cobaltstrike | 28c844728899e907d73a4180665af86d5c4be6f6a404112cf8fc271fcef847f9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-apylesce4y
SHA256 28c844728899e907d73a4180665af86d5c4be6f6a404112cf8fc271fcef847f9
MD5 0fcc4e571283972fbb34217abe05ffa6
SHA1 143c425348157895e973c17989b7bda979b23f2a
SHA512 cffc7c7c563244ccaaa2f13f773a06def0f4a6b729b490f2d8e581a2f5b8f6726c539df238a24d636e73a524f150d2714352511dac4e28f8bbfca69abec8e27e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000233f2-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-17.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-24.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-30.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f3-35.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-57.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-69.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-81.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-120.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-75.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-62.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-52.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233f2-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f3-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2008-0-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	UPX
behavioral2/files/0x00080000000233f2-5.dat	UPX
behavioral2/memory/2084-8-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f6-10.dat	UPX
behavioral2/memory/2860-14-0x00007FF793200000-0x00007FF793554000-memory.dmp	UPX
behavioral2/files/0x00070000000233f7-17.dat	UPX
behavioral2/files/0x00070000000233f8-24.dat	UPX
behavioral2/memory/4900-26-0x00007FF788430000-0x00007FF788784000-memory.dmp	UPX
behavioral2/memory/2760-22-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-30.dat	UPX
behavioral2/memory/404-32-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	UPX
behavioral2/files/0x00080000000233f3-35.dat	UPX
behavioral2/files/0x00070000000233fa-41.dat	UPX
behavioral2/files/0x00070000000233fb-47.dat	UPX
behavioral2/files/0x00070000000233fd-57.dat	UPX
behavioral2/files/0x00070000000233ff-69.dat	UPX
behavioral2/files/0x0007000000023402-81.dat	UPX
behavioral2/memory/3752-95-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	UPX
behavioral2/memory/2608-100-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	UPX
behavioral2/memory/4956-104-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	UPX
behavioral2/memory/1400-112-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-120.dat	UPX
behavioral2/memory/4408-127-0x00007FF7EB9D0000-0x00007FF7EBD24000-memory.dmp	UPX
behavioral2/memory/2020-126-0x00007FF74ADE0000-0x00007FF74B134000-memory.dmp	UPX
behavioral2/memory/2404-125-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-123.dat	UPX
behavioral2/memory/452-122-0x00007FF6395B0000-0x00007FF639904000-memory.dmp	UPX
behavioral2/memory/692-119-0x00007FF719400000-0x00007FF719754000-memory.dmp	UPX
behavioral2/files/0x0007000000023406-116.dat	UPX
behavioral2/memory/4396-115-0x00007FF6986E0000-0x00007FF698A34000-memory.dmp	UPX
behavioral2/memory/4140-108-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	UPX
behavioral2/memory/3252-107-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	UPX
behavioral2/files/0x0007000000023405-102.dat	UPX
behavioral2/memory/3092-101-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	UPX
behavioral2/files/0x0007000000023404-98.dat	UPX
behavioral2/memory/3588-97-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	UPX
behavioral2/memory/4372-90-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-89.dat	UPX
behavioral2/files/0x0007000000023401-79.dat	UPX
behavioral2/files/0x0007000000023400-75.dat	UPX
behavioral2/files/0x00070000000233fe-62.dat	UPX
behavioral2/files/0x00070000000233fc-52.dat	UPX
behavioral2/memory/5064-38-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	UPX
behavioral2/memory/2008-128-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	UPX
behavioral2/memory/2084-129-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	UPX
behavioral2/memory/2860-130-0x00007FF793200000-0x00007FF793554000-memory.dmp	UPX
behavioral2/memory/2760-131-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	UPX
behavioral2/memory/404-132-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	UPX
behavioral2/memory/2084-133-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	UPX
behavioral2/memory/2860-134-0x00007FF793200000-0x00007FF793554000-memory.dmp	UPX
behavioral2/memory/2760-135-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	UPX
behavioral2/memory/4900-136-0x00007FF788430000-0x00007FF788784000-memory.dmp	UPX
behavioral2/memory/404-137-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	UPX
behavioral2/memory/5064-138-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	UPX
behavioral2/memory/4372-139-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/memory/3752-140-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	UPX
behavioral2/memory/692-141-0x00007FF719400000-0x00007FF719754000-memory.dmp	UPX
behavioral2/memory/2608-143-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	UPX
behavioral2/memory/3588-142-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	UPX
behavioral2/memory/3092-144-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	UPX
behavioral2/memory/4956-145-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	UPX
behavioral2/memory/3252-146-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	UPX
behavioral2/memory/4140-147-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	UPX
behavioral2/memory/1400-148-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2008-0-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f2-5.dat	xmrig
behavioral2/memory/2084-8-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f6-10.dat	xmrig
behavioral2/memory/2860-14-0x00007FF793200000-0x00007FF793554000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-17.dat	xmrig
behavioral2/files/0x00070000000233f8-24.dat	xmrig
behavioral2/memory/4900-26-0x00007FF788430000-0x00007FF788784000-memory.dmp	xmrig
behavioral2/memory/2760-22-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-30.dat	xmrig
behavioral2/memory/404-32-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233f3-35.dat	xmrig
behavioral2/files/0x00070000000233fa-41.dat	xmrig
behavioral2/files/0x00070000000233fb-47.dat	xmrig
behavioral2/files/0x00070000000233fd-57.dat	xmrig
behavioral2/files/0x00070000000233ff-69.dat	xmrig
behavioral2/files/0x0007000000023402-81.dat	xmrig
behavioral2/memory/3752-95-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	xmrig
behavioral2/memory/2608-100-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	xmrig
behavioral2/memory/4956-104-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	xmrig
behavioral2/memory/1400-112-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-120.dat	xmrig
behavioral2/memory/4408-127-0x00007FF7EB9D0000-0x00007FF7EBD24000-memory.dmp	xmrig
behavioral2/memory/2020-126-0x00007FF74ADE0000-0x00007FF74B134000-memory.dmp	xmrig
behavioral2/memory/2404-125-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-123.dat	xmrig
behavioral2/memory/452-122-0x00007FF6395B0000-0x00007FF639904000-memory.dmp	xmrig
behavioral2/memory/692-119-0x00007FF719400000-0x00007FF719754000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-116.dat	xmrig
behavioral2/memory/4396-115-0x00007FF6986E0000-0x00007FF698A34000-memory.dmp	xmrig
behavioral2/memory/4140-108-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	xmrig
behavioral2/memory/3252-107-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	xmrig
behavioral2/files/0x0007000000023405-102.dat	xmrig
behavioral2/memory/3092-101-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-98.dat	xmrig
behavioral2/memory/3588-97-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	xmrig
behavioral2/memory/4372-90-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-89.dat	xmrig
behavioral2/files/0x0007000000023401-79.dat	xmrig
behavioral2/files/0x0007000000023400-75.dat	xmrig
behavioral2/files/0x00070000000233fe-62.dat	xmrig
behavioral2/files/0x00070000000233fc-52.dat	xmrig
behavioral2/memory/5064-38-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	xmrig
behavioral2/memory/2008-128-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	xmrig
behavioral2/memory/2084-129-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	xmrig
behavioral2/memory/2860-130-0x00007FF793200000-0x00007FF793554000-memory.dmp	xmrig
behavioral2/memory/2760-131-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	xmrig
behavioral2/memory/404-132-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	xmrig
behavioral2/memory/2084-133-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	xmrig
behavioral2/memory/2860-134-0x00007FF793200000-0x00007FF793554000-memory.dmp	xmrig
behavioral2/memory/2760-135-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	xmrig
behavioral2/memory/4900-136-0x00007FF788430000-0x00007FF788784000-memory.dmp	xmrig
behavioral2/memory/404-137-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	xmrig
behavioral2/memory/5064-138-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	xmrig
behavioral2/memory/4372-139-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/memory/3752-140-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	xmrig
behavioral2/memory/692-141-0x00007FF719400000-0x00007FF719754000-memory.dmp	xmrig
behavioral2/memory/2608-143-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	xmrig
behavioral2/memory/3588-142-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	xmrig
behavioral2/memory/3092-144-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	xmrig
behavioral2/memory/4956-145-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	xmrig
behavioral2/memory/3252-146-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	xmrig
behavioral2/memory/4140-147-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	xmrig
behavioral2/memory/1400-148-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2084	pMBpKbk.exe
2860	NWXXdUc.exe
2760	JuoUOTK.exe
4900	vFBlWaM.exe
404	waJLkoz.exe
5064	vjCbSkc.exe
4372	laVCZDi.exe
3752	uLnoFzU.exe
692	jQUgHJs.exe
3588	jalttIs.exe
2608	ZXdBNTl.exe
3092	mAvVMQn.exe
4956	ChYUxKI.exe
3252	jSQQqzM.exe
4140	ApryAgo.exe
1400	eetsoKH.exe
4396	qvyKvOf.exe
452	bUeQzFW.exe
2404	ckYgXXC.exe
2020	lGtZliK.exe
4408	rgPyjlt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2008-0-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	upx
behavioral2/files/0x00080000000233f2-5.dat	upx
behavioral2/memory/2084-8-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-10.dat	upx
behavioral2/memory/2860-14-0x00007FF793200000-0x00007FF793554000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-17.dat	upx
behavioral2/files/0x00070000000233f8-24.dat	upx
behavioral2/memory/4900-26-0x00007FF788430000-0x00007FF788784000-memory.dmp	upx
behavioral2/memory/2760-22-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-30.dat	upx
behavioral2/memory/404-32-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	upx
behavioral2/files/0x00080000000233f3-35.dat	upx
behavioral2/files/0x00070000000233fa-41.dat	upx
behavioral2/files/0x00070000000233fb-47.dat	upx
behavioral2/files/0x00070000000233fd-57.dat	upx
behavioral2/files/0x00070000000233ff-69.dat	upx
behavioral2/files/0x0007000000023402-81.dat	upx
behavioral2/memory/3752-95-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	upx
behavioral2/memory/2608-100-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	upx
behavioral2/memory/4956-104-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	upx
behavioral2/memory/1400-112-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	upx
behavioral2/files/0x0007000000023407-120.dat	upx
behavioral2/memory/4408-127-0x00007FF7EB9D0000-0x00007FF7EBD24000-memory.dmp	upx
behavioral2/memory/2020-126-0x00007FF74ADE0000-0x00007FF74B134000-memory.dmp	upx
behavioral2/memory/2404-125-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp	upx
behavioral2/files/0x0007000000023408-123.dat	upx
behavioral2/memory/452-122-0x00007FF6395B0000-0x00007FF639904000-memory.dmp	upx
behavioral2/memory/692-119-0x00007FF719400000-0x00007FF719754000-memory.dmp	upx
behavioral2/files/0x0007000000023406-116.dat	upx
behavioral2/memory/4396-115-0x00007FF6986E0000-0x00007FF698A34000-memory.dmp	upx
behavioral2/memory/4140-108-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	upx
behavioral2/memory/3252-107-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	upx
behavioral2/files/0x0007000000023405-102.dat	upx
behavioral2/memory/3092-101-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	upx
behavioral2/files/0x0007000000023404-98.dat	upx
behavioral2/memory/3588-97-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	upx
behavioral2/memory/4372-90-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/files/0x0007000000023403-89.dat	upx
behavioral2/files/0x0007000000023401-79.dat	upx
behavioral2/files/0x0007000000023400-75.dat	upx
behavioral2/files/0x00070000000233fe-62.dat	upx
behavioral2/files/0x00070000000233fc-52.dat	upx
behavioral2/memory/5064-38-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	upx
behavioral2/memory/2008-128-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp	upx
behavioral2/memory/2084-129-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	upx
behavioral2/memory/2860-130-0x00007FF793200000-0x00007FF793554000-memory.dmp	upx
behavioral2/memory/2760-131-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	upx
behavioral2/memory/404-132-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	upx
behavioral2/memory/2084-133-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp	upx
behavioral2/memory/2860-134-0x00007FF793200000-0x00007FF793554000-memory.dmp	upx
behavioral2/memory/2760-135-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp	upx
behavioral2/memory/4900-136-0x00007FF788430000-0x00007FF788784000-memory.dmp	upx
behavioral2/memory/404-137-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp	upx
behavioral2/memory/5064-138-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp	upx
behavioral2/memory/4372-139-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/memory/3752-140-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp	upx
behavioral2/memory/692-141-0x00007FF719400000-0x00007FF719754000-memory.dmp	upx
behavioral2/memory/2608-143-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp	upx
behavioral2/memory/3588-142-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp	upx
behavioral2/memory/3092-144-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp	upx
behavioral2/memory/4956-145-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp	upx
behavioral2/memory/3252-146-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	upx
behavioral2/memory/4140-147-0x00007FF765650000-0x00007FF7659A4000-memory.dmp	upx
behavioral2/memory/1400-148-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\JuoUOTK.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uLnoFzU.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZXdBNTl.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mAvVMQn.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NWXXdUc.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vFBlWaM.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jSQQqzM.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qvyKvOf.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bUeQzFW.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lGtZliK.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vjCbSkc.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\laVCZDi.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jQUgHJs.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ApryAgo.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ckYgXXC.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rgPyjlt.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pMBpKbk.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\waJLkoz.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jalttIs.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ChYUxKI.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eetsoKH.exe	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2084	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	82
PID 2008 wrote to memory of 2084	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	82
PID 2008 wrote to memory of 2860	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	83
PID 2008 wrote to memory of 2860	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	83
PID 2008 wrote to memory of 2760	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	85
PID 2008 wrote to memory of 2760	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	85
PID 2008 wrote to memory of 4900	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	86
PID 2008 wrote to memory of 4900	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	86
PID 2008 wrote to memory of 404	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	87
PID 2008 wrote to memory of 404	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	87
PID 2008 wrote to memory of 5064	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	89
PID 2008 wrote to memory of 5064	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	89
PID 2008 wrote to memory of 4372	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	91
PID 2008 wrote to memory of 4372	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	91
PID 2008 wrote to memory of 3752	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	92
PID 2008 wrote to memory of 3752	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	92
PID 2008 wrote to memory of 692	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	93
PID 2008 wrote to memory of 692	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	93
PID 2008 wrote to memory of 3588	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	94
PID 2008 wrote to memory of 3588	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	94
PID 2008 wrote to memory of 2608	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	95
PID 2008 wrote to memory of 2608	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	95
PID 2008 wrote to memory of 3092	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	96
PID 2008 wrote to memory of 3092	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	96
PID 2008 wrote to memory of 4956	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	97
PID 2008 wrote to memory of 4956	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	97
PID 2008 wrote to memory of 3252	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	98
PID 2008 wrote to memory of 3252	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	98
PID 2008 wrote to memory of 4140	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	99
PID 2008 wrote to memory of 4140	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	99
PID 2008 wrote to memory of 1400	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	100
PID 2008 wrote to memory of 1400	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	100
PID 2008 wrote to memory of 4396	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	101
PID 2008 wrote to memory of 4396	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	101
PID 2008 wrote to memory of 452	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	102
PID 2008 wrote to memory of 452	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	102
PID 2008 wrote to memory of 2404	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	103
PID 2008 wrote to memory of 2404	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	103
PID 2008 wrote to memory of 2020	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	104
PID 2008 wrote to memory of 2020	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	104
PID 2008 wrote to memory of 4408	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	105
PID 2008 wrote to memory of 4408	2008	2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_0fcc4e571283972fbb34217abe05ffa6_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System\pMBpKbk.exe
  C:\Windows\System\pMBpKbk.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\NWXXdUc.exe
  C:\Windows\System\NWXXdUc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\JuoUOTK.exe
  C:\Windows\System\JuoUOTK.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vFBlWaM.exe
  C:\Windows\System\vFBlWaM.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\waJLkoz.exe
  C:\Windows\System\waJLkoz.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\vjCbSkc.exe
  C:\Windows\System\vjCbSkc.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\laVCZDi.exe
  C:\Windows\System\laVCZDi.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\uLnoFzU.exe
  C:\Windows\System\uLnoFzU.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\jQUgHJs.exe
  C:\Windows\System\jQUgHJs.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\jalttIs.exe
  C:\Windows\System\jalttIs.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\ZXdBNTl.exe
  C:\Windows\System\ZXdBNTl.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\mAvVMQn.exe
  C:\Windows\System\mAvVMQn.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\ChYUxKI.exe
  C:\Windows\System\ChYUxKI.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\jSQQqzM.exe
  C:\Windows\System\jSQQqzM.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\ApryAgo.exe
  C:\Windows\System\ApryAgo.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\eetsoKH.exe
  C:\Windows\System\eetsoKH.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\qvyKvOf.exe
  C:\Windows\System\qvyKvOf.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\bUeQzFW.exe
  C:\Windows\System\bUeQzFW.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ckYgXXC.exe
  C:\Windows\System\ckYgXXC.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\lGtZliK.exe
  C:\Windows\System\lGtZliK.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\rgPyjlt.exe
  C:\Windows\System\rgPyjlt.exe
  2⤵
  - Executes dropped EXE
  PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ApryAgo.exe

Path C:\Windows\System\ApryAgo.exe
Size 5.9MB
SHA256 f070cd291fb77b50325b8699c1d975c8a02152f9038fcf391a3d12e5e71711cf
MD5 f31854c9592f5c79b09a2b85920a1f96
SHA1 dff37455abe93e24f1ed1f1de6cba9635068d53c
SHA512 b9c900bfbdc485e69c569c8c4d5e55c2483a1e850e48cf0e77fb0da2fcc6b15df8174d78c28a405b292969e5d7db46ef817773b5039ff7d920edead39d6d56f8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChYUxKI.exe

Path C:\Windows\System\ChYUxKI.exe
Size 5.9MB
SHA256 e049a48bbc49313e610a863228d999fe0c419920531b8f0e98f2370d6294ec92
MD5 fb4c79ad3ce5c6a3f636fdabaf179c5b
SHA1 f059f67c134eff8f03c505b70ebc893ff6b3c8fe
SHA512 0daa4169d0a419dc938fe7704c474596bab6d70608197449dff4a1205b4c9c8ec1f14fa89212dc4deb024dbe7cc0040c7c0b9cc2edab630fc8e26ce5ebaeb180
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

JuoUOTK.exe

Path C:\Windows\System\JuoUOTK.exe
Size 5.9MB
SHA256 fb03ec248494458494a4d2d89cfead2aaf2a6f3d6a15971b1492cde46952451c
MD5 ca834f30369a5b3312f6b813962b7a59
SHA1 f7be87749d69d295f90c63657627b9ab37506492
SHA512 8c9bc192a00c0495f32787acc18d5973fb2154824bd7903ad03111d4fafd2d3664cf7038ed4dc9da0dc986833320c931d35ea32279fd0bad8129a49aaa7b10b1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NWXXdUc.exe

Path C:\Windows\System\NWXXdUc.exe
Size 5.9MB
SHA256 b191612a3fdf84b248e034696c5723b16da1aed853e1e8a41a2cef3d7012a103
MD5 ec4a8a5019d1eecdc1aa1e5c60543891
SHA1 473d30133af11fef7cdd590565795b123d54251e
SHA512 22640e5a3f8e726cdedd73f28fd0d42b1911100b70512ec3cc9fff6f1e0bcb17a4f2db24fcfc91643fb04a99129c420bb1433eba0d369cfc1c957706447baffb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZXdBNTl.exe

Path C:\Windows\System\ZXdBNTl.exe
Size 5.9MB
SHA256 3ffb910cfaa375498a7121ec3b4be2dc50e9e57fd2117774bfaa4b953dadc038
MD5 a8b39cbd90326a82cb06d45baf343702
SHA1 18700f310515726ee3f974c0bb8b182b56a76d9b
SHA512 79954ed531967543d7f01e78ff68ae86a7d06c9ddfe1e442f9c27417fbb68e532552ff735bb762b35a84b0bc607bd916570eec6fdb863cc61d9ea7b54eaeb497
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

bUeQzFW.exe

Path C:\Windows\System\bUeQzFW.exe
Size 5.9MB
SHA256 9ed2b08c9ca5a0ce40876d0dc2064c710b57e06db05f5f8b831a818d2705d9fb
MD5 6e5cfa00f15937faa9c3b4259c6a07d9
SHA1 4369f35f7e0f1dbaead151fb2beeaef15501d7f9
SHA512 28ae961a357b2a0c1855c7348a1b12d2ed08ebd9a013e57a2fd0fe3352d90313e611416d1e94f9c18fe07a6c703c969c42c4bf31a6dd8ce9aecf57af24dffa56
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckYgXXC.exe

Path C:\Windows\System\ckYgXXC.exe
Size 5.9MB
SHA256 cdf1960824bb473f9f1125755daaa0f133b9ecff2a2438b83fea44c7b0536901
MD5 a505d9f2bedda36858880d4c45fb0044
SHA1 fd171b863a36dee3ed6422bd74b378a65fc5ab9b
SHA512 90caf0e88ea81b8560d831b6f39112fff1667c8731a8325d53a8a64e26065d035ba6ae3c55940444cb8c202fa2219ccf9b8769e7d93735016c1512ffb8cb04a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

eetsoKH.exe

Path C:\Windows\System\eetsoKH.exe
Size 5.9MB
SHA256 d19137498462b71c3762bb0e8e94502e02aca5c4d166bbc7b86f661a14ab12f2
MD5 4e1ecd8c7d93b8419c65f9b0781268ed
SHA1 1300491a00185cc1709c2c876d8dfdd334b26cba
SHA512 936d981afe00f01611cf7b0bdb65d79a886bb705ddec9005985c2977ef23c157f6488f92427bee6dd87d896af4530e791fe96695407a3c8e8d8de5a7417d2a72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQUgHJs.exe

Path C:\Windows\System\jQUgHJs.exe
Size 5.9MB
SHA256 9872b0acf9bd04460c4204f6c4af79c41d013f7364f82bdb47ff7b42eb33d31f
MD5 78e3327ec5b00b4744f17181741894e8
SHA1 cf25f76249a7364f212bc59fb3fcd8f008bb608f
SHA512 d39fa94297a58e6e4cb9a5dfa2707d015e2515c3540327f994e9003b0cc8954c8b17841c732c3fcede9e6c0662c4ec3f07762cbab812d4b121f5148d6d711a90
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

jSQQqzM.exe

Path C:\Windows\System\jSQQqzM.exe
Size 5.9MB
SHA256 262e87581814aa048c0b23b7f9f30d7d2aa2cf21471a7e9f794a7ccd659b3869
MD5 731213c21d3737ee9c013b7b2413d39b
SHA1 e778aca1c027ba236771a13e4cb4176a20b6c59e
SHA512 53760620f4601befe22dc11a7d05e9de871f13dc3e45be8ee897e2430efa0911bb630fb9c7f664d27e872b3e951ff1d4e75380c5f2fc20f5fbcf6498c362778c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

jalttIs.exe

Path C:\Windows\System\jalttIs.exe
Size 5.9MB
SHA256 67c504b2fe6d0b87fd872e0b6cf76e64761e36524a22d7513aca596b099eab44
MD5 dd5dd785f10a78ed279a73b02e9904da
SHA1 4590f3ed214884aac01a315afaab05b2bfcfab9e
SHA512 996af440130ce317865f3c92978c6ce6d476a29ab2a90ecdcbf07bf1aad515b82d38702376fa3d0ea07e2bfadc772f7c19b24abe15a67a6629f1f1caa462bb35
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

lGtZliK.exe

Path C:\Windows\System\lGtZliK.exe
Size 5.9MB
SHA256 a6357333e6d50d357c035dc4cbbc48fb5334f0e8d0cebf5e6b397c6981b01666
MD5 08371d383b038ab9ee80c95b2e716073
SHA1 d0bee0e496ff1ae7cb8d6af856091d6933e78284
SHA512 4ce01eddd22ec8460ddd3fcf20f10592e5bc1b451d2fe0fd7e9d1b810d866f758d26e2bed360248e0552637bd7ccfacd26398ad6d4ef93e65315b5ffbfce6130
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

laVCZDi.exe

Path C:\Windows\System\laVCZDi.exe
Size 5.9MB
SHA256 8d256d26238579c72fb4333ae3d9db0cefe98edc1744132b1df7efe28aa78ddf
MD5 21f6bb035c091e9b00207467efaf8511
SHA1 069363de9a353f524f4ab644436e005e1b215b2d
SHA512 3315bd6d771c78b31d4d0815ed7f0fc6a3ccf6752fb2f75c4932378019ea0c15b4ee18b93939483f9e6907eb1651755451e469ee204590b1a72c8fcc55b7a957
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAvVMQn.exe

Path C:\Windows\System\mAvVMQn.exe
Size 5.9MB
SHA256 dd8fc6e16f3a76b652bc58e401f9917e64561be2881b5fd5bb77c2fd2e630f08
MD5 b566891a266047c86c3772e148dc22d9
SHA1 7723ae7cc91371e537e566ce2731580709a9a0ef
SHA512 e936c754ce4bef887bdc09f26ea9b760f92fc908131e9687f9d3f6b73fd9ad4a33003f8431c112581c4d0d037bfe557122a3075e2bb8420e94e07259ee845f59
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

pMBpKbk.exe

Path C:\Windows\System\pMBpKbk.exe
Size 5.9MB
SHA256 e267663da0a79f83d9f70bd2083ea9dfe639f34ce2d037d78c4d8781422fc781
MD5 a2cd93502831966d179e7e36dd63fc98
SHA1 757779bfbf616f5039b9f6f0a8f2dceb616878df
SHA512 0d0058c80b45ddb43104db5b6c1ef12a5319fd266553b2129701b20731ab0a81a97767466ea2ffb395db2098ac6da5c448f0a9eba1c93ff157d71df2af094c1b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvyKvOf.exe

Path C:\Windows\System\qvyKvOf.exe
Size 5.9MB
SHA256 12e2db9ab4e131feeaf206683252d6c4e1c475f419d4627d0a87ed623b659751
MD5 af427230c3ecccebe0f243ed5d6fdf96
SHA1 95ca4a40b5c1a099e08f483a0ca826747f4a8dc5
SHA512 61dbf6b2aff5dbf0607384a14ea181494af09fbdc2815824b81cc352cac4f28d3215a845305f8a77e9d2bbfa3bb03d2507cf5f55f675a9420f73cd4e2404671d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rgPyjlt.exe

Path C:\Windows\System\rgPyjlt.exe
Size 5.9MB
SHA256 b7f57a6980d9c69a35b3ffc4f9bf1630f80e563481ba2791404dbd635f8e9800
MD5 fba95c823ca2f3c4d5def04dcdb12a57
SHA1 3d4e782c4e1efbb4ab118eadcccc95e9514a6593
SHA512 1fc96badabeb980f6c222e2676b300ae1ab180c6dcd55fdf7ee466263985fcbce0c78c3392399f3ba9f6593b3df4af6656e055a12bd6bedcdaad06961dccf16a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLnoFzU.exe

Path C:\Windows\System\uLnoFzU.exe
Size 5.9MB
SHA256 d9ba390ae103de89111216b856d56108891a849176f065885bcace2d334369e3
MD5 751df96f9361f4a8d92cda2ebbaf9b7f
SHA1 2c591a7b989cec6d91b409d165cc6117cf4a26ef
SHA512 6d5f6bfcd64cc1dd89c4ec7db1cd42bfaab90e42247f3083162357bdd3c6392d8ef15b049e0707352d453dbe6051a510a0b7a852cb2ad7e31da7d2e4bd9965a6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

vFBlWaM.exe

Path C:\Windows\System\vFBlWaM.exe
Size 5.9MB
SHA256 38c5a1c1abf0176e705d1b43c72e4f1923f20893ace5a6d39f281c61467f83c5
MD5 88f2c9a4eb881a818db5223f1deaabc7
SHA1 e8e9877762e076ad7188cf24223c717399ab13f1
SHA512 a811aaa0c3805d771250eb3d536fcafa458e5872c937a71f9eb02bfb326c7347bd7b9bab54bec2688cb1c96498cb7d905ddf20523c4f916f3602cd5ba244d8f2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjCbSkc.exe

Path C:\Windows\System\vjCbSkc.exe
Size 5.9MB
SHA256 1807db44ddd53c1066b7a11da6a4d83c82ea89080c76a9ae4ff412369311d649
MD5 3afbf1b76924cae07ff4214071549a9c
SHA1 ca862cf6eacc5843efac7ca527815a05dd7e8efa
SHA512 befdd182fe3f916195d3c9217dcad5a550d5adeb7cd96b37dc9485bff4fe4685e522d552a0683f3155bc078fbaa89cac5a68768300d98f4abe351fba0fd4821b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

waJLkoz.exe

Path C:\Windows\System\waJLkoz.exe
Size 5.9MB
SHA256 1d3e0d8bbd3f4821baed13874c74e5bb13423ce75e5697782e99f7b2ae968170
MD5 5c2d140797486b1c68d9f0d495bfcb86
SHA1 4430e8ad885d063e132a067bd033605e0c598a36
SHA512 df73db9073e9b119e462e4d2aa695250b539676804f49b06e5d2483b14097c80d989543567943d8421d1aeb5093b746616324060104292d3601b8e0b8cc44299
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-132-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp

Download

memory/404-32-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp

Download

memory/404-137-0x00007FF6E2C60000-0x00007FF6E2FB4000-memory.dmp

Download

memory/452-150-0x00007FF6395B0000-0x00007FF639904000-memory.dmp

Download

memory/452-122-0x00007FF6395B0000-0x00007FF639904000-memory.dmp

Download

memory/692-119-0x00007FF719400000-0x00007FF719754000-memory.dmp

Download

memory/692-141-0x00007FF719400000-0x00007FF719754000-memory.dmp

Download

memory/1400-148-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp

Download

memory/1400-112-0x00007FF78DD70000-0x00007FF78E0C4000-memory.dmp

Download

memory/2008-128-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp

Download

memory/2008-1-0x00000296D91D0000-0x00000296D91E0000-memory.dmp

Download

memory/2008-0-0x00007FF733A70000-0x00007FF733DC4000-memory.dmp

Download

memory/2020-126-0x00007FF74ADE0000-0x00007FF74B134000-memory.dmp

Download

memory/2020-152-0x00007FF74ADE0000-0x00007FF74B134000-memory.dmp

Download

memory/2084-8-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp

Download

memory/2084-133-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp

Download

memory/2084-129-0x00007FF63A490000-0x00007FF63A7E4000-memory.dmp

Download

memory/2404-151-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp

Download

memory/2404-125-0x00007FF7FB880000-0x00007FF7FBBD4000-memory.dmp

Download

memory/2608-100-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp

Download

memory/2608-143-0x00007FF7EC4A0000-0x00007FF7EC7F4000-memory.dmp

Download

memory/2760-135-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp

Download

memory/2760-22-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp

Download

memory/2760-131-0x00007FF6D4D80000-0x00007FF6D50D4000-memory.dmp

Download

memory/2860-14-0x00007FF793200000-0x00007FF793554000-memory.dmp

Download

memory/2860-130-0x00007FF793200000-0x00007FF793554000-memory.dmp

Download

memory/2860-134-0x00007FF793200000-0x00007FF793554000-memory.dmp

Download

memory/3092-144-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp

Download

memory/3092-101-0x00007FF69C700000-0x00007FF69CA54000-memory.dmp

Download

memory/3252-146-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp

Download

memory/3252-107-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp

Download

memory/3588-97-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp

Download

memory/3588-142-0x00007FF7C3F60000-0x00007FF7C42B4000-memory.dmp

Download

memory/3752-140-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp

Download

memory/3752-95-0x00007FF6E6F90000-0x00007FF6E72E4000-memory.dmp

Download

memory/4140-108-0x00007FF765650000-0x00007FF7659A4000-memory.dmp

Download

memory/4140-147-0x00007FF765650000-0x00007FF7659A4000-memory.dmp

Download

memory/4372-139-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/4372-90-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/4396-149-0x00007FF6986E0000-0x00007FF698A34000-memory.dmp

Download

memory/4396-115-0x00007FF6986E0000-0x00007FF698A34000-memory.dmp

Download

memory/4408-127-0x00007FF7EB9D0000-0x00007FF7EBD24000-memory.dmp

Download

memory/4408-153-0x00007FF7EB9D0000-0x00007FF7EBD24000-memory.dmp

Download

memory/4900-136-0x00007FF788430000-0x00007FF788784000-memory.dmp

Download

memory/4900-26-0x00007FF788430000-0x00007FF788784000-memory.dmp

Download

memory/4956-104-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp

Download

memory/4956-145-0x00007FF6DB180000-0x00007FF6DB4D4000-memory.dmp

Download

memory/5064-38-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp

Download

memory/5064-138-0x00007FF7D27F0000-0x00007FF7D2B44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads