cobaltstrike | 9afcac867ef52d96f631444d1eab7bd6e472e2baa7e03ade307305af1da29b99

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-zd59kaeb71
SHA256 9afcac867ef52d96f631444d1eab7bd6e472e2baa7e03ade307305af1da29b99
MD5 ef73b460113e94f25a5cd44410eddd90
SHA1 3a9ffd64bdda68182021bed793f0dc07b1b637ff
SHA512 12513159d8ac43fe047557a9aa87039df12cd459cde49b33064f1196a2d5122d3bb59e8723570840400331077997a8d84753942eece1eb7b1905045038223270
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:T+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002343b-6.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-29.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002343f-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-40.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-43.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344b-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-58.dat	cobalt_reflective_dll
behavioral2/files/0x0006000000022960-86.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002337f-94.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344c-83.dat	cobalt_reflective_dll
behavioral2/files/0x000c000000023384-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344d-107.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344f-121.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023450-128.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023451-130.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344e-113.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002343b-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002343f-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344b-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0006000000022960-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002337f-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344c-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c000000023384-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344d-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344f-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023450-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023451-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344e-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1212-0-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	UPX
behavioral2/files/0x000800000002343b-6.dat	UPX
behavioral2/memory/1844-10-0x00007FF749400000-0x00007FF749754000-memory.dmp	UPX
behavioral2/files/0x0007000000023443-9.dat	UPX
behavioral2/files/0x0007000000023442-11.dat	UPX
behavioral2/memory/3748-12-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	UPX
behavioral2/memory/4668-26-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023444-24.dat	UPX
behavioral2/files/0x0007000000023445-29.dat	UPX
behavioral2/memory/4244-32-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	UPX
behavioral2/memory/2372-21-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	UPX
behavioral2/files/0x000800000002343f-34.dat	UPX
behavioral2/files/0x0007000000023446-40.dat	UPX
behavioral2/files/0x0007000000023447-43.dat	UPX
behavioral2/memory/2028-41-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	UPX
behavioral2/memory/904-46-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	UPX
behavioral2/memory/3696-53-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	UPX
behavioral2/memory/1212-62-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	UPX
behavioral2/files/0x000700000002344b-72.dat	UPX
behavioral2/files/0x000700000002344a-74.dat	UPX
behavioral2/memory/2160-76-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	UPX
behavioral2/memory/3748-73-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	UPX
behavioral2/memory/2748-70-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	UPX
behavioral2/memory/1844-67-0x00007FF749400000-0x00007FF749754000-memory.dmp	UPX
behavioral2/memory/4316-63-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	UPX
behavioral2/files/0x0007000000023449-64.dat	UPX
behavioral2/memory/4808-57-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023448-58.dat	UPX
behavioral2/files/0x0006000000022960-86.dat	UPX
behavioral2/memory/4832-92-0x00007FF668A80000-0x00007FF668DD4000-memory.dmp	UPX
behavioral2/files/0x000a00000002337f-94.dat	UPX
behavioral2/memory/508-93-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	UPX
behavioral2/memory/2784-89-0x00007FF6A2FF0000-0x00007FF6A3344000-memory.dmp	UPX
behavioral2/files/0x000700000002344c-83.dat	UPX
behavioral2/files/0x000c000000023384-98.dat	UPX
behavioral2/files/0x000700000002344d-107.dat	UPX
behavioral2/memory/3696-111-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	UPX
behavioral2/files/0x000700000002344f-121.dat	UPX
behavioral2/files/0x0007000000023450-128.dat	UPX
behavioral2/files/0x0007000000023451-130.dat	UPX
behavioral2/memory/1500-118-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	UPX
behavioral2/files/0x000700000002344e-113.dat	UPX
behavioral2/memory/4308-112-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	UPX
behavioral2/memory/904-109-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	UPX
behavioral2/memory/2052-108-0x00007FF659070000-0x00007FF6593C4000-memory.dmp	UPX
behavioral2/memory/2028-104-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	UPX
behavioral2/memory/4244-101-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	UPX
behavioral2/memory/4808-132-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	UPX
behavioral2/memory/1488-133-0x00007FF648810000-0x00007FF648B64000-memory.dmp	UPX
behavioral2/memory/2288-134-0x00007FF704CE0000-0x00007FF705034000-memory.dmp	UPX
behavioral2/memory/4020-135-0x00007FF717A40000-0x00007FF717D94000-memory.dmp	UPX
behavioral2/memory/4316-136-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	UPX
behavioral2/memory/2748-137-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	UPX
behavioral2/memory/2160-138-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	UPX
behavioral2/memory/508-139-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	UPX
behavioral2/memory/4308-140-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	UPX
behavioral2/memory/1500-141-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	UPX
behavioral2/memory/1844-142-0x00007FF749400000-0x00007FF749754000-memory.dmp	UPX
behavioral2/memory/3748-143-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	UPX
behavioral2/memory/2372-144-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	UPX
behavioral2/memory/4668-145-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	UPX
behavioral2/memory/4244-146-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	UPX
behavioral2/memory/2028-147-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	UPX
behavioral2/memory/3696-148-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1212-0-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	xmrig
behavioral2/files/0x000800000002343b-6.dat	xmrig
behavioral2/memory/1844-10-0x00007FF749400000-0x00007FF749754000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-9.dat	xmrig
behavioral2/files/0x0007000000023442-11.dat	xmrig
behavioral2/memory/3748-12-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	xmrig
behavioral2/memory/4668-26-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-24.dat	xmrig
behavioral2/files/0x0007000000023445-29.dat	xmrig
behavioral2/memory/4244-32-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	xmrig
behavioral2/memory/2372-21-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	xmrig
behavioral2/files/0x000800000002343f-34.dat	xmrig
behavioral2/files/0x0007000000023446-40.dat	xmrig
behavioral2/files/0x0007000000023447-43.dat	xmrig
behavioral2/memory/2028-41-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	xmrig
behavioral2/memory/904-46-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	xmrig
behavioral2/memory/3696-53-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	xmrig
behavioral2/memory/1212-62-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-72.dat	xmrig
behavioral2/files/0x000700000002344a-74.dat	xmrig
behavioral2/memory/2160-76-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	xmrig
behavioral2/memory/3748-73-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	xmrig
behavioral2/memory/2748-70-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	xmrig
behavioral2/memory/1844-67-0x00007FF749400000-0x00007FF749754000-memory.dmp	xmrig
behavioral2/memory/4316-63-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-64.dat	xmrig
behavioral2/memory/4808-57-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-58.dat	xmrig
behavioral2/files/0x0006000000022960-86.dat	xmrig
behavioral2/memory/4832-92-0x00007FF668A80000-0x00007FF668DD4000-memory.dmp	xmrig
behavioral2/files/0x000a00000002337f-94.dat	xmrig
behavioral2/memory/508-93-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	xmrig
behavioral2/memory/2784-89-0x00007FF6A2FF0000-0x00007FF6A3344000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-83.dat	xmrig
behavioral2/files/0x000c000000023384-98.dat	xmrig
behavioral2/files/0x000700000002344d-107.dat	xmrig
behavioral2/memory/3696-111-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-121.dat	xmrig
behavioral2/files/0x0007000000023450-128.dat	xmrig
behavioral2/files/0x0007000000023451-130.dat	xmrig
behavioral2/memory/1500-118-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-113.dat	xmrig
behavioral2/memory/4308-112-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	xmrig
behavioral2/memory/904-109-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	xmrig
behavioral2/memory/2052-108-0x00007FF659070000-0x00007FF6593C4000-memory.dmp	xmrig
behavioral2/memory/2028-104-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	xmrig
behavioral2/memory/4244-101-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	xmrig
behavioral2/memory/4808-132-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	xmrig
behavioral2/memory/1488-133-0x00007FF648810000-0x00007FF648B64000-memory.dmp	xmrig
behavioral2/memory/2288-134-0x00007FF704CE0000-0x00007FF705034000-memory.dmp	xmrig
behavioral2/memory/4020-135-0x00007FF717A40000-0x00007FF717D94000-memory.dmp	xmrig
behavioral2/memory/4316-136-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	xmrig
behavioral2/memory/2748-137-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	xmrig
behavioral2/memory/2160-138-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	xmrig
behavioral2/memory/508-139-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	xmrig
behavioral2/memory/4308-140-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	xmrig
behavioral2/memory/1500-141-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	xmrig
behavioral2/memory/1844-142-0x00007FF749400000-0x00007FF749754000-memory.dmp	xmrig
behavioral2/memory/3748-143-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	xmrig
behavioral2/memory/2372-144-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	xmrig
behavioral2/memory/4668-145-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	xmrig
behavioral2/memory/4244-146-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	xmrig
behavioral2/memory/2028-147-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	xmrig
behavioral2/memory/3696-148-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1844	bmIEaPz.exe
3748	EGKZYNT.exe
2372	QSxpsZz.exe
4668	HowzXfL.exe
4244	suPEUTx.exe
2028	idLkpxN.exe
904	rfUTWQM.exe
3696	xKVwyvI.exe
4808	ppYglCG.exe
4316	FpbGNzl.exe
2748	kiGulMv.exe
2160	QPaRsxM.exe
2784	UxfCAaC.exe
4832	GkSosmn.exe
508	BshKycJ.exe
2052	radaoCk.exe
4308	YXktQYC.exe
1500	fSXdCDm.exe
1488	EzgxItb.exe
2288	WQXOVSH.exe
4020	wIosHsH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1212-0-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	upx
behavioral2/files/0x000800000002343b-6.dat	upx
behavioral2/memory/1844-10-0x00007FF749400000-0x00007FF749754000-memory.dmp	upx
behavioral2/files/0x0007000000023443-9.dat	upx
behavioral2/files/0x0007000000023442-11.dat	upx
behavioral2/memory/3748-12-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	upx
behavioral2/memory/4668-26-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	upx
behavioral2/files/0x0007000000023444-24.dat	upx
behavioral2/files/0x0007000000023445-29.dat	upx
behavioral2/memory/4244-32-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	upx
behavioral2/memory/2372-21-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	upx
behavioral2/files/0x000800000002343f-34.dat	upx
behavioral2/files/0x0007000000023446-40.dat	upx
behavioral2/files/0x0007000000023447-43.dat	upx
behavioral2/memory/2028-41-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	upx
behavioral2/memory/904-46-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	upx
behavioral2/memory/3696-53-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	upx
behavioral2/memory/1212-62-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp	upx
behavioral2/files/0x000700000002344b-72.dat	upx
behavioral2/files/0x000700000002344a-74.dat	upx
behavioral2/memory/2160-76-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	upx
behavioral2/memory/3748-73-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	upx
behavioral2/memory/2748-70-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	upx
behavioral2/memory/1844-67-0x00007FF749400000-0x00007FF749754000-memory.dmp	upx
behavioral2/memory/4316-63-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	upx
behavioral2/files/0x0007000000023449-64.dat	upx
behavioral2/memory/4808-57-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	upx
behavioral2/files/0x0007000000023448-58.dat	upx
behavioral2/files/0x0006000000022960-86.dat	upx
behavioral2/memory/4832-92-0x00007FF668A80000-0x00007FF668DD4000-memory.dmp	upx
behavioral2/files/0x000a00000002337f-94.dat	upx
behavioral2/memory/508-93-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	upx
behavioral2/memory/2784-89-0x00007FF6A2FF0000-0x00007FF6A3344000-memory.dmp	upx
behavioral2/files/0x000700000002344c-83.dat	upx
behavioral2/files/0x000c000000023384-98.dat	upx
behavioral2/files/0x000700000002344d-107.dat	upx
behavioral2/memory/3696-111-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	upx
behavioral2/files/0x000700000002344f-121.dat	upx
behavioral2/files/0x0007000000023450-128.dat	upx
behavioral2/files/0x0007000000023451-130.dat	upx
behavioral2/memory/1500-118-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	upx
behavioral2/files/0x000700000002344e-113.dat	upx
behavioral2/memory/4308-112-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	upx
behavioral2/memory/904-109-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp	upx
behavioral2/memory/2052-108-0x00007FF659070000-0x00007FF6593C4000-memory.dmp	upx
behavioral2/memory/2028-104-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	upx
behavioral2/memory/4244-101-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	upx
behavioral2/memory/4808-132-0x00007FF783980000-0x00007FF783CD4000-memory.dmp	upx
behavioral2/memory/1488-133-0x00007FF648810000-0x00007FF648B64000-memory.dmp	upx
behavioral2/memory/2288-134-0x00007FF704CE0000-0x00007FF705034000-memory.dmp	upx
behavioral2/memory/4020-135-0x00007FF717A40000-0x00007FF717D94000-memory.dmp	upx
behavioral2/memory/4316-136-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp	upx
behavioral2/memory/2748-137-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp	upx
behavioral2/memory/2160-138-0x00007FF7604D0000-0x00007FF760824000-memory.dmp	upx
behavioral2/memory/508-139-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	upx
behavioral2/memory/4308-140-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp	upx
behavioral2/memory/1500-141-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp	upx
behavioral2/memory/1844-142-0x00007FF749400000-0x00007FF749754000-memory.dmp	upx
behavioral2/memory/3748-143-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp	upx
behavioral2/memory/2372-144-0x00007FF60F030000-0x00007FF60F384000-memory.dmp	upx
behavioral2/memory/4668-145-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp	upx
behavioral2/memory/4244-146-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp	upx
behavioral2/memory/2028-147-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp	upx
behavioral2/memory/3696-148-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\rfUTWQM.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UxfCAaC.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GkSosmn.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BshKycJ.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WQXOVSH.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\radaoCk.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fSXdCDm.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EzgxItb.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EGKZYNT.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QSxpsZz.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\suPEUTx.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ppYglCG.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YXktQYC.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wIosHsH.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QPaRsxM.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bmIEaPz.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HowzXfL.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\idLkpxN.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xKVwyvI.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FpbGNzl.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kiGulMv.exe	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1844	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	85
PID 1212 wrote to memory of 1844	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	85
PID 1212 wrote to memory of 3748	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	86
PID 1212 wrote to memory of 3748	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	86
PID 1212 wrote to memory of 2372	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	87
PID 1212 wrote to memory of 2372	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	87
PID 1212 wrote to memory of 4668	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	88
PID 1212 wrote to memory of 4668	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	88
PID 1212 wrote to memory of 4244	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	90
PID 1212 wrote to memory of 4244	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	90
PID 1212 wrote to memory of 2028	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	93
PID 1212 wrote to memory of 2028	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	93
PID 1212 wrote to memory of 904	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	94
PID 1212 wrote to memory of 904	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	94
PID 1212 wrote to memory of 3696	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	95
PID 1212 wrote to memory of 3696	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	95
PID 1212 wrote to memory of 4808	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	96
PID 1212 wrote to memory of 4808	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	96
PID 1212 wrote to memory of 4316	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	97
PID 1212 wrote to memory of 4316	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	97
PID 1212 wrote to memory of 2748	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	98
PID 1212 wrote to memory of 2748	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	98
PID 1212 wrote to memory of 2160	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	99
PID 1212 wrote to memory of 2160	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	99
PID 1212 wrote to memory of 2784	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	100
PID 1212 wrote to memory of 2784	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	100
PID 1212 wrote to memory of 4832	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	101
PID 1212 wrote to memory of 4832	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	101
PID 1212 wrote to memory of 508	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	102
PID 1212 wrote to memory of 508	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	102
PID 1212 wrote to memory of 2052	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	103
PID 1212 wrote to memory of 2052	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	103
PID 1212 wrote to memory of 4308	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	104
PID 1212 wrote to memory of 4308	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	104
PID 1212 wrote to memory of 1500	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	105
PID 1212 wrote to memory of 1500	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	105
PID 1212 wrote to memory of 1488	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	106
PID 1212 wrote to memory of 1488	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	106
PID 1212 wrote to memory of 2288	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	107
PID 1212 wrote to memory of 2288	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	107
PID 1212 wrote to memory of 4020	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	108
PID 1212 wrote to memory of 4020	1212	2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ef73b460113e94f25a5cd44410eddd90_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\System\bmIEaPz.exe
  C:\Windows\System\bmIEaPz.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\EGKZYNT.exe
  C:\Windows\System\EGKZYNT.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\QSxpsZz.exe
  C:\Windows\System\QSxpsZz.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HowzXfL.exe
  C:\Windows\System\HowzXfL.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\suPEUTx.exe
  C:\Windows\System\suPEUTx.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\idLkpxN.exe
  C:\Windows\System\idLkpxN.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\rfUTWQM.exe
  C:\Windows\System\rfUTWQM.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\xKVwyvI.exe
  C:\Windows\System\xKVwyvI.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\ppYglCG.exe
  C:\Windows\System\ppYglCG.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\FpbGNzl.exe
  C:\Windows\System\FpbGNzl.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\kiGulMv.exe
  C:\Windows\System\kiGulMv.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\QPaRsxM.exe
  C:\Windows\System\QPaRsxM.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\UxfCAaC.exe
  C:\Windows\System\UxfCAaC.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\GkSosmn.exe
  C:\Windows\System\GkSosmn.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\BshKycJ.exe
  C:\Windows\System\BshKycJ.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\radaoCk.exe
  C:\Windows\System\radaoCk.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\YXktQYC.exe
  C:\Windows\System\YXktQYC.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\fSXdCDm.exe
  C:\Windows\System\fSXdCDm.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\EzgxItb.exe
  C:\Windows\System\EzgxItb.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\WQXOVSH.exe
  C:\Windows\System\WQXOVSH.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\wIosHsH.exe
  C:\Windows\System\wIosHsH.exe
  2⤵
  - Executes dropped EXE
  PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BshKycJ.exe

Path C:\Windows\System\BshKycJ.exe
Size 5.9MB
SHA256 a61a32e91410b3230f7d400d031889eaab2b596c947038bafcd790992b7b14fd
MD5 92ad87c69f642f2872442addf87c3a62
SHA1 de040fecaaa8f08ef5662d0c0798f9ee6c2766c6
SHA512 34501b905e457f099d135b2a4097a1f7d625c78f3e055d0897e5d2c8bb7401f5be923b311cc8b93c07c54a580716c1f512cc4857c0186da5e77fc84882f4b056
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGKZYNT.exe

Path C:\Windows\System\EGKZYNT.exe
Size 5.9MB
SHA256 ef52044cbd1fc6e799a7c93ddd53e467b39b18c3e0230073c86e4e9a6ba1b251
MD5 041c2b1fb6ff4e23db9fbda8009ade34
SHA1 c65fbc7c512d8d155b22f04c6f52b438ea5c5c1f
SHA512 69a75edf0b11e77bf8780d8ec8f308565b1b469898ba55e4a2b66413e9e576719f0ba6246cf48dcf4b37702522e6207b770526aa42df3f43bc23e70bbff56e37
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

EzgxItb.exe

Path C:\Windows\System\EzgxItb.exe
Size 5.9MB
SHA256 08e960eb821cb3c4830b15824f2630f35d448e0e8296910a9b6a88fd83f9c9bb
MD5 0c63750b66c85d955a986e4fd542a9c0
SHA1 f361da70be5e5b003d754e3a3c5d8e0870813d91
SHA512 07d2c4c37f1caa3ab7879ade9d7b9ba12a65aa2950c5119030dae75576f6b8d357388ae1500c27c3ede87312f5055b6c07d1e1a8fafd368a4a0e4593417ea28c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

FpbGNzl.exe

Path C:\Windows\System\FpbGNzl.exe
Size 5.9MB
SHA256 523d81d2b0dd57b60c0adacf6f01449b56daccc5bf61e41059e5234105c7d9a6
MD5 078e84bafeeef2b93a5c4459e8db0b01
SHA1 a4ce48c8d34e2df74985d5987e3c3b50fb6ea31c
SHA512 9b79d4a816f76da20a715044e2846088a78ffc5880095371b0ab844eb3f90088ddde192fb0855d37aa90d34cd00e8b358b5cda7a5c7df97edbcfd3f5c7f9bc42
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:T+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

GkSosmn.exe

Path C:\Windows\System\GkSosmn.exe
Size 5.9MB
SHA256 5abf46442f7346abc4c483c449c0b7de8538433a30f861f8b225b02982e2e496
MD5 85f03f812e4e1fcb994858caddb046f6
SHA1 93716b5fa4dbfb3ab667ea7aea1f31307dd2d37d
SHA512 8577f9c35d21ae5ff5c27a5748f93e24eef9da4c3055be78a4937bf7c520a87c2e7fd52fe6f6901e8c7b5bca86d09de2ff817d6daeece4e631e9c68928727f4b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

HowzXfL.exe

Path C:\Windows\System\HowzXfL.exe
Size 5.9MB
SHA256 d4dd36662064513d1e11e515ccd0df00cd1438e99b7cd4dad06c5b6da4763fd3
MD5 2916c7adec8d4f286ef55bc0d91c6640
SHA1 af021b5603f282016b7a3affb4f2477fbdb41511
SHA512 ffe2f2d7772b5e7a3991d37218171ee09f0029faa6530668487af5df9449bd53a550c11f5b6e7faf0514e263f959e8108820a11d432571d0d040f6a0995fd3c9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:T+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

QPaRsxM.exe

Path C:\Windows\System\QPaRsxM.exe
Size 5.9MB
SHA256 a1dee098d69cb6305cb35b96ecb203b9f7272b49146952c4e0f25a013e5cc5a8
MD5 dab18069d91c6082214dc3ef9c2545dd
SHA1 515bdea20f73f2729034790b6d88835899929865
SHA512 e45846ed76bfbe18cd2c2c8c31db051cf47beb8fc294f76abb901e9162aae0013ce71a2a82a8925c0ab81783de06db25a72a8bf91674aaaa4fb0de9fe4ac266c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

QSxpsZz.exe

Path C:\Windows\System\QSxpsZz.exe
Size 5.9MB
SHA256 8b451ee6ce25b12f3f6eb33686dfcdfb4d95664b8ebcaa7193c6090b9907d5a6
MD5 c7a28e6a2aa1f06e5d4de3a3a3d9146b
SHA1 5701e397c48ed06a90905d088b590c04804ada8d
SHA512 8e9323bd291a43f6c61ee3f788fcd958b1a8d903c80b8785290fdeee908e80028409c71182caab5c22d688436d897929ea834db2cd8844354e45321e6046d4f7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

UxfCAaC.exe

Path C:\Windows\System\UxfCAaC.exe
Size 5.9MB
SHA256 2dfbd3410adc363d056f34746a2de427ac19f5d42738a2a04b9bfdb70d7eef5f
MD5 172f497e54381ad71fdee870e8ab85cc
SHA1 70c7276161274d9cb51eaf2b638b6ef4efb6fdd4
SHA512 43232b7802f50e97c59658f0737cb1a63d4b5086650a17c76349d9c5b9a4d385a03bee0b0314fd47cd37db2d5e0f0ae302c32b97b5f961931de0ad7878eef85a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

WQXOVSH.exe

Path C:\Windows\System\WQXOVSH.exe
Size 5.9MB
SHA256 ac7792ee79fe39a7605fb0b9ef427917ddccd17e9ca57d12bee895a0b48e7558
MD5 d6b7bd4df76eafee9ab8de342a80df48
SHA1 1aac661d269771c56da5fae3bf5abc5e646183b2
SHA512 752c347e6a07bf91e31dfa4b05c32263ba0c7e0cce903025d4aed1528211891c1502536f73b5f16697fe5a6b14cb8d07ad8cd16dad15c4c083e3e90ecc13804f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

YXktQYC.exe

Path C:\Windows\System\YXktQYC.exe
Size 5.9MB
SHA256 aa434bee8c95b77d1d492e125d375b3ff367fab76a93207e99ffcce3e1e1c325
MD5 5771e979f36ff001471460375b18653c
SHA1 55c8df9a77b15a5b4b558d5e8c5ea622c3e8e573
SHA512 d0ac41d7b23995dfdaacf173768d748dc833058719d4810e2e53cdecf5942af66e2312956950c9a8d1b84c52c59d6424cd9bd6eb1aa5c8585388d60309417ee0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmIEaPz.exe

Path C:\Windows\System\bmIEaPz.exe
Size 5.9MB
SHA256 d41bf7a8d592953cb88a55360edd0578291a943dddfda5ef3c4c86d2ceff113d
MD5 f001587b3f89b3e4793ad8795cbf9b5c
SHA1 23f56f8d6da2d862bddedb1acc628f0b09ed3e33
SHA512 fe2072d355f8266519b58a11b003f7b6f993c39f572594f4bab7a9c6f13c48069f52b2ffc7ad3a6ce06710d60e1bc2df59a9a993a15d3b2967ec952cb9372032
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

fSXdCDm.exe

Path C:\Windows\System\fSXdCDm.exe
Size 5.9MB
SHA256 336558636e8cd1dc73c416ce7cee5d86faa04b853661977ff890a43c9f1b46e2
MD5 1b04ee5af28e5ac34574b4e3c28916c7
SHA1 451126f19fa11fc7da7c87050736a8e62821a22c
SHA512 36b3c0997be2bb4694f5772501576d462cdf9a3819b49cf9325b6323fbb8fec3505fc44e096a69f388ff662eeba4464f3924b23944387bdce9731bf27626733d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

idLkpxN.exe

Path C:\Windows\System\idLkpxN.exe
Size 5.9MB
SHA256 2cb4d930be9bbcb1a96678e332c4534b9ead9f69ff3d7810ae81703c994d75fa
MD5 886ee55daa934329597e02e61d9d35bf
SHA1 135e80673516349b4a8e792ab699042294eed3fe
SHA512 40fc214eba821fb751dc7a292897e3b85afb8e8aa872861c9d39514564fb3e645a61cca6ceacf8376afdaa78be59792a6142c14436120b5464c974bb64af25c9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

kiGulMv.exe

Path C:\Windows\System\kiGulMv.exe
Size 5.9MB
SHA256 8f1741ba51ba98cfe5957bcd41a7e56cac22cb4425b32a152119390622e15d56
MD5 ea08d5acd574a3e8a1c7a2d879795d23
SHA1 d5560c0a3de6be694ebec05a0afab1f5cd2e5d08
SHA512 6885cf40fc46c80f2ab08e4601eada0c22c7b2844e30e4088f602cacef50598c7227d01f1c562aab5d00453fdee4470b159d0642f0dd0e63d091db54d9c95b50
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppYglCG.exe

Path C:\Windows\System\ppYglCG.exe
Size 5.9MB
SHA256 80acb9d4b36cb7b61ee89dc2d07e53b76feef0e55b7a81e0fa3f4db21062f104
MD5 14788391d944ebc0f69c1c7de9d4530c
SHA1 f2af345e7e44e7e39adfe4236ecef10c515dd0cd
SHA512 64917a4a5fe13ffd2c3463b419629fa5bb7d9151ffa43e08b179b76860ede929f389b2ef0a8e8cb2ddd5201c25e8b0e282aa54532012c04e5f22b4ab4d9a1a12
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:T+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

radaoCk.exe

Path C:\Windows\System\radaoCk.exe
Size 5.9MB
SHA256 f5b2ae3e192aa60a5335fc50e1eeafe15caf54f372e21a03a2d2fc7c811d7356
MD5 e1d25f02c48557e952cff6a00438c35b
SHA1 32b1f9a2d01b381b27ee0ea46b67eb4f2819353c
SHA512 0c2c6c8a8551fc7912b442c028ac8ba9f965447f1271f7ba78a3a566138f36a8a41ba9add6e2b65f0fcca0d4da751b195dffc93f3d806315f7c029212a1709ac
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

rfUTWQM.exe

Path C:\Windows\System\rfUTWQM.exe
Size 5.9MB
SHA256 0de65e2738a2d32d1b36dd55d9465c239fc23159de03d915530426b0dbd72fb9
MD5 f1f3ae40158f5e373f286df4aa2266b0
SHA1 0aa9bdc3789d4f7a3306f41334f5996a2df2652f
SHA512 e0d3c83d23345cbb08dda14acbfd3c14aa4dece240c0445d6159910d3659f9b6f3711b8bdac73d1625dbfeac921ec7bf4ac8778e9c98c8317d1d8f6b1152dca1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

suPEUTx.exe

Path C:\Windows\System\suPEUTx.exe
Size 5.9MB
SHA256 964987a5b90300dd0653199dc8d3e4f2469f85323a406f2f5c5007d10ced0b10
MD5 7242b42b8f74320853874d9581c62b4b
SHA1 e815130ee22a0b3ea311c73cb4929b7e760aac3b
SHA512 61a99bf0ba244a329e51051c95935fee80d5da5e6fa8e826c37b4e2d88196e000ed25e425f19bde32e5fab02a21d6a94d6734c4f615a1f522acb008620b25c4f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

wIosHsH.exe

Path C:\Windows\System\wIosHsH.exe
Size 5.9MB
SHA256 8c2842e8dab8b4d3a3b4ef728504ff0412499b8db162e5b3e66969975481fb17
MD5 6bee720f4d49453e2fedd2e77d4da418
SHA1 984640d39a9c547dfe989178e7c69cef8e05aba9
SHA512 7e4c906c003383446a57d8bffb690d046f2f5414d3745d64f3013128e162c320b67542bbde007941d643bd7b8b1ea64c024743e47ccd01b4ad4e2ce43ef5553a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:T+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

xKVwyvI.exe

Path C:\Windows\System\xKVwyvI.exe
Size 5.9MB
SHA256 66191a154685aa3b10587a26fc59210d5d8f81bdc0e700f53c8d541b569a266d
MD5 aa6a892b8d46751c6e171f097be2219a
SHA1 118227b1c99ca445d92861a3c46ddeacd59f4a9e
SHA512 f0774626be1110363218f655f758473a04c94bf23be78ce6d8bf5c3724410befb8fb218a01fa6a0c5a5c8cac728757b99d3f1400b7fda3a8e1139e5ddf02ffdd
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/508-93-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Download

memory/508-156-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Download

memory/508-139-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Download

memory/904-46-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp

Download

memory/904-149-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp

Download

memory/904-109-0x00007FF7539C0000-0x00007FF753D14000-memory.dmp

Download

memory/1212-0-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp

Download

memory/1212-1-0x00000221ED210000-0x00000221ED220000-memory.dmp

Download

memory/1212-62-0x00007FF6C1910000-0x00007FF6C1C64000-memory.dmp

Download

memory/1488-160-0x00007FF648810000-0x00007FF648B64000-memory.dmp

Download

memory/1488-133-0x00007FF648810000-0x00007FF648B64000-memory.dmp

Download

memory/1500-118-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp

Download

memory/1500-141-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp

Download

memory/1500-158-0x00007FF6249B0000-0x00007FF624D04000-memory.dmp

Download

memory/1844-142-0x00007FF749400000-0x00007FF749754000-memory.dmp

Download

memory/1844-10-0x00007FF749400000-0x00007FF749754000-memory.dmp

Download

memory/1844-67-0x00007FF749400000-0x00007FF749754000-memory.dmp

Download

memory/2028-41-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp

Download

memory/2028-147-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp

Download

memory/2028-104-0x00007FF7BE990000-0x00007FF7BECE4000-memory.dmp

Download

memory/2052-157-0x00007FF659070000-0x00007FF6593C4000-memory.dmp

Download

memory/2052-108-0x00007FF659070000-0x00007FF6593C4000-memory.dmp

Download

memory/2160-152-0x00007FF7604D0000-0x00007FF760824000-memory.dmp

Download

memory/2160-138-0x00007FF7604D0000-0x00007FF760824000-memory.dmp

Download

memory/2160-76-0x00007FF7604D0000-0x00007FF760824000-memory.dmp

Download

memory/2288-161-0x00007FF704CE0000-0x00007FF705034000-memory.dmp

Download

memory/2288-134-0x00007FF704CE0000-0x00007FF705034000-memory.dmp

Download

memory/2372-144-0x00007FF60F030000-0x00007FF60F384000-memory.dmp

Download

memory/2372-21-0x00007FF60F030000-0x00007FF60F384000-memory.dmp

Download

memory/2748-137-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp

Download

memory/2748-153-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp

Download

memory/2748-70-0x00007FF63A890000-0x00007FF63ABE4000-memory.dmp

Download

memory/2784-89-0x00007FF6A2FF0000-0x00007FF6A3344000-memory.dmp

Download

memory/2784-154-0x00007FF6A2FF0000-0x00007FF6A3344000-memory.dmp

Download

memory/3696-53-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp

Download

memory/3696-111-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp

Download

memory/3696-148-0x00007FF7A6960000-0x00007FF7A6CB4000-memory.dmp

Download

memory/3748-12-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp

Download

memory/3748-73-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp

Download

memory/3748-143-0x00007FF6FC800000-0x00007FF6FCB54000-memory.dmp

Download

memory/4020-135-0x00007FF717A40000-0x00007FF717D94000-memory.dmp

Download

memory/4020-162-0x00007FF717A40000-0x00007FF717D94000-memory.dmp

Download

memory/4244-32-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp

Download

memory/4244-101-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp

Download

memory/4244-146-0x00007FF6E64F0000-0x00007FF6E6844000-memory.dmp

Download

memory/4308-159-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp

Download

memory/4308-112-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp

Download

memory/4308-140-0x00007FF7D3E20000-0x00007FF7D4174000-memory.dmp

Download

memory/4316-151-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp

Download

memory/4316-136-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp

Download

memory/4316-63-0x00007FF6269E0000-0x00007FF626D34000-memory.dmp

Download

memory/4668-26-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp

Download

memory/4668-145-0x00007FF74DF80000-0x00007FF74E2D4000-memory.dmp

Download

memory/4808-132-0x00007FF783980000-0x00007FF783CD4000-memory.dmp

Download

memory/4808-150-0x00007FF783980000-0x00007FF783CD4000-memory.dmp

Download

memory/4808-57-0x00007FF783980000-0x00007FF783CD4000-memory.dmp

Download

memory/4832-155-0x00007FF668A80000-0x00007FF668DD4000-memory.dmp

Download

memory/4832-92-0x00007FF668A80000-0x00007FF668DD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads