cobaltstrike | 4fa4b354c41c6f9dbd6d8a673b088eca478d78495a4996665b0c073d91c24df3

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240602-zmllhsff48
SHA256 4fa4b354c41c6f9dbd6d8a673b088eca478d78495a4996665b0c073d91c24df3
MD5 3cee302246bc86a9cdc8c88a2149425b
SHA1 a4dad0817438a08972f55bf4bce986b9de3e643f
SHA512 b2745ab485099e9d701a5aa833522f69381629ce37732ca690750ee1d6059bd389d89d6886dcdb252fde8b6e7afae43a2eacaf3c6a04f8a2d5ee89a951c8e678
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233e5-6.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002341d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-21.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-38.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-63.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000002296d-78.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002297d-98.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023419-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-107.dat	cobalt_reflective_dll
behavioral2/files/0x000600000002297c-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-122.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-131.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-123.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233e5-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002341d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000002296d-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002297d-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023419-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000600000002297c-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/528-0-0x00007FF637700000-0x00007FF637A54000-memory.dmp	UPX
behavioral2/files/0x00090000000233e5-6.dat	UPX
behavioral2/memory/4084-8-0x00007FF620510000-0x00007FF620864000-memory.dmp	UPX
behavioral2/files/0x000800000002341d-11.dat	UPX
behavioral2/files/0x000700000002341e-10.dat	UPX
behavioral2/files/0x000700000002341f-21.dat	UPX
behavioral2/files/0x0007000000023420-29.dat	UPX
behavioral2/memory/4584-30-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	UPX
behavioral2/files/0x0007000000023421-38.dat	UPX
behavioral2/files/0x0007000000023423-44.dat	UPX
behavioral2/files/0x0007000000023422-48.dat	UPX
behavioral2/memory/2300-55-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	UPX
behavioral2/memory/5052-61-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-67.dat	UPX
behavioral2/files/0x0007000000023424-65.dat	UPX
behavioral2/files/0x0007000000023425-63.dat	UPX
behavioral2/memory/4312-62-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	UPX
behavioral2/memory/3704-58-0x00007FF648530000-0x00007FF648884000-memory.dmp	UPX
behavioral2/memory/1604-52-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	UPX
behavioral2/memory/2396-40-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	UPX
behavioral2/memory/2040-35-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	UPX
behavioral2/memory/2952-23-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	UPX
behavioral2/files/0x000c00000002296d-78.dat	UPX
behavioral2/memory/4084-79-0x00007FF620510000-0x00007FF620864000-memory.dmp	UPX
behavioral2/memory/5108-87-0x00007FF759390000-0x00007FF7596E4000-memory.dmp	UPX
behavioral2/memory/2964-92-0x00007FF6DBAE0000-0x00007FF6DBE34000-memory.dmp	UPX
behavioral2/files/0x000800000002297d-98.dat	UPX
behavioral2/files/0x0009000000023419-100.dat	UPX
behavioral2/files/0x0007000000023428-104.dat	UPX
behavioral2/files/0x0007000000023429-107.dat	UPX
behavioral2/memory/2116-110-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	UPX
behavioral2/memory/4868-111-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	UPX
behavioral2/memory/2764-109-0x00007FF764880000-0x00007FF764BD4000-memory.dmp	UPX
behavioral2/memory/2040-108-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	UPX
behavioral2/memory/3916-94-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	UPX
behavioral2/memory/4584-93-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	UPX
behavioral2/memory/2952-90-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	UPX
behavioral2/files/0x000600000002297c-84.dat	UPX
behavioral2/memory/512-75-0x00007FF6BDA30000-0x00007FF6BDD84000-memory.dmp	UPX
behavioral2/memory/528-74-0x00007FF637700000-0x00007FF637A54000-memory.dmp	UPX
behavioral2/files/0x0007000000023427-71.dat	UPX
behavioral2/memory/4140-18-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-122.dat	UPX
behavioral2/memory/2396-125-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-131.dat	UPX
behavioral2/memory/3704-133-0x00007FF648530000-0x00007FF648884000-memory.dmp	UPX
behavioral2/memory/2844-134-0x00007FF756EC0000-0x00007FF757214000-memory.dmp	UPX
behavioral2/memory/1524-129-0x00007FF687850000-0x00007FF687BA4000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-123.dat	UPX
behavioral2/memory/4500-121-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	UPX
behavioral2/memory/5052-135-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	UPX
behavioral2/memory/4312-136-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	UPX
behavioral2/memory/3916-137-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	UPX
behavioral2/memory/2116-138-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	UPX
behavioral2/memory/4868-139-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	UPX
behavioral2/memory/4500-140-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	UPX
behavioral2/memory/4084-141-0x00007FF620510000-0x00007FF620864000-memory.dmp	UPX
behavioral2/memory/4140-142-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	UPX
behavioral2/memory/2952-143-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	UPX
behavioral2/memory/4584-144-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	UPX
behavioral2/memory/2040-145-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	UPX
behavioral2/memory/2396-146-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	UPX
behavioral2/memory/2300-147-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	UPX
behavioral2/memory/1604-148-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/528-0-0x00007FF637700000-0x00007FF637A54000-memory.dmp	xmrig
behavioral2/files/0x00090000000233e5-6.dat	xmrig
behavioral2/memory/4084-8-0x00007FF620510000-0x00007FF620864000-memory.dmp	xmrig
behavioral2/files/0x000800000002341d-11.dat	xmrig
behavioral2/files/0x000700000002341e-10.dat	xmrig
behavioral2/files/0x000700000002341f-21.dat	xmrig
behavioral2/files/0x0007000000023420-29.dat	xmrig
behavioral2/memory/4584-30-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-38.dat	xmrig
behavioral2/files/0x0007000000023423-44.dat	xmrig
behavioral2/files/0x0007000000023422-48.dat	xmrig
behavioral2/memory/2300-55-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	xmrig
behavioral2/memory/5052-61-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-67.dat	xmrig
behavioral2/files/0x0007000000023424-65.dat	xmrig
behavioral2/files/0x0007000000023425-63.dat	xmrig
behavioral2/memory/4312-62-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	xmrig
behavioral2/memory/3704-58-0x00007FF648530000-0x00007FF648884000-memory.dmp	xmrig
behavioral2/memory/1604-52-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	xmrig
behavioral2/memory/2396-40-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	xmrig
behavioral2/memory/2040-35-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	xmrig
behavioral2/memory/2952-23-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	xmrig
behavioral2/files/0x000c00000002296d-78.dat	xmrig
behavioral2/memory/4084-79-0x00007FF620510000-0x00007FF620864000-memory.dmp	xmrig
behavioral2/memory/5108-87-0x00007FF759390000-0x00007FF7596E4000-memory.dmp	xmrig
behavioral2/memory/2964-92-0x00007FF6DBAE0000-0x00007FF6DBE34000-memory.dmp	xmrig
behavioral2/files/0x000800000002297d-98.dat	xmrig
behavioral2/files/0x0009000000023419-100.dat	xmrig
behavioral2/files/0x0007000000023428-104.dat	xmrig
behavioral2/files/0x0007000000023429-107.dat	xmrig
behavioral2/memory/2116-110-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	xmrig
behavioral2/memory/4868-111-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	xmrig
behavioral2/memory/2764-109-0x00007FF764880000-0x00007FF764BD4000-memory.dmp	xmrig
behavioral2/memory/2040-108-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	xmrig
behavioral2/memory/3916-94-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	xmrig
behavioral2/memory/4584-93-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	xmrig
behavioral2/memory/2952-90-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	xmrig
behavioral2/files/0x000600000002297c-84.dat	xmrig
behavioral2/memory/512-75-0x00007FF6BDA30000-0x00007FF6BDD84000-memory.dmp	xmrig
behavioral2/memory/528-74-0x00007FF637700000-0x00007FF637A54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-71.dat	xmrig
behavioral2/memory/4140-18-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-122.dat	xmrig
behavioral2/memory/2396-125-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-131.dat	xmrig
behavioral2/memory/3704-133-0x00007FF648530000-0x00007FF648884000-memory.dmp	xmrig
behavioral2/memory/2844-134-0x00007FF756EC0000-0x00007FF757214000-memory.dmp	xmrig
behavioral2/memory/1524-129-0x00007FF687850000-0x00007FF687BA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-123.dat	xmrig
behavioral2/memory/4500-121-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	xmrig
behavioral2/memory/5052-135-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	xmrig
behavioral2/memory/4312-136-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	xmrig
behavioral2/memory/3916-137-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	xmrig
behavioral2/memory/2116-138-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	xmrig
behavioral2/memory/4868-139-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	xmrig
behavioral2/memory/4500-140-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	xmrig
behavioral2/memory/4084-141-0x00007FF620510000-0x00007FF620864000-memory.dmp	xmrig
behavioral2/memory/4140-142-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	xmrig
behavioral2/memory/2952-143-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	xmrig
behavioral2/memory/4584-144-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	xmrig
behavioral2/memory/2040-145-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	xmrig
behavioral2/memory/2396-146-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	xmrig
behavioral2/memory/2300-147-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	xmrig
behavioral2/memory/1604-148-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4084	PmpBvVa.exe
4140	mEAbJma.exe
2952	ptpURei.exe
4584	SPTUqoq.exe
2040	UlknaQO.exe
2396	kwfwAJb.exe
1604	tzaBIpy.exe
2300	yJAUHCA.exe
3704	fZeABgg.exe
4312	leAtKpE.exe
5052	ivwlqGg.exe
512	fTVCZgW.exe
5108	WrlexLE.exe
2964	queUmHd.exe
3916	tfQHXuf.exe
2764	iJhkReE.exe
2116	ZEcPGJE.exe
4868	sLNqBMy.exe
4500	rCzmoyl.exe
1524	mfJUwUg.exe
2844	FuzdvpZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/528-0-0x00007FF637700000-0x00007FF637A54000-memory.dmp	upx
behavioral2/files/0x00090000000233e5-6.dat	upx
behavioral2/memory/4084-8-0x00007FF620510000-0x00007FF620864000-memory.dmp	upx
behavioral2/files/0x000800000002341d-11.dat	upx
behavioral2/files/0x000700000002341e-10.dat	upx
behavioral2/files/0x000700000002341f-21.dat	upx
behavioral2/files/0x0007000000023420-29.dat	upx
behavioral2/memory/4584-30-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	upx
behavioral2/files/0x0007000000023421-38.dat	upx
behavioral2/files/0x0007000000023423-44.dat	upx
behavioral2/files/0x0007000000023422-48.dat	upx
behavioral2/memory/2300-55-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	upx
behavioral2/memory/5052-61-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	upx
behavioral2/files/0x0007000000023426-67.dat	upx
behavioral2/files/0x0007000000023424-65.dat	upx
behavioral2/files/0x0007000000023425-63.dat	upx
behavioral2/memory/4312-62-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	upx
behavioral2/memory/3704-58-0x00007FF648530000-0x00007FF648884000-memory.dmp	upx
behavioral2/memory/1604-52-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	upx
behavioral2/memory/2396-40-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	upx
behavioral2/memory/2040-35-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	upx
behavioral2/memory/2952-23-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	upx
behavioral2/files/0x000c00000002296d-78.dat	upx
behavioral2/memory/4084-79-0x00007FF620510000-0x00007FF620864000-memory.dmp	upx
behavioral2/memory/5108-87-0x00007FF759390000-0x00007FF7596E4000-memory.dmp	upx
behavioral2/memory/2964-92-0x00007FF6DBAE0000-0x00007FF6DBE34000-memory.dmp	upx
behavioral2/files/0x000800000002297d-98.dat	upx
behavioral2/files/0x0009000000023419-100.dat	upx
behavioral2/files/0x0007000000023428-104.dat	upx
behavioral2/files/0x0007000000023429-107.dat	upx
behavioral2/memory/2116-110-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	upx
behavioral2/memory/4868-111-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	upx
behavioral2/memory/2764-109-0x00007FF764880000-0x00007FF764BD4000-memory.dmp	upx
behavioral2/memory/2040-108-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	upx
behavioral2/memory/3916-94-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	upx
behavioral2/memory/4584-93-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	upx
behavioral2/memory/2952-90-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	upx
behavioral2/files/0x000600000002297c-84.dat	upx
behavioral2/memory/512-75-0x00007FF6BDA30000-0x00007FF6BDD84000-memory.dmp	upx
behavioral2/memory/528-74-0x00007FF637700000-0x00007FF637A54000-memory.dmp	upx
behavioral2/files/0x0007000000023427-71.dat	upx
behavioral2/memory/4140-18-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	upx
behavioral2/files/0x000700000002342b-122.dat	upx
behavioral2/memory/2396-125-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	upx
behavioral2/files/0x000700000002342c-131.dat	upx
behavioral2/memory/3704-133-0x00007FF648530000-0x00007FF648884000-memory.dmp	upx
behavioral2/memory/2844-134-0x00007FF756EC0000-0x00007FF757214000-memory.dmp	upx
behavioral2/memory/1524-129-0x00007FF687850000-0x00007FF687BA4000-memory.dmp	upx
behavioral2/files/0x000700000002342a-123.dat	upx
behavioral2/memory/4500-121-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	upx
behavioral2/memory/5052-135-0x00007FF6933C0000-0x00007FF693714000-memory.dmp	upx
behavioral2/memory/4312-136-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp	upx
behavioral2/memory/3916-137-0x00007FF6920C0000-0x00007FF692414000-memory.dmp	upx
behavioral2/memory/2116-138-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp	upx
behavioral2/memory/4868-139-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp	upx
behavioral2/memory/4500-140-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp	upx
behavioral2/memory/4084-141-0x00007FF620510000-0x00007FF620864000-memory.dmp	upx
behavioral2/memory/4140-142-0x00007FF640CB0000-0x00007FF641004000-memory.dmp	upx
behavioral2/memory/2952-143-0x00007FF633B10000-0x00007FF633E64000-memory.dmp	upx
behavioral2/memory/4584-144-0x00007FF64E530000-0x00007FF64E884000-memory.dmp	upx
behavioral2/memory/2040-145-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp	upx
behavioral2/memory/2396-146-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp	upx
behavioral2/memory/2300-147-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp	upx
behavioral2/memory/1604-148-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\yJAUHCA.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\leAtKpE.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fTVCZgW.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WrlexLE.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tfQHXuf.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZEcPGJE.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rCzmoyl.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SPTUqoq.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tzaBIpy.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fZeABgg.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ivwlqGg.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iJhkReE.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mfJUwUg.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UlknaQO.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\queUmHd.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sLNqBMy.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FuzdvpZ.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PmpBvVa.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mEAbJma.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ptpURei.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kwfwAJb.exe	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 4084	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	82
PID 528 wrote to memory of 4084	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	82
PID 528 wrote to memory of 4140	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	84
PID 528 wrote to memory of 4140	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	84
PID 528 wrote to memory of 2952	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	86
PID 528 wrote to memory of 2952	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	86
PID 528 wrote to memory of 4584	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	87
PID 528 wrote to memory of 4584	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	87
PID 528 wrote to memory of 2040	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	88
PID 528 wrote to memory of 2040	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	88
PID 528 wrote to memory of 2396	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	89
PID 528 wrote to memory of 2396	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	89
PID 528 wrote to memory of 1604	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	90
PID 528 wrote to memory of 1604	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	90
PID 528 wrote to memory of 2300	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	91
PID 528 wrote to memory of 2300	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	91
PID 528 wrote to memory of 4312	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	92
PID 528 wrote to memory of 4312	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	92
PID 528 wrote to memory of 3704	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	93
PID 528 wrote to memory of 3704	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	93
PID 528 wrote to memory of 5052	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	94
PID 528 wrote to memory of 5052	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	94
PID 528 wrote to memory of 512	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	95
PID 528 wrote to memory of 512	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	95
PID 528 wrote to memory of 5108	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	97
PID 528 wrote to memory of 5108	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	97
PID 528 wrote to memory of 2964	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	98
PID 528 wrote to memory of 2964	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	98
PID 528 wrote to memory of 3916	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	99
PID 528 wrote to memory of 3916	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	99
PID 528 wrote to memory of 2764	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	100
PID 528 wrote to memory of 2764	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	100
PID 528 wrote to memory of 2116	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	101
PID 528 wrote to memory of 2116	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	101
PID 528 wrote to memory of 4868	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	102
PID 528 wrote to memory of 4868	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	102
PID 528 wrote to memory of 4500	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	103
PID 528 wrote to memory of 4500	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	103
PID 528 wrote to memory of 1524	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	106
PID 528 wrote to memory of 1524	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	106
PID 528 wrote to memory of 2844	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	107
PID 528 wrote to memory of 2844	528	2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-02_3cee302246bc86a9cdc8c88a2149425b_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\System\PmpBvVa.exe
  C:\Windows\System\PmpBvVa.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\mEAbJma.exe
  C:\Windows\System\mEAbJma.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\ptpURei.exe
  C:\Windows\System\ptpURei.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\SPTUqoq.exe
  C:\Windows\System\SPTUqoq.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\UlknaQO.exe
  C:\Windows\System\UlknaQO.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\kwfwAJb.exe
  C:\Windows\System\kwfwAJb.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tzaBIpy.exe
  C:\Windows\System\tzaBIpy.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\yJAUHCA.exe
  C:\Windows\System\yJAUHCA.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\leAtKpE.exe
  C:\Windows\System\leAtKpE.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\fZeABgg.exe
  C:\Windows\System\fZeABgg.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\ivwlqGg.exe
  C:\Windows\System\ivwlqGg.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\fTVCZgW.exe
  C:\Windows\System\fTVCZgW.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\WrlexLE.exe
  C:\Windows\System\WrlexLE.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\queUmHd.exe
  C:\Windows\System\queUmHd.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\tfQHXuf.exe
  C:\Windows\System\tfQHXuf.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\iJhkReE.exe
  C:\Windows\System\iJhkReE.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ZEcPGJE.exe
  C:\Windows\System\ZEcPGJE.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\sLNqBMy.exe
  C:\Windows\System\sLNqBMy.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\rCzmoyl.exe
  C:\Windows\System\rCzmoyl.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\mfJUwUg.exe
  C:\Windows\System\mfJUwUg.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\FuzdvpZ.exe
  C:\Windows\System\FuzdvpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FuzdvpZ.exe

Path C:\Windows\System\FuzdvpZ.exe
Size 5.9MB
SHA256 910cb57aa4a17f128517db7735a42a6e2f2b25086d5801c707832dd8d23c9993
MD5 08a7cdc0a681a0cf1b75f791703cdc62
SHA1 d0ba73605f17c1d1b7a02909471dda6e3688881a
SHA512 ae9781abbb4acc3962753e29cf720f793077e493d7da6317531ae00ab926c09d9f1d99fd72ba153d7438538c180d176a85f9e7a9df1e5dbf35037e50bad129bc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

PmpBvVa.exe

Path C:\Windows\System\PmpBvVa.exe
Size 5.9MB
SHA256 b6a1395c965b7f88e9ff515efca6ca2e80774ee813f3b95b115de4441107ffd6
MD5 350588bdc883ed0572006860092b135a
SHA1 94084ef0b33d3366f619799a811a4dd53b9e7238
SHA512 069d252cda5094384017960805f6f9812ee5d5cfee07203eda3f2f0a022bb50c7a41c1fb8b4c1e0601fe1d2ceea76f4e81b3074832ae683e5eca951cb5de88d1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

SPTUqoq.exe

Path C:\Windows\System\SPTUqoq.exe
Size 5.9MB
SHA256 5704c7e13782ea97d303ef2b3d6b0a932e464f44cd4c9a996c201da5a6a5f039
MD5 1c0d0018b586723019505e5fb17e51e4
SHA1 fda080a3b7dee8742da85077a2d88e36f14b4794
SHA512 9a74cd4459fb69ff53a303e3cdc63d3e2047ef56f459469a247115614161c02f6cb9abd81146500397acda37004543b68fac04b311c5f022980b4186bc7dfc67
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

UlknaQO.exe

Path C:\Windows\System\UlknaQO.exe
Size 5.9MB
SHA256 ea7949c3d6410167940434afc581527c32f041025eb76a77613edd7561baddef
MD5 bdc0f519632ffb1bcf83ddb0c3ee7984
SHA1 d00c262fab7821475bc8de8b7a8352dd785ab11f
SHA512 77ac138057d23a0afbf174d0e2d124f5287a08b63d7fcf62c792954ca257584a49e32830e6527cb170c5b07c867cf81e8e36938e32e0ec678f01ce40327e4497
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrlexLE.exe

Path C:\Windows\System\WrlexLE.exe
Size 5.9MB
SHA256 4aa65e3de8367058a372d7ddb523efb2c1a7556a749135630ae998abe449727e
MD5 6c91437f91ceaca6ee8dd84523ce155b
SHA1 9c2571934e67b136ff073f42bbbcc1ef75b3f3bf
SHA512 35b717aee6c1f344f116755927cd5bb06c1e9198d4da95c869edbc32275b0bcbba6cce1998630a6170aa4f235aa3f1a65583624741310f94b0660a20c7291fa2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZEcPGJE.exe

Path C:\Windows\System\ZEcPGJE.exe
Size 5.9MB
SHA256 437bf338b6c0e3d8ba96f4248952a13e7b3dea064bc10e81a3916f53fd328983
MD5 6f4cd011dd2e7b6cfcf80bebd95ab8ce
SHA1 313aa4d606675df50236d070ebae30090327cc15
SHA512 4d9b56aa1d63e360a9eb29713d984234a02d40b91c750b03c52f81327c7329558f9e7797e036b67e7b7c25ca9fa92c9c760a080132f0bba523aa53524f292b33
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTVCZgW.exe

Path C:\Windows\System\fTVCZgW.exe
Size 5.9MB
SHA256 bb66f31c4b9308c77967f25aaf8eeebc30e6b99f2d667f2d296a87ef10a4de62
MD5 3df88eccaa67e32926ff4e54f0947d41
SHA1 82e3d450b7ed4dee7046396b503c42106e7ed1dc
SHA512 e65ddfa463dc0cbf4e1d40b86d2014deaba14aff68c4495ac0d1023ce5334b1b23567cfba335eec0eb950bc3683eb7fa4dc8913aaf48329a78457b1dbb3071db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZeABgg.exe

Path C:\Windows\System\fZeABgg.exe
Size 5.9MB
SHA256 2423d777b4be408f9baa21d255ad3bfb47beea97711a0d6c9371cd7da0071767
MD5 78563e362d6b8c5ed6fc08f79957b377
SHA1 b6db57498f6714134f2e72c28bae18ee11c4afc2
SHA512 32ad30f1c2e9c2fa62ec66faedecf2dbe3f3eff840f34712e1927e39f719ec3b4372600ee2143708b73b34ef88ba467ec0c110dcb89a95b984a232f000e118d0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

iJhkReE.exe

Path C:\Windows\System\iJhkReE.exe
Size 5.9MB
SHA256 9fda38cb0f88af4046e5ee96a8e86ca60d2584a1c58fb5f962adb5a6158cf157
MD5 c94bd32facc66d9d3862fba286e5cccf
SHA1 ae47c9a01d2f6e37b68ef5385fa0d0d8b521898d
SHA512 dd692c9d8fa0fbeaa316e01cf18b7c2da53a9ad0e3fbb73e361a6cb5dd80ab8d5791af4c730e1cf8ebeaff2fab3c2826ddd530bebcc18be778b230b02e0603e6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ivwlqGg.exe

Path C:\Windows\System\ivwlqGg.exe
Size 5.9MB
SHA256 457c5a40d79d875f841d7da66e13fcf09311231726b5287db7bf4d06deb1a0e7
MD5 de1f187219f0581b4453c0f481a87fe3
SHA1 23e7d416a3bc2b7b84c2ab618122f2179d7e85e8
SHA512 a6655a3cd124ca8f4028f7a681211524d7cbc33093cc78f4278c1a26264589004db1c23dab520172d5c5f19ac4b0c38ff4a388596c6267d43629977db34fb01e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwfwAJb.exe

Path C:\Windows\System\kwfwAJb.exe
Size 5.9MB
SHA256 4d708ef49a1d50d531d451c27b9e882073e63f54b7cbe936b05e579a1673eb2a
MD5 68f51ac7e8528fe5523ae77fcfa633cd
SHA1 7cf648d3fb34ffa0202eb41fae5fe29bad5c5c32
SHA512 e4b1e27768d702fbe8a3e79b4790e6f9266638929ea8c405bdd6f6a16af6709bbca7ad61e2538992e3002d661fad7937e354022ee4161c083f51ab35544cacf0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

leAtKpE.exe

Path C:\Windows\System\leAtKpE.exe
Size 5.9MB
SHA256 def5dd14d7765331b4584bc1cb1939bc210672713da37fd7d51a9dc4f3c95c9c
MD5 e964b94c0269bc6e4e9a10938b82aa18
SHA1 fed72d5e487b670b64ed593b8160a8478778c8cf
SHA512 a6748c7e50f77d3b3a5f4aa9fad8cababc10ab25fdb59172749a95f715ff4aed847357cb30339fb0b4186c083e4275182e2605c738da052f1527e11cc2c201ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

mEAbJma.exe

Path C:\Windows\System\mEAbJma.exe
Size 5.9MB
SHA256 22d896f9c81fec4d3d17d66f96d4265a7d08a71a6cb713ccfcac12fedca7eb89
MD5 274982c88554a25224942fe05727e6cd
SHA1 a13f77405185f2aa5dd657b75a62f29787c27177
SHA512 920f008831dfd7c36168b14c1bf8883c02e980a62f387664dd8953ade137302f0e762925e624726aad2746294daab98f2111707f0203a0b783248f1a2113d050
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfJUwUg.exe

Path C:\Windows\System\mfJUwUg.exe
Size 5.9MB
SHA256 7159d2eb880e063fa0cc00959f093412235dbd3a111c72dee0cca01724b4a617
MD5 571dbf6db7eed0964361931950b2ab4a
SHA1 03e80be550fc30b02e6c159e5376b85cd0137f09
SHA512 d169c0bb96d6d6042cd137b9617d5ad696c18eda6c5fa4c5a43a3b864b3ed014807c9cedc7aee047b24ba3d7a5ca15b35675bb34c59e5b09d43157a1b2c672cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ptpURei.exe

Path C:\Windows\System\ptpURei.exe
Size 5.9MB
SHA256 d33c59274a76350c1575a606e9f9a8482a329cde12d616cbbe9163ddfc0e6c1c
MD5 15354c7fd6189f1640c38f31bc44e44d
SHA1 da698183425a315790109e944741d8b844b77d71
SHA512 f73d04966f83e18936eba1c01d5932517e5157138fb7ff7c79d25da999506a1abc0a491f8e8f87dfb959c8346595a661453adaf2d899de897d80d4c37a118ade
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

queUmHd.exe

Path C:\Windows\System\queUmHd.exe
Size 5.9MB
SHA256 f9be7d2799318f3d27ec81af3e327089f720af6f4de85cd0d99ebf4ebb38792a
MD5 97fe49ed251d9c19e538e66dc4f7cbfa
SHA1 018dac25e458e35c9041b77e7ec10bd2eef91022
SHA512 a3f785b918490f7afaea6a9c094f3e519fc9022a4333b1b03f4714ceb9c83cd5503df7b62b9933ff2a156c595a6008fe9307cc4b239cec287031bf48e18be728
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

rCzmoyl.exe

Path C:\Windows\System\rCzmoyl.exe
Size 5.9MB
SHA256 0c2befc52adaecc1a99013cfeabf55188a20c3e208a1bdf7f627d10afce25267
MD5 0112029ddb82bfc93cb91664bdfb090d
SHA1 aec1bb4708352de3e318dba0c544821e361b982e
SHA512 9ac9fd238f11d486b8fa40d9bc6a8ff8cbe68a3bb1e86ce6457e9f4b40d9380027224612b705da9b0de481afaae3626d2fa1a87d01c590b98646d07dfba83690
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

sLNqBMy.exe

Path C:\Windows\System\sLNqBMy.exe
Size 5.9MB
SHA256 cc30353fc8d950ffee3c9bdca257811d54cde46c660a8a9be9424dff299f7928
MD5 05cbdd45dd639da2a2ada86d84d1276d
SHA1 490f6932df99a7487497c931dd2cf73d78555c6f
SHA512 958163d3cb278ed16edae40789226897e513fde6113b8b68dddd3595de03a64e0bd14ca38b2eb9bdfa357b9c00cb00425c96d7753dc9a133075edef4c69b2dc6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

tfQHXuf.exe

Path C:\Windows\System\tfQHXuf.exe
Size 5.9MB
SHA256 bd9793af0b67dfa81c8c415052712f5ad769a4349bd8f2016f27f61eb964e3be
MD5 85ee17fba5283da169b8094cb2d7ba9a
SHA1 91ca1ea91ddc5c0abf54b914552b3e1cc3ed2d1f
SHA512 711896d8f765814d55c2ac98f4c4a9190a121f500d78b3df3a83c51d90c7f603de4c524b494e3073bea1ed013152fa9c5e66396a3c0aeeb81ee99bb998b7377c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

tzaBIpy.exe

Path C:\Windows\System\tzaBIpy.exe
Size 5.9MB
SHA256 cece762c5344aeb05f1a2cd0086f6e6f5d31e0b905c58491fcdea57af9451bab
MD5 3b62d04e8b90377157265f61b2251d0e
SHA1 18e54d469ee786da8d5f3987b8ca3eff747aa887
SHA512 de4871ea7246dca916ff92dbc67bf3180f8fe600138195d9a72003d68630f1ce4150611deda33daa2c2b3405c4c89ac806cfd078f526adb640ab27fe33005ee2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

yJAUHCA.exe

Path C:\Windows\System\yJAUHCA.exe
Size 5.9MB
SHA256 8c00599de4e2ed7805f7a70b7665429522a499214732108aee7a1159970cf40a
MD5 856a6274d7c614dadc6c9b8eade2c125
SHA1 e6b71569d74ae730f4c81462ae2a4de23a1b592e
SHA512 eaae95755862d4b80c3aa98564968c035da4e61f9175a324dda564a5acedb893d71cbc5ec5f57cc7836b25f037177e74ec1c8ddba6b64829db0585ab10eae05a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-75-0x00007FF6BDA30000-0x00007FF6BDD84000-memory.dmp

Download

memory/512-152-0x00007FF6BDA30000-0x00007FF6BDD84000-memory.dmp

Download

memory/528-1-0x000001F44FBA0000-0x000001F44FBB0000-memory.dmp

Download

memory/528-0-0x00007FF637700000-0x00007FF637A54000-memory.dmp

Download

memory/528-74-0x00007FF637700000-0x00007FF637A54000-memory.dmp

Download

memory/1524-160-0x00007FF687850000-0x00007FF687BA4000-memory.dmp

Download

memory/1524-129-0x00007FF687850000-0x00007FF687BA4000-memory.dmp

Download

memory/1604-148-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp

Download

memory/1604-52-0x00007FF60ABA0000-0x00007FF60AEF4000-memory.dmp

Download

memory/2040-145-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp

Download

memory/2040-35-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp

Download

memory/2040-108-0x00007FF609EB0000-0x00007FF60A204000-memory.dmp

Download

memory/2116-110-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp

Download

memory/2116-157-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp

Download

memory/2116-138-0x00007FF74F290000-0x00007FF74F5E4000-memory.dmp

Download

memory/2300-55-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp

Download

memory/2300-147-0x00007FF6CB7E0000-0x00007FF6CBB34000-memory.dmp

Download

memory/2396-40-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp

Download

memory/2396-125-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp

Download

memory/2396-146-0x00007FF636B70000-0x00007FF636EC4000-memory.dmp

Download

memory/2764-156-0x00007FF764880000-0x00007FF764BD4000-memory.dmp

Download

memory/2764-109-0x00007FF764880000-0x00007FF764BD4000-memory.dmp

Download

memory/2844-161-0x00007FF756EC0000-0x00007FF757214000-memory.dmp

Download

memory/2844-134-0x00007FF756EC0000-0x00007FF757214000-memory.dmp

Download

memory/2952-143-0x00007FF633B10000-0x00007FF633E64000-memory.dmp

Download

memory/2952-90-0x00007FF633B10000-0x00007FF633E64000-memory.dmp

Download

memory/2952-23-0x00007FF633B10000-0x00007FF633E64000-memory.dmp

Download

memory/2964-154-0x00007FF6DBAE0000-0x00007FF6DBE34000-memory.dmp

Download

memory/2964-92-0x00007FF6DBAE0000-0x00007FF6DBE34000-memory.dmp

Download

memory/3704-149-0x00007FF648530000-0x00007FF648884000-memory.dmp

Download

memory/3704-133-0x00007FF648530000-0x00007FF648884000-memory.dmp

Download

memory/3704-58-0x00007FF648530000-0x00007FF648884000-memory.dmp

Download

memory/3916-94-0x00007FF6920C0000-0x00007FF692414000-memory.dmp

Download

memory/3916-137-0x00007FF6920C0000-0x00007FF692414000-memory.dmp

Download

memory/3916-155-0x00007FF6920C0000-0x00007FF692414000-memory.dmp

Download

memory/4084-141-0x00007FF620510000-0x00007FF620864000-memory.dmp

Download

memory/4084-8-0x00007FF620510000-0x00007FF620864000-memory.dmp

Download

memory/4084-79-0x00007FF620510000-0x00007FF620864000-memory.dmp

Download

memory/4140-142-0x00007FF640CB0000-0x00007FF641004000-memory.dmp

Download

memory/4140-18-0x00007FF640CB0000-0x00007FF641004000-memory.dmp

Download

memory/4312-62-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp

Download

memory/4312-136-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp

Download

memory/4312-150-0x00007FF7BE520000-0x00007FF7BE874000-memory.dmp

Download

memory/4500-140-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp

Download

memory/4500-121-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp

Download

memory/4500-159-0x00007FF73EB90000-0x00007FF73EEE4000-memory.dmp

Download

memory/4584-30-0x00007FF64E530000-0x00007FF64E884000-memory.dmp

Download

memory/4584-93-0x00007FF64E530000-0x00007FF64E884000-memory.dmp

Download

memory/4584-144-0x00007FF64E530000-0x00007FF64E884000-memory.dmp

Download

memory/4868-111-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp

Download

memory/4868-139-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp

Download

memory/4868-158-0x00007FF6FFD70000-0x00007FF7000C4000-memory.dmp

Download

memory/5052-61-0x00007FF6933C0000-0x00007FF693714000-memory.dmp

Download

memory/5052-135-0x00007FF6933C0000-0x00007FF693714000-memory.dmp

Download

memory/5052-151-0x00007FF6933C0000-0x00007FF693714000-memory.dmp

Download

memory/5108-87-0x00007FF759390000-0x00007FF7596E4000-memory.dmp

Download

memory/5108-153-0x00007FF759390000-0x00007FF7596E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads