111-0x00007FF6650E0000-0x00007FF665434000-memory.dmp	xmrig
behavioral2/memory/1800-119-0x00007FF68F560000-0x00007FF68F8B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023473-123.dat	xmrig
behavioral2/files/0x0007000000023474-126.dat	xmrig
behavioral2/files/0x0007000000023475-130.dat	xmrig
behavioral2/memory/3628-125-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	xmrig
behavioral2/memory/2328-122-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	xmrig
behavioral2/memory/3600-121-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	xmrig
behavioral2/memory/1064-112-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	xmrig
behavioral2/memory/3644-108-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233e1-99.dat	xmrig
behavioral2/memory/2688-95-0x00007FF759900000-0x00007FF759C54000-memory.dmp	xmrig
behavioral2/memory/2124-94-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	xmrig
behavioral2/memory/2876-132-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	xmrig
behavioral2/memory/3156-134-0x00007FF706900000-0x00007FF706C54000-memory.dmp	xmrig
behavioral2/memory/704-133-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	xmrig
behavioral2/memory/2096-135-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	xmrig
behavioral2/memory/1640-136-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	xmrig
behavioral2/memory/3104-137-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	xmrig
behavioral2/memory/1836-138-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	xmrig
behavioral2/memory/1064-139-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	xmrig
behavioral2/memory/3600-140-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	xmrig
behavioral2/memory/3628-141-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	xmrig
behavioral2/memory/4744-142-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	xmrig
behavioral2/memory/2124-143-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	xmrig
behavioral2/memory/3644-144-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	xmrig
behavioral2/memory/2288-145-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	xmrig
behavioral2/memory/2876-146-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	xmrig
behavioral2/memory/2328-147-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	xmrig
behavioral2/memory/4356-148-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4744	UGMwSrS.exe
2124	YGbTvKu.exe
3644	MOzPegh.exe
2288	ReoUmjU.exe
2328	fqJwYKG.exe
2876	rPtgquq.exe
4356	XkoeDxS.exe
1192	IyZdSQd.exe
704	DKRQUKi.exe
1640	kugsLvY.exe
2096	AXGebah.exe
3104	TswQxhG.exe
1836	JvjDTyV.exe
5080	nAwBBcQ.exe
2688	sKxOevq.exe
180	mCSZtti.exe
1064	ihofZtA.exe
1800	irRejMV.exe
3600	hLIwlgd.exe
3628	TvDrNat.exe
3156	tOhlInM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2692-0-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	upx
behavioral2/files/0x0007000000023305-5.dat	upx
behavioral2/memory/4744-6-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	upx
behavioral2/files/0x0007000000023466-11.dat	upx
behavioral2/files/0x0008000000023462-10.dat	upx
behavioral2/memory/2124-14-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	upx
behavioral2/memory/3644-18-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	upx
behavioral2/files/0x0007000000023468-23.dat	upx
behavioral2/memory/2288-26-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	upx
behavioral2/files/0x0007000000023469-28.dat	upx
behavioral2/memory/2328-31-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	upx
behavioral2/memory/2876-37-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	upx
behavioral2/files/0x000700000002346b-42.dat	upx
behavioral2/files/0x000700000002346e-55.dat	upx
behavioral2/memory/4356-54-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	upx
behavioral2/memory/704-62-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	upx
behavioral2/files/0x000700000002346f-65.dat	upx
behavioral2/memory/2096-64-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	upx
behavioral2/memory/1640-63-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	upx
behavioral2/files/0x000700000002346d-59.dat	upx
behavioral2/memory/1192-58-0x00007FF6C6650000-0x00007FF6C69A4000-memory.dmp	upx
behavioral2/files/0x000700000002346c-49.dat	upx
behavioral2/files/0x000700000002346a-32.dat	upx
behavioral2/files/0x0007000000023470-71.dat	upx
behavioral2/memory/3104-74-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	upx
behavioral2/files/0x0007000000022b21-77.dat	upx
behavioral2/files/0x000a0000000233dc-84.dat	upx
behavioral2/memory/1836-81-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	upx
behavioral2/memory/2692-78-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp	upx
behavioral2/memory/4744-86-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	upx
behavioral2/files/0x000a0000000233e0-92.dat	upx
behavioral2/memory/5080-90-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	upx
behavioral2/files/0x0007000000023471-103.dat	upx
behavioral2/files/0x0007000000023472-107.dat	upx
behavioral2/memory/180-111-0x00007FF6650E0000-0x00007FF665434000-memory.dmp	upx
behavioral2/memory/1800-119-0x00007FF68F560000-0x00007FF68F8B4000-memory.dmp	upx
behavioral2/files/0x0007000000023473-123.dat	upx
behavioral2/files/0x0007000000023474-126.dat	upx
behavioral2/files/0x0007000000023475-130.dat	upx
behavioral2/memory/3628-125-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	upx
behavioral2/memory/2328-122-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	upx
behavioral2/memory/3600-121-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	upx
behavioral2/memory/1064-112-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	upx
behavioral2/memory/3644-108-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	upx
behavioral2/files/0x000a0000000233e1-99.dat	upx
behavioral2/memory/2688-95-0x00007FF759900000-0x00007FF759C54000-memory.dmp	upx
behavioral2/memory/2124-94-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	upx
behavioral2/memory/2876-132-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	upx
behavioral2/memory/3156-134-0x00007FF706900000-0x00007FF706C54000-memory.dmp	upx
behavioral2/memory/704-133-0x00007FF64F400000-0x00007FF64F754000-memory.dmp	upx
behavioral2/memory/2096-135-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp	upx
behavioral2/memory/1640-136-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp	upx
behavioral2/memory/3104-137-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp	upx
behavioral2/memory/1836-138-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp	upx
behavioral2/memory/1064-139-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp	upx
behavioral2/memory/3600-140-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp	upx
behavioral2/memory/3628-141-0x00007FF711880000-0x00007FF711BD4000-memory.dmp	upx
behavioral2/memory/4744-142-0x00007FF6033B0000-0x00007FF603704000-memory.dmp	upx
behavioral2/memory/2124-143-0x00007FF706B00000-0x00007FF706E54000-memory.dmp	upx
behavioral2/memory/3644-144-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp	upx
behavioral2/memory/2288-145-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp	upx
behavioral2/memory/2876-146-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp	upx
behavioral2/memory/2328-147-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp	upx
behavioral2/memory/4356-148-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\sKxOevq.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mCSZtti.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tOhlInM.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YGbTvKu.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rPtgquq.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TswQxhG.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nAwBBcQ.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\irRejMV.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hLIwlgd.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MOzPegh.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XkoeDxS.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DKRQUKi.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JvjDTyV.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ihofZtA.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TvDrNat.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ReoUmjU.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fqJwYKG.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IyZdSQd.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kugsLvY.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UGMwSrS.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AXGebah.exe	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4744	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	83
PID 2692 wrote to memory of 4744	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	83
PID 2692 wrote to memory of 2124	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	84
PID 2692 wrote to memory of 2124	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	84
PID 2692 wrote to memory of 3644	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	85
PID 2692 wrote to memory of 3644	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	85
PID 2692 wrote to memory of 2288	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	89
PID 2692 wrote to memory of 2288	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	89
PID 2692 wrote to memory of 2328	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	90
PID 2692 wrote to memory of 2328	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	90
PID 2692 wrote to memory of 2876	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	91
PID 2692 wrote to memory of 2876	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	91
PID 2692 wrote to memory of 4356	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	92
PID 2692 wrote to memory of 4356	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	92
PID 2692 wrote to memory of 1192	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	93
PID 2692 wrote to memory of 1192	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	93
PID 2692 wrote to memory of 704	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	94
PID 2692 wrote to memory of 704	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	94
PID 2692 wrote to memory of 1640	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	95
PID 2692 wrote to memory of 1640	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	95
PID 2692 wrote to memory of 2096	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	96
PID 2692 wrote to memory of 2096	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	96
PID 2692 wrote to memory of 3104	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	97
PID 2692 wrote to memory of 3104	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	97
PID 2692 wrote to memory of 1836	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	98
PID 2692 wrote to memory of 1836	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	98
PID 2692 wrote to memory of 5080	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	99
PID 2692 wrote to memory of 5080	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	99
PID 2692 wrote to memory of 2688	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	100
PID 2692 wrote to memory of 2688	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	100
PID 2692 wrote to memory of 180	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	101
PID 2692 wrote to memory of 180	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	101
PID 2692 wrote to memory of 1064	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	104
PID 2692 wrote to memory of 1064	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	104
PID 2692 wrote to memory of 1800	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	105
PID 2692 wrote to memory of 1800	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	105
PID 2692 wrote to memory of 3600	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	106
PID 2692 wrote to memory of 3600	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	106
PID 2692 wrote to memory of 3628	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	107
PID 2692 wrote to memory of 3628	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	107
PID 2692 wrote to memory of 3156	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	108
PID 2692 wrote to memory of 3156	2692	2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ce10b479c08cb69a92adfc5080ae62f2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System\UGMwSrS.exe
  C:\Windows\System\UGMwSrS.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\YGbTvKu.exe
  C:\Windows\System\YGbTvKu.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\MOzPegh.exe
  C:\Windows\System\MOzPegh.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\ReoUmjU.exe
  C:\Windows\System\ReoUmjU.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\fqJwYKG.exe
  C:\Windows\System\fqJwYKG.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\rPtgquq.exe
  C:\Windows\System\rPtgquq.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\XkoeDxS.exe
  C:\Windows\System\XkoeDxS.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\IyZdSQd.exe
  C:\Windows\System\IyZdSQd.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\DKRQUKi.exe
  C:\Windows\System\DKRQUKi.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\kugsLvY.exe
  C:\Windows\System\kugsLvY.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\AXGebah.exe
  C:\Windows\System\AXGebah.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\TswQxhG.exe
  C:\Windows\System\TswQxhG.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\JvjDTyV.exe
  C:\Windows\System\JvjDTyV.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\nAwBBcQ.exe
  C:\Windows\System\nAwBBcQ.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\sKxOevq.exe
  C:\Windows\System\sKxOevq.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\mCSZtti.exe
  C:\Windows\System\mCSZtti.exe
  2⤵
  - Executes dropped EXE
  PID:180
- C:\Windows\System\ihofZtA.exe
  C:\Windows\System\ihofZtA.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\irRejMV.exe
  C:\Windows\System\irRejMV.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\hLIwlgd.exe
  C:\Windows\System\hLIwlgd.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\TvDrNat.exe
  C:\Windows\System\TvDrNat.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\tOhlInM.exe
  C:\Windows\System\tOhlInM.exe
  2⤵
  - Executes dropped EXE
  PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AXGebah.exe

Path C:\Windows\System\AXGebah.exe
Size 5.9MB
SHA256 55689bd35abe31f9b0933cf277061a19bd2458c1f707b9caae436add9337a15b
MD5 72ab912df12616d18db0bae4ecd2e95e
SHA1 dabdd564d7c65102e49d625477869427269d60f9
SHA512 0185462e13e9c46268f88f19198ed28acdf2a3d70d25a515a179a7585b8922b98f86f2e9f0d634a2f282b5ccc4aa37464cc3356341d8e30baca42223a7c342b4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:T+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

DKRQUKi.exe

Path C:\Windows\System\DKRQUKi.exe
Size 5.9MB
SHA256 bfbc96caf8b1a7006565b58d525b11dc20ef8ed8a72f0817646040e1ca28793c
MD5 44c5a5b72aea433dc1034b5f0cfb2b05
SHA1 cce650ad0c9eadf8cf990aee2e632c85b5f71d81
SHA512 b243f8e539147ff347a46141757023c2dab30ceb81d787b2d1b6d1f3f07fa3873221699c0582b18774a1dec388f0d793e92f6c33db9a88d5955bf9cda9400518
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:T+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

IyZdSQd.exe

Path C:\Windows\System\IyZdSQd.exe
Size 5.9MB
SHA256 537548fad7851541e0bca1657783eb7893af330edc7c3139e7e1f09ffb5bd42d
MD5 387e11c417cc03964cb8d538d95a6c5c
SHA1 bc8c5999af2b22c1237c2b4a135dc4eb8bd35a68
SHA512 5c50bd57d90ca24351cb01ded2c442da098325b010d07bf464a886b382940a923216b78afc9164a966d152b99802c9dc72b4310410803e4175aa35eb2c952adb
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

JvjDTyV.exe

Path C:\Windows\System\JvjDTyV.exe
Size 5.9MB
SHA256 0aa0487d8f4dd5878987a0b9522812d25d34b8a7cb3b97598c3a18dc428ed14a
MD5 ae36f3923ebc5e09b30b530f28b876c4
SHA1 c7c0a3d13a74398960debadb26ff7e3c581d6c8c
SHA512 b7ffcef9e9ec745ed8494c1a0532e948100de9f6a4fec8a2c2c1944aad4ea9c2451ea6b5f25e5f7750c7fbfb85af6d6e749e0233ccc13b9078bc5829e4572f9e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

MOzPegh.exe

Path C:\Windows\System\MOzPegh.exe
Size 5.9MB
SHA256 cdd8e59c2a4d93db2bbaccf48ef6c3fcf91158a82b480c436821b5831bd1c158
MD5 027b4f7298b833d9e180e134e1e6152d
SHA1 2e31c647834ae3da19986067bdd90dbc3cd2f994
SHA512 e159d02edd86c7d096fe0c86621278f237af79880b42ec0f2749c6947614ccbbdcae50af6bc78980b8b71ce5aecfd2b43bb7fcfc803afc1b477f50bb124533a0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReoUmjU.exe

Path C:\Windows\System\ReoUmjU.exe
Size 5.9MB
SHA256 5e30c4df63b88f7712627205d6d0b187091ba648fb7479ec46765a83fe7f1d80
MD5 d71654cd84bc36265c24c664205e4af4
SHA1 d02a5977fa0adffc39a1e861b3ba9c906504c4ba
SHA512 1dd5c7750cd56928386bbc5a397eeaa961b97653076cbdb865f03c2583bfe6509db2cb6636a2d10c34d51e030165142c93a95359316a557746e05d7dd2c6ea5f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:T+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

TswQxhG.exe

Path C:\Windows\System\TswQxhG.exe
Size 5.9MB
SHA256 bdb30670e735faa86037407c2f74f3fe8c5c0ae78ce3f83e2aee04d07bd6e24c
MD5 00f52de26d7f0e2f39cdc35aff6d1096
SHA1 e9815b9e444056571606c73a1411a998b8048a86
SHA512 2766a23609d1a4f00047d957a7684fbd5de9c17874777d64b9847b69e3d8c2e03f6dba671a42416266251423649c21b7d563445be1609f929c038ce54980cfda
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:T+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvDrNat.exe

Path C:\Windows\System\TvDrNat.exe
Size 5.9MB
SHA256 db2774bc658781c056561045b00d376e523b7dded4cc3580de2455fcaefe87e9
MD5 bd1cb0eff2b4c307c0c96514b1f9bfb6
SHA1 9c3a925036ed03d076a109bf39e68306266a17b8
SHA512 9d7f2d366c7587cccc3779961a062f7fa14b2a12acb1db24b4a18b0c06336f0291ac9d6efc89f7cf7c80e490607cb81da55c3f2bc279e0279473bafff718f4bb
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

UGMwSrS.exe

Path C:\Windows\System\UGMwSrS.exe
Size 5.9MB
SHA256 d3cba3d220d415cc56e5c1ca23a0b2d936e814231570ad804a57f5bc07208d32
MD5 42990c292dfbaa2170de36a127b9a20b
SHA1 6d64ff04adcf966814bf0e860a8b00f6f9258391
SHA512 ef112ad0c314d55dcda0e7137b7c1e584daf6f83aa51b09d15d24ba96177b08ef951c3e4cdb0eeb4c6917f4ee5b344585462a6d07bb947a80f600ed8d511e845
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkoeDxS.exe

Path C:\Windows\System\XkoeDxS.exe
Size 5.9MB
SHA256 7cf1034f00a54c51df9a90dce36b67a212763eb3f264f539227b08f05908bad0
MD5 597f0e8fe99b972e44f802f877ad1550
SHA1 8b505d50cc418b240868017cbafec6a68d49b59e
SHA512 f08f9d734a1ffa437c24aa04cfcdcd95939cdcd737ba0b46e299de12ce7c1cf56889038e31a450cfdf0608cfd686a0d35bb78c7d22f94e3bbd2c864636ff151b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

YGbTvKu.exe

Path C:\Windows\System\YGbTvKu.exe
Size 5.9MB
SHA256 4b9c2e1b38a57c2d2a657168b6d6934526f0cae618a6ae58ad438eb7f9a8f391
MD5 94aec168de8bba8e4443cdfd02b3ab91
SHA1 54e781dd874e72989ebad108cfddee76bb55c18b
SHA512 cb35cdbbad52950601196db020ad9c71a89e2fb4aa4770fcbff3924dded2cef32deb20f43166aa6e55e238a6ebdea540de4339096ec951fbc5eb908593a5e4ce
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqJwYKG.exe

Path C:\Windows\System\fqJwYKG.exe
Size 5.9MB
SHA256 ef33aa8de5a4f4aa24b668da9ea6e08dadc952c1ffe85ff8f1fac88babb1c341
MD5 4918a0ba104eedf9a53b143f41c9ce40
SHA1 fd0c040051e0e4c33c42de679cbd188146553a71
SHA512 e4222a7ebe9d95750917e15c91b5ae1c06a67e925833c3121c0d081b3e238cffb5c1993cc793ec9ce84a20734d9b102a4a86ce16d4e101c32bcab100e0fb1069
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:T+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

hLIwlgd.exe

Path C:\Windows\System\hLIwlgd.exe
Size 5.9MB
SHA256 6138defdd00dc340e80b5412d7f4ced669fbd1afa84cf32693e4df50c052188a
MD5 8693d6929a7251a8f9cc066ce2efbc00
SHA1 6dd4409b117c4bb3822d9990e082c565cf7e67d5
SHA512 72a1d9fdc195dbd3b4b3cc99045f6f7d1e34e406375ddd9ee533b4c946a550a86bb58ac097308e91e4e1e54355f8f2bf6751a4ae441357c814296f8335c70597
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:T+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

ihofZtA.exe

Path C:\Windows\System\ihofZtA.exe
Size 5.9MB
SHA256 bd71f46890602852e57523c3cadee845981af0cfb4b5fb5083e7f8f56b243770
MD5 2c284bf17e6afd12b6dfaf6c246b74fe
SHA1 fe29d93706f963275a92138baff90b1c073ea58c
SHA512 55324a6aa97471844abb52bc5140216184027e68e972414ecc4998eb4c4f5f8da964688e79c46380a46035f797732f5b9affb53611d4667188d6b89266f5feb9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

irRejMV.exe

Path C:\Windows\System\irRejMV.exe
Size 5.9MB
SHA256 a00068f3e33fe979f1d7f93b37b846b57c5771586deea7838d8fa5d62be93cd6
MD5 c0c3500ff2391903da9919d21313bd25
SHA1 87f1b6dc05eb3e70a37db64d8fc58432038366fb
SHA512 910ca6cd61140b4232a7759f0ef7bcd6e861713fd54d57849a0d08a3187c290e491bd02cf3f58aaddb7537fd01cfb2f164c1fef9a3dd6d3ca8c7ba656501a047
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:T+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

kugsLvY.exe

Path C:\Windows\System\kugsLvY.exe
Size 5.9MB
SHA256 b7c9746390fad75190d29c84f04095604fb4981959c50d534d25def825a97bec
MD5 25a2c999bc241bcf8ea6f85c54619cff
SHA1 d46aa28964d4374ba965b126b1b57781478c9ad7
SHA512 8435489ce94382260c07a95999ae9d9567ccc93ebf167da88241c6c11302c970311445799d7d5ca496f7337920e99a86aa4d8331d7e76e950a8b13842b5ac10b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCSZtti.exe

Path C:\Windows\System\mCSZtti.exe
Size 5.9MB
SHA256 df55ac318b7c07999891f0e1237b78c01b1cf492dead52432750f64362168adb
MD5 4d577be729ecc25082d157eed953e528
SHA1 8563f16863b2115d0c09afde01286b8dc2d9434d
SHA512 65eecceee85002c5d7a367be063c0a33d53857c21b33edeb5f6c92ef7cd2b775d7108348c08639cd9d38bd9a8dfbb252243b035c174d9961761b7533698327e7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

nAwBBcQ.exe

Path C:\Windows\System\nAwBBcQ.exe
Size 5.9MB
SHA256 f5b575598e670396ae47a29cc8dda6aa5ea5b6aeec8cfd417529a46c09d501ff
MD5 68a7b275edabd3e96de41b93d5325170
SHA1 2e2f105e0afce12b0c648469e114a91bbc5a515a
SHA512 2d42271a5f539f7cae5627fbe133d22a35b626a54ead83df4d8faf59360f12a3940fc5d661d57c80969960c958fad7f9e4be07811b2934ef068bee92206e2d5f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:T+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

rPtgquq.exe

Path C:\Windows\System\rPtgquq.exe
Size 5.9MB
SHA256 c4be70e7fce4094a9f37a8e5cc751d9c1233406a18f156a539e3dd7c89073b44
MD5 b368aba0ad6d59339bea842a3ade3d34
SHA1 19cf1f452828d975195e672100a48a86271bfa48
SHA512 07326424b3ca8b9f4f680f8bc314c8dcacf62324b72de84040413005be2374920387f1a010d6f11a03bd442baa464b78f171b44c6365af2d3d691abbba060dbc
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

sKxOevq.exe

Path C:\Windows\System\sKxOevq.exe
Size 5.9MB
SHA256 fa319d50d31847058bf02c4a80eece51b30a99160de3af3edfff3232c1f42643
MD5 afcb21f53f68368ae27f71160fff5353
SHA1 19ee06a26a518496dc290fdbc07ccae2b6134906
SHA512 d25ee83a672d0f70596d00ad46799b87832e0e9ce1e2a4d467a98c664875a77593fae071347649c507500320450004a5878bb7f9f93d629d6d600d789cc4001c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOhlInM.exe

Path C:\Windows\System\tOhlInM.exe
Size 5.9MB
SHA256 8a93291aeda63c529cf7250086fbddba9ce89ef7ef9e7e4aadb468c81fa75344
MD5 60ce992c6c348e7f97f6dac49d8da3b9
SHA1 2ff774d3a833a504a2d12c8878a49170bff6623a
SHA512 456cd4d1bb9e3ab2ca5c1a688e58bdd86e852ea782cf7ca2f5fbb6f47cf72ee9e53fae417864e874cf55cecbc3bf6e14901e0c13175aa16b78b1ba7bb58d4208
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/180-157-0x00007FF6650E0000-0x00007FF665434000-memory.dmp

Download

memory/180-111-0x00007FF6650E0000-0x00007FF665434000-memory.dmp

Download

memory/704-62-0x00007FF64F400000-0x00007FF64F754000-memory.dmp

Download

memory/704-133-0x00007FF64F400000-0x00007FF64F754000-memory.dmp

Download

memory/704-150-0x00007FF64F400000-0x00007FF64F754000-memory.dmp

Download

memory/1064-112-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp

Download

memory/1064-139-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp

Download

memory/1064-158-0x00007FF709BC0000-0x00007FF709F14000-memory.dmp

Download

memory/1192-149-0x00007FF6C6650000-0x00007FF6C69A4000-memory.dmp

Download

memory/1192-58-0x00007FF6C6650000-0x00007FF6C69A4000-memory.dmp

Download

memory/1640-63-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp

Download

memory/1640-136-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp

Download

memory/1640-152-0x00007FF6C66B0000-0x00007FF6C6A04000-memory.dmp

Download

memory/1800-119-0x00007FF68F560000-0x00007FF68F8B4000-memory.dmp

Download

memory/1800-159-0x00007FF68F560000-0x00007FF68F8B4000-memory.dmp

Download

memory/1836-155-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp

Download

memory/1836-81-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp

Download

memory/1836-138-0x00007FF7CB390000-0x00007FF7CB6E4000-memory.dmp

Download

memory/2096-64-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp

Download

memory/2096-151-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp

Download

memory/2096-135-0x00007FF6279C0000-0x00007FF627D14000-memory.dmp

Download

memory/2124-14-0x00007FF706B00000-0x00007FF706E54000-memory.dmp

Download

memory/2124-94-0x00007FF706B00000-0x00007FF706E54000-memory.dmp

Download

memory/2124-143-0x00007FF706B00000-0x00007FF706E54000-memory.dmp

Download

memory/2288-145-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp

Download

memory/2288-26-0x00007FF69A780000-0x00007FF69AAD4000-memory.dmp

Download

memory/2328-122-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp

Download

memory/2328-31-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp

Download

memory/2328-147-0x00007FF6176D0000-0x00007FF617A24000-memory.dmp

Download

memory/2688-95-0x00007FF759900000-0x00007FF759C54000-memory.dmp

Download

memory/2688-156-0x00007FF759900000-0x00007FF759C54000-memory.dmp

Download

memory/2692-1-0x0000017F41B80000-0x0000017F41B90000-memory.dmp

Download

memory/2692-78-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp

Download

memory/2692-0-0x00007FF699BA0000-0x00007FF699EF4000-memory.dmp

Download

memory/2876-37-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp

Download

memory/2876-132-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp

Download

memory/2876-146-0x00007FF7ACF80000-0x00007FF7AD2D4000-memory.dmp

Download

memory/3104-137-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp

Download

memory/3104-153-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp

Download

memory/3104-74-0x00007FF6A8770000-0x00007FF6A8AC4000-memory.dmp

Download

memory/3156-134-0x00007FF706900000-0x00007FF706C54000-memory.dmp

Download

memory/3156-162-0x00007FF706900000-0x00007FF706C54000-memory.dmp

Download

memory/3600-121-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp

Download

memory/3600-140-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp

Download

memory/3600-161-0x00007FF7CA4E0000-0x00007FF7CA834000-memory.dmp

Download

memory/3628-125-0x00007FF711880000-0x00007FF711BD4000-memory.dmp

Download

memory/3628-141-0x00007FF711880000-0x00007FF711BD4000-memory.dmp

Download

memory/3628-160-0x00007FF711880000-0x00007FF711BD4000-memory.dmp

Download

memory/3644-18-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp

Download

memory/3644-144-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp

Download

memory/3644-108-0x00007FF70B570000-0x00007FF70B8C4000-memory.dmp

Download

memory/4356-148-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp

Download

memory/4356-54-0x00007FF7CC460000-0x00007FF7CC7B4000-memory.dmp

Download

memory/4744-6-0x00007FF6033B0000-0x00007FF603704000-memory.dmp

Download

memory/4744-142-0x00007FF6033B0000-0x00007FF603704000-memory.dmp

Download

memory/4744-86-0x00007FF6033B0000-0x00007FF603704000-memory.dmp

Download

memory/5080-154-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp

Download

memory/5080-90-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads