cobaltstrike | 80ea7a400bad0bda799f866a3a4bf092ddb317952ee92c4ad404bfd1094e95e6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-jktaksgd2x
SHA256 80ea7a400bad0bda799f866a3a4bf092ddb317952ee92c4ad404bfd1094e95e6
MD5 46b3ac90e27a9f71ee79ffa5b1ede93f
SHA1 1780575c4a2a5203b7f541046fbc1fea9a0baa78
SHA512 5bacd861c35a151b73333e72a447ad3936866dfe6babcfceabaefe675bc6e5d07d7f9dcfe21f28b576f68fedf43b7969eb5c7466676497a98648f0317ce95bbb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233e8-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-7.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f7-13.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-17.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-28.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-57.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000233ef-78.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-51.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-95.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-108.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-117.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-123.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-112.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233e8-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f7-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000233ef-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4092-0-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	UPX
behavioral2/files/0x00090000000233e8-5.dat	UPX
behavioral2/memory/3064-10-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fc-7.dat	UPX
behavioral2/files/0x00080000000233f7-13.dat	UPX
behavioral2/files/0x00070000000233fd-17.dat	UPX
behavioral2/files/0x00070000000233fe-28.dat	UPX
behavioral2/files/0x00070000000233ff-36.dat	UPX
behavioral2/files/0x0007000000023400-44.dat	UPX
behavioral2/files/0x0007000000023402-47.dat	UPX
behavioral2/files/0x0007000000023401-57.dat	UPX
behavioral2/memory/4496-60-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	UPX
behavioral2/memory/2364-68-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	UPX
behavioral2/memory/816-72-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	UPX
behavioral2/files/0x00090000000233ef-78.dat	UPX
behavioral2/files/0x0007000000023405-76.dat	UPX
behavioral2/memory/2200-86-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	UPX
behavioral2/memory/3088-92-0x00007FF7FE530000-0x00007FF7FE884000-memory.dmp	UPX
behavioral2/memory/4468-91-0x00007FF72C0E0000-0x00007FF72C434000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-89.dat	UPX
behavioral2/files/0x0007000000023406-87.dat	UPX
behavioral2/files/0x0007000000023404-70.dat	UPX
behavioral2/memory/400-69-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	UPX
behavioral2/memory/3676-66-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	UPX
behavioral2/memory/992-63-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	UPX
behavioral2/memory/4784-56-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	UPX
behavioral2/memory/2240-54-0x00007FF680620000-0x00007FF680974000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-51.dat	UPX
behavioral2/memory/1372-48-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	UPX
behavioral2/memory/3964-41-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	UPX
behavioral2/memory/2136-19-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-95.dat	UPX
behavioral2/memory/1156-102-0x00007FF795E10000-0x00007FF796164000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-106.dat	UPX
behavioral2/files/0x000700000002340b-108.dat	UPX
behavioral2/files/0x000700000002340d-117.dat	UPX
behavioral2/memory/1584-120-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-123.dat	UPX
behavioral2/memory/1352-126-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	UPX
behavioral2/memory/4176-116-0x00007FF6AF4D0000-0x00007FF6AF824000-memory.dmp	UPX
behavioral2/memory/3328-114-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-112.dat	UPX
behavioral2/memory/1292-127-0x00007FF692790000-0x00007FF692AE4000-memory.dmp	UPX
behavioral2/memory/4092-128-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	UPX
behavioral2/memory/3064-129-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	UPX
behavioral2/memory/2136-130-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	UPX
behavioral2/memory/400-131-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	UPX
behavioral2/memory/816-132-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	UPX
behavioral2/memory/1156-133-0x00007FF795E10000-0x00007FF796164000-memory.dmp	UPX
behavioral2/memory/3328-134-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	UPX
behavioral2/memory/1352-136-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	UPX
behavioral2/memory/1584-135-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	UPX
behavioral2/memory/3064-137-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	UPX
behavioral2/memory/2136-138-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	UPX
behavioral2/memory/4496-140-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	UPX
behavioral2/memory/3964-139-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	UPX
behavioral2/memory/992-142-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	UPX
behavioral2/memory/2240-143-0x00007FF680620000-0x00007FF680974000-memory.dmp	UPX
behavioral2/memory/1372-141-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	UPX
behavioral2/memory/2200-144-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	UPX
behavioral2/memory/816-148-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	UPX
behavioral2/memory/4784-149-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	UPX
behavioral2/memory/2364-147-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	UPX
behavioral2/memory/3676-146-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4092-0-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233e8-5.dat	xmrig
behavioral2/memory/3064-10-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-7.dat	xmrig
behavioral2/files/0x00080000000233f7-13.dat	xmrig
behavioral2/files/0x00070000000233fd-17.dat	xmrig
behavioral2/files/0x00070000000233fe-28.dat	xmrig
behavioral2/files/0x00070000000233ff-36.dat	xmrig
behavioral2/files/0x0007000000023400-44.dat	xmrig
behavioral2/files/0x0007000000023402-47.dat	xmrig
behavioral2/files/0x0007000000023401-57.dat	xmrig
behavioral2/memory/4496-60-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	xmrig
behavioral2/memory/2364-68-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	xmrig
behavioral2/memory/816-72-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ef-78.dat	xmrig
behavioral2/files/0x0007000000023405-76.dat	xmrig
behavioral2/memory/2200-86-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	xmrig
behavioral2/memory/3088-92-0x00007FF7FE530000-0x00007FF7FE884000-memory.dmp	xmrig
behavioral2/memory/4468-91-0x00007FF72C0E0000-0x00007FF72C434000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-89.dat	xmrig
behavioral2/files/0x0007000000023406-87.dat	xmrig
behavioral2/files/0x0007000000023404-70.dat	xmrig
behavioral2/memory/400-69-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	xmrig
behavioral2/memory/3676-66-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	xmrig
behavioral2/memory/992-63-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	xmrig
behavioral2/memory/4784-56-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	xmrig
behavioral2/memory/2240-54-0x00007FF680620000-0x00007FF680974000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-51.dat	xmrig
behavioral2/memory/1372-48-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	xmrig
behavioral2/memory/3964-41-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	xmrig
behavioral2/memory/2136-19-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-95.dat	xmrig
behavioral2/memory/1156-102-0x00007FF795E10000-0x00007FF796164000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-106.dat	xmrig
behavioral2/files/0x000700000002340b-108.dat	xmrig
behavioral2/files/0x000700000002340d-117.dat	xmrig
behavioral2/memory/1584-120-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-123.dat	xmrig
behavioral2/memory/1352-126-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	xmrig
behavioral2/memory/4176-116-0x00007FF6AF4D0000-0x00007FF6AF824000-memory.dmp	xmrig
behavioral2/memory/3328-114-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-112.dat	xmrig
behavioral2/memory/1292-127-0x00007FF692790000-0x00007FF692AE4000-memory.dmp	xmrig
behavioral2/memory/4092-128-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	xmrig
behavioral2/memory/3064-129-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	xmrig
behavioral2/memory/2136-130-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	xmrig
behavioral2/memory/400-131-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	xmrig
behavioral2/memory/816-132-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	xmrig
behavioral2/memory/1156-133-0x00007FF795E10000-0x00007FF796164000-memory.dmp	xmrig
behavioral2/memory/3328-134-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	xmrig
behavioral2/memory/1352-136-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	xmrig
behavioral2/memory/1584-135-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	xmrig
behavioral2/memory/3064-137-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	xmrig
behavioral2/memory/2136-138-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	xmrig
behavioral2/memory/4496-140-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	xmrig
behavioral2/memory/3964-139-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	xmrig
behavioral2/memory/992-142-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	xmrig
behavioral2/memory/2240-143-0x00007FF680620000-0x00007FF680974000-memory.dmp	xmrig
behavioral2/memory/1372-141-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	xmrig
behavioral2/memory/2200-144-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	xmrig
behavioral2/memory/816-148-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	xmrig
behavioral2/memory/4784-149-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	xmrig
behavioral2/memory/2364-147-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	xmrig
behavioral2/memory/3676-146-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3064	rnZzBnO.exe
2136	qAlFiSi.exe
3964	kqDNIKk.exe
4496	gorRUTg.exe
1372	RLLDShG.exe
992	EykiNKZ.exe
2240	LFeDEAO.exe
3676	UeNGyOr.exe
4784	WXPlyJY.exe
2364	RhOQrel.exe
400	PWHBRYd.exe
816	MLIuUiW.exe
2200	DxLfxLo.exe
4468	drTMeCp.exe
3088	BcbKDVt.exe
1156	eERKJxg.exe
3328	xLTgcuD.exe
4176	SuicYrL.exe
1584	DjoQtEX.exe
1292	DEHnSqx.exe
1352	CJKEnFv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-0-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	upx
behavioral2/files/0x00090000000233e8-5.dat	upx
behavioral2/memory/3064-10-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-7.dat	upx
behavioral2/files/0x00080000000233f7-13.dat	upx
behavioral2/files/0x00070000000233fd-17.dat	upx
behavioral2/files/0x00070000000233fe-28.dat	upx
behavioral2/files/0x00070000000233ff-36.dat	upx
behavioral2/files/0x0007000000023400-44.dat	upx
behavioral2/files/0x0007000000023402-47.dat	upx
behavioral2/files/0x0007000000023401-57.dat	upx
behavioral2/memory/4496-60-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	upx
behavioral2/memory/2364-68-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	upx
behavioral2/memory/816-72-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	upx
behavioral2/files/0x00090000000233ef-78.dat	upx
behavioral2/files/0x0007000000023405-76.dat	upx
behavioral2/memory/2200-86-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	upx
behavioral2/memory/3088-92-0x00007FF7FE530000-0x00007FF7FE884000-memory.dmp	upx
behavioral2/memory/4468-91-0x00007FF72C0E0000-0x00007FF72C434000-memory.dmp	upx
behavioral2/files/0x0007000000023407-89.dat	upx
behavioral2/files/0x0007000000023406-87.dat	upx
behavioral2/files/0x0007000000023404-70.dat	upx
behavioral2/memory/400-69-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	upx
behavioral2/memory/3676-66-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	upx
behavioral2/memory/992-63-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	upx
behavioral2/memory/4784-56-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	upx
behavioral2/memory/2240-54-0x00007FF680620000-0x00007FF680974000-memory.dmp	upx
behavioral2/files/0x0007000000023403-51.dat	upx
behavioral2/memory/1372-48-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	upx
behavioral2/memory/3964-41-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	upx
behavioral2/memory/2136-19-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	upx
behavioral2/files/0x0007000000023408-95.dat	upx
behavioral2/memory/1156-102-0x00007FF795E10000-0x00007FF796164000-memory.dmp	upx
behavioral2/files/0x000700000002340c-106.dat	upx
behavioral2/files/0x000700000002340b-108.dat	upx
behavioral2/files/0x000700000002340d-117.dat	upx
behavioral2/memory/1584-120-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	upx
behavioral2/files/0x000700000002340e-123.dat	upx
behavioral2/memory/1352-126-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	upx
behavioral2/memory/4176-116-0x00007FF6AF4D0000-0x00007FF6AF824000-memory.dmp	upx
behavioral2/memory/3328-114-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	upx
behavioral2/files/0x000700000002340a-112.dat	upx
behavioral2/memory/1292-127-0x00007FF692790000-0x00007FF692AE4000-memory.dmp	upx
behavioral2/memory/4092-128-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp	upx
behavioral2/memory/3064-129-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	upx
behavioral2/memory/2136-130-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	upx
behavioral2/memory/400-131-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp	upx
behavioral2/memory/816-132-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	upx
behavioral2/memory/1156-133-0x00007FF795E10000-0x00007FF796164000-memory.dmp	upx
behavioral2/memory/3328-134-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp	upx
behavioral2/memory/1352-136-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp	upx
behavioral2/memory/1584-135-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp	upx
behavioral2/memory/3064-137-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp	upx
behavioral2/memory/2136-138-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp	upx
behavioral2/memory/4496-140-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp	upx
behavioral2/memory/3964-139-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp	upx
behavioral2/memory/992-142-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp	upx
behavioral2/memory/2240-143-0x00007FF680620000-0x00007FF680974000-memory.dmp	upx
behavioral2/memory/1372-141-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp	upx
behavioral2/memory/2200-144-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp	upx
behavioral2/memory/816-148-0x00007FF6085B0000-0x00007FF608904000-memory.dmp	upx
behavioral2/memory/4784-149-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp	upx
behavioral2/memory/2364-147-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp	upx
behavioral2/memory/3676-146-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\RLLDShG.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LFeDEAO.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DEHnSqx.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xLTgcuD.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DjoQtEX.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qAlFiSi.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UeNGyOr.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RhOQrel.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PWHBRYd.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SuicYrL.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gorRUTg.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\drTMeCp.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BcbKDVt.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DxLfxLo.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eERKJxg.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CJKEnFv.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rnZzBnO.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kqDNIKk.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EykiNKZ.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WXPlyJY.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MLIuUiW.exe	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3064	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	83
PID 4092 wrote to memory of 3064	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	83
PID 4092 wrote to memory of 2136	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	84
PID 4092 wrote to memory of 2136	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	84
PID 4092 wrote to memory of 3964	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	85
PID 4092 wrote to memory of 3964	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	85
PID 4092 wrote to memory of 4496	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	86
PID 4092 wrote to memory of 4496	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	86
PID 4092 wrote to memory of 1372	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	87
PID 4092 wrote to memory of 1372	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	87
PID 4092 wrote to memory of 992	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	88
PID 4092 wrote to memory of 992	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	88
PID 4092 wrote to memory of 2240	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	89
PID 4092 wrote to memory of 2240	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	89
PID 4092 wrote to memory of 3676	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	90
PID 4092 wrote to memory of 3676	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	90
PID 4092 wrote to memory of 4784	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	91
PID 4092 wrote to memory of 4784	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	91
PID 4092 wrote to memory of 2364	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	92
PID 4092 wrote to memory of 2364	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	92
PID 4092 wrote to memory of 400	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	93
PID 4092 wrote to memory of 400	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	93
PID 4092 wrote to memory of 816	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	94
PID 4092 wrote to memory of 816	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	94
PID 4092 wrote to memory of 2200	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	95
PID 4092 wrote to memory of 2200	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	95
PID 4092 wrote to memory of 4468	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	96
PID 4092 wrote to memory of 4468	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	96
PID 4092 wrote to memory of 3088	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	97
PID 4092 wrote to memory of 3088	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	97
PID 4092 wrote to memory of 1156	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	98
PID 4092 wrote to memory of 1156	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	98
PID 4092 wrote to memory of 4176	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	99
PID 4092 wrote to memory of 4176	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	99
PID 4092 wrote to memory of 3328	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	100
PID 4092 wrote to memory of 3328	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	100
PID 4092 wrote to memory of 1584	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	101
PID 4092 wrote to memory of 1584	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	101
PID 4092 wrote to memory of 1292	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	102
PID 4092 wrote to memory of 1292	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	102
PID 4092 wrote to memory of 1352	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	103
PID 4092 wrote to memory of 1352	4092	2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_46b3ac90e27a9f71ee79ffa5b1ede93f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System\rnZzBnO.exe
  C:\Windows\System\rnZzBnO.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\qAlFiSi.exe
  C:\Windows\System\qAlFiSi.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\kqDNIKk.exe
  C:\Windows\System\kqDNIKk.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\gorRUTg.exe
  C:\Windows\System\gorRUTg.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\RLLDShG.exe
  C:\Windows\System\RLLDShG.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\EykiNKZ.exe
  C:\Windows\System\EykiNKZ.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\LFeDEAO.exe
  C:\Windows\System\LFeDEAO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\UeNGyOr.exe
  C:\Windows\System\UeNGyOr.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\WXPlyJY.exe
  C:\Windows\System\WXPlyJY.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\RhOQrel.exe
  C:\Windows\System\RhOQrel.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\PWHBRYd.exe
  C:\Windows\System\PWHBRYd.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\MLIuUiW.exe
  C:\Windows\System\MLIuUiW.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\DxLfxLo.exe
  C:\Windows\System\DxLfxLo.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\drTMeCp.exe
  C:\Windows\System\drTMeCp.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\BcbKDVt.exe
  C:\Windows\System\BcbKDVt.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\eERKJxg.exe
  C:\Windows\System\eERKJxg.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\SuicYrL.exe
  C:\Windows\System\SuicYrL.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\xLTgcuD.exe
  C:\Windows\System\xLTgcuD.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\DjoQtEX.exe
  C:\Windows\System\DjoQtEX.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\DEHnSqx.exe
  C:\Windows\System\DEHnSqx.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\CJKEnFv.exe
  C:\Windows\System\CJKEnFv.exe
  2⤵
  - Executes dropped EXE
  PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BcbKDVt.exe

Path C:\Windows\System\BcbKDVt.exe
Size 5.9MB
SHA256 589eff05a11e546476914a034c99b090cb7c4f54a5084061f6f2cac4c655f368
MD5 e45bd2492c82814f4c5bfcaba3c60a03
SHA1 daaa07d8d334a8bb98dde9b8b6641d5c7d1f72bc
SHA512 cb7454d6d98562c22e231e0d07ebb2491b81210e1e23508dad3286466e53294fb37bbaa36c5c06cae040d66951e987288b614cc2a1744346be1c2edda7bf9c2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJKEnFv.exe

Path C:\Windows\System\CJKEnFv.exe
Size 5.9MB
SHA256 1dd88157a6a4ce8f4c8eaec2cc01f11a4bd1a41134b65b6a8bceea5cf42e2954
MD5 eb0d5305ac34011a7ba71d16b9064b0c
SHA1 a4e9db79e82e6581d6051ad4ad44446b8535e374
SHA512 1b9a68d9a0f0afebb5c758d7e0a0aab447a77345a40d35727180364f3e5cd2a72fe7b87d0977798f20e749f564d5268aafbbc5d8ba2bf3274838e6d20ee5339d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEHnSqx.exe

Path C:\Windows\System\DEHnSqx.exe
Size 5.9MB
SHA256 f761e1318728a675bddc2f2598f4203a237f6895515ac26960eb4779dacb82e4
MD5 a3a8c599398ee0986e601562e6a66bb3
SHA1 4e2ee8640751c328994f3d3db4e4c84cb89840bd
SHA512 e120a75e64e8cd4854b826a1f84c812710ee9da5c6d5779128ced9467360f5c6b862382acb9b31d0ea31679bb03569955aae7413af5a9c38b800065bbd798fca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

DjoQtEX.exe

Path C:\Windows\System\DjoQtEX.exe
Size 5.9MB
SHA256 f1afadc1784a487e00235b2bd27fdfa80cd60e80e00fc6372036670838496eb8
MD5 3bb4d9775ce6591808b792147f011778
SHA1 1a860899bb169afefa3bbcf119b110f15ad9375b
SHA512 7943ada480bc71e9bb0755b1e6cf44cbf54c013c5b7b06a657667477b16808508892e11da77bd31fc4537838d334f04505a2ccc3429f728cc05849e608f48dd7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

DxLfxLo.exe

Path C:\Windows\System\DxLfxLo.exe
Size 5.9MB
SHA256 4a4c1bd338e63cfcf43cdfd5c1c8f986919844d73b8fce25abd9afd9f3ae70ce
MD5 76a3ffeb261c84af93640518f2d5bb99
SHA1 547c29b7478c963329e55379253cb2992baf041c
SHA512 9be15aad66da926e649f65501cf97fa042c7adf5b5ff7e2d4123f65fc3af24bd8f5090bab2674510808f57b3a64f04ba66837d63ca85f848cee5bd40b51d85dc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

EykiNKZ.exe

Path C:\Windows\System\EykiNKZ.exe
Size 5.9MB
SHA256 1871639c7a314b374c9ffed2f69c5fb4b9fc6f014c7f98d82d225b9f50027bf3
MD5 d86c743bfe6450ddb167d0b60c6167b3
SHA1 bb73a7b106ced8714ec649a8ab84bf2b6d6fac12
SHA512 00351642fbf1aaa7aedca9695314d5469ecc83fd80b03243dff3af9fc97783957db57bc91e2425e9794c58f002716a361b35a4f4989aa923acbac4bd33222d77
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

LFeDEAO.exe

Path C:\Windows\System\LFeDEAO.exe
Size 5.9MB
SHA256 6f89f7a04a675a673a4a5bd657845bb43d9df11d41868d732dec28dc8d3730ca
MD5 5235654d19ecef5821b42387278921eb
SHA1 7cb8eae693bf28d98fc6a6d4485845303320639c
SHA512 0ed47845435abc1a8fd98f1105b2cacec522c81f5674927e468211c702a55d1e3f36e233245daf1ed5a545ad2bdd5fc36eb9c600d25573bb92c6c700d806e883
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MLIuUiW.exe

Path C:\Windows\System\MLIuUiW.exe
Size 5.9MB
SHA256 5a9cb8c0896d45c8d5af22a8bc4fb8b0cce1f4221524c3248a65f196eb2436c7
MD5 c39559187c3c24c87099290c38318071
SHA1 abd2a60cc8612dacf9c64860f13d98f018d46d8c
SHA512 d97f10a352750d91f34af431dc5dc1b5165dec5e4c82aa5c0efb54e841338c6fe8dcf333cd895fc55074600da037798b1ac55b4bb20de9c206aabf39153b087c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

PWHBRYd.exe

Path C:\Windows\System\PWHBRYd.exe
Size 5.9MB
SHA256 8baf8244261aeb4dd798571de44208c041b4c49b0cf1540282da1bde05a138fb
MD5 5f0181fbf8d7624a5f17ddc55aaacad9
SHA1 81ab6005b49ba6cc5a773d71231e17e208aab53f
SHA512 3376cae0bb7b9337837b53963fbaea5e1e44dab8c7a6f6fbf33ce2ac63c8e22c198e5d1bc3011ed61a24cbaa4887468bd4e01d7c9cc669b7e483263dd413db8d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

RLLDShG.exe

Path C:\Windows\System\RLLDShG.exe
Size 5.9MB
SHA256 c744928b4056103c8a5e30f947467378aac61a2b216be844d55ef974999999de
MD5 39b1a1f50b18fb0b763b3035e5d9ab43
SHA1 4c98693ef47618f8ec77378b0bb5bc73327d4721
SHA512 af3e3ef2ae703a435ae63ef63da051259b2cd274a26517a20e8e667bdedb7f597cc502beac4285c7a7f5ec176a1526c9ffdc9f3d85ef0155e16ffb2603c58104
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

RhOQrel.exe

Path C:\Windows\System\RhOQrel.exe
Size 5.9MB
SHA256 b9299f7eec75f7daaf3a9aeaf7f6049308c4a589fc61aa601e34aaa030c4926e
MD5 7cd2b0ce2f85a334f12205668bbb299e
SHA1 13d04132bb572f01c1c5f45bb45701f3a87e8ede
SHA512 22b3d5d9595bd9d8112abe8423b6b7363963a8f13f13eed5bfadd997e4c91f525b0200c1b53e280703384fb47345235f79e39a80101f5637b7f308b67a3998fc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SuicYrL.exe

Path C:\Windows\System\SuicYrL.exe
Size 5.9MB
SHA256 f1fe5ff9c7b7abc4634b68dd485009db3daaf6200018ea9df55bb9d484e090c2
MD5 91af0a37c18034e531a5a0196abecf32
SHA1 2af65dd1c325f13f2b7f733312e0e3b90ad5b4b7
SHA512 1ab3a28c7fbbe2440386f9b563f4ea6f7f5d57e26e63e1114673ebdb2a2465637980323a176d7dbc204f4afc3bf474a76a2443238f8b7fd56402bfcce48e029c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

UeNGyOr.exe

Path C:\Windows\System\UeNGyOr.exe
Size 5.9MB
SHA256 9f7d45e0ea912321094d028e79c6d7c60e3816decc8cbe5140b9e50b3ecc185d
MD5 d7b06f5d55a29c81c00beaa0dea4b0f5
SHA1 953615ca55028787d32a27ea01d7290a7cf84523
SHA512 b92153bce8ed05c3efb6ad396e922be06980d246c0869313d109cb46afb51b1a2e3006c57913ec6b36d1e0c8eff1fb233c47ecbb6395b7b821df73da93c2c06c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

WXPlyJY.exe

Path C:\Windows\System\WXPlyJY.exe
Size 5.9MB
SHA256 551fa1f67ee9f4f9e7596460dd260c4a75f16f0cb0234405d7d07caf91793a1f
MD5 0bb23f23153fb519e3b901bf055581c9
SHA1 a9060a18d56755e754622db20784ca346d3d92f7
SHA512 2288ec755ef112d7655f1e45d4011abfee9a71c8d79ef1937258cdc2dbd1a33119ef9f3be01ef99b0e5511ad3e5d63b17d0bab6eae82f1aa1407d2ffef4251aa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

drTMeCp.exe

Path C:\Windows\System\drTMeCp.exe
Size 5.9MB
SHA256 536b4cb38fd34ee045d3deede880d12e5638e32036e84f49e18a3826e833744b
MD5 13bf14ce2e9306c2c3775461fbcd0e8c
SHA1 0bed86c8f799be5b6c78fec9c279a5c57d1e20a8
SHA512 1d8a8be4dfca902af5f059af97943debf450ccbab3d6c241288b75db8b5f9c931f48141f2d55b8fe9a118609a8f2e379444a8af56a7f0f54afe390540763efbb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

eERKJxg.exe

Path C:\Windows\System\eERKJxg.exe
Size 5.9MB
SHA256 4abf4bb1c09094e7f607c32a24893c30d35b22a463a022dab0258b913f120b16
MD5 309926180bda13f1567904fcf4edb2b0
SHA1 d9f756f132fa268f502abc9200932994d5addac9
SHA512 ce176f7476667caf79d720be3fae1f96d0363ee762f57e4ac7565113581e48fa56e0d8291295b95aa5996132cef6a4fab903006d4d079e4b9b518ac0a36097f8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

gorRUTg.exe

Path C:\Windows\System\gorRUTg.exe
Size 5.9MB
SHA256 7e166cc59b6b8952a8af989c77aca052157f00b02b2f1a637cb4da142d2ff8c5
MD5 ac050f6b4450ac4b18eee06b3a68ba9e
SHA1 002de44439766233986b224c3d129ffe582114bb
SHA512 4892af970c31e20781f1207d3cc8419046d8089733bec87949cec8fbf101881fef1c007f21fe443edd28d86e0c0ef69805b9af29156ac03a1864be97779da82c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqDNIKk.exe

Path C:\Windows\System\kqDNIKk.exe
Size 5.9MB
SHA256 88d0ed469eedc3f43af28cc6fec33954e96442b407b2e042f09f314020832842
MD5 887120803f26b62f40379deea55976fe
SHA1 891b76c5228388023c3da77169afb32a3365b53f
SHA512 af53c46482bc173e1869f1cba659b23c0471eba74d0fd5d1cd7ba783e16352b6df03f48ef375f2cc33693e41fb2c0b4f5a961094d8803e47c47230ff55f59b01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

qAlFiSi.exe

Path C:\Windows\System\qAlFiSi.exe
Size 5.9MB
SHA256 40e0eb958567b646e971d8b151988017f3ad2962252aa3444e19cfa485dec804
MD5 37716cc6adde648d4801c0a9cfe694e2
SHA1 d86139a4a636a86bdd1b0069fa02bb204d67a8e1
SHA512 3620e9d499a009f80519d87bcebab6e8650441836972b7223ec7df413998905ae9179e9a8e8c953f8c9c6cfc92eda7f2a7c3aae20d7fcf648681e3e70b22b6b6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

rnZzBnO.exe

Path C:\Windows\System\rnZzBnO.exe
Size 5.9MB
SHA256 811fa354927c60fb814eeed3c3bd334a7d43b4b0cb48c95666524d63c1ed6d5e
MD5 879efa64d11080e2b1f2d48df1e60fe9
SHA1 a4c828231f45cd93c4649d9572fb34a56a288375
SHA512 e5d990a691bc9a104adc9cb5119ebd9cfcf10f8940b2fd7b6609157405f827741906a3cf1fdfee2ef71624ed5238f5828cf2c424a663bd5edce1f02e916b20d4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLTgcuD.exe

Path C:\Windows\System\xLTgcuD.exe
Size 5.9MB
SHA256 58fbec47c95e59198a249b648d0197bd4da2a79f9e487f894283285e39928c0b
MD5 d16ba43e1d872eb155a27a30bc33f189
SHA1 3bbdd22ef9f8650395fb35b5f02cf511c28939c2
SHA512 4ca34a5cbb50b1f011cd0291c31a22d5f8aca18c4c0aadbdb8d4768c9b05e8f7ebd21cfb589d9cb03f49800160ec20209bced6670c5bd16cdf0e3d423061ed12
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-145-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp

Download

memory/400-131-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp

Download

memory/400-69-0x00007FF64FA90000-0x00007FF64FDE4000-memory.dmp

Download

memory/816-72-0x00007FF6085B0000-0x00007FF608904000-memory.dmp

Download

memory/816-132-0x00007FF6085B0000-0x00007FF608904000-memory.dmp

Download

memory/816-148-0x00007FF6085B0000-0x00007FF608904000-memory.dmp

Download

memory/992-63-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp

Download

memory/992-142-0x00007FF7BCB40000-0x00007FF7BCE94000-memory.dmp

Download

memory/1156-102-0x00007FF795E10000-0x00007FF796164000-memory.dmp

Download

memory/1156-133-0x00007FF795E10000-0x00007FF796164000-memory.dmp

Download

memory/1156-152-0x00007FF795E10000-0x00007FF796164000-memory.dmp

Download

memory/1292-127-0x00007FF692790000-0x00007FF692AE4000-memory.dmp

Download

memory/1292-157-0x00007FF692790000-0x00007FF692AE4000-memory.dmp

Download

memory/1352-155-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp

Download

memory/1352-126-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp

Download

memory/1352-136-0x00007FF6A68D0000-0x00007FF6A6C24000-memory.dmp

Download

memory/1372-48-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp

Download

memory/1372-141-0x00007FF742D90000-0x00007FF7430E4000-memory.dmp

Download

memory/1584-135-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp

Download

memory/1584-156-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp

Download

memory/1584-120-0x00007FF64F6A0000-0x00007FF64F9F4000-memory.dmp

Download

memory/2136-138-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp

Download

memory/2136-130-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp

Download

memory/2136-19-0x00007FF67CEC0000-0x00007FF67D214000-memory.dmp

Download

memory/2200-144-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp

Download

memory/2200-86-0x00007FF6E0FD0000-0x00007FF6E1324000-memory.dmp

Download

memory/2240-54-0x00007FF680620000-0x00007FF680974000-memory.dmp

Download

memory/2240-143-0x00007FF680620000-0x00007FF680974000-memory.dmp

Download

memory/2364-68-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp

Download

memory/2364-147-0x00007FF63CFF0000-0x00007FF63D344000-memory.dmp

Download

memory/3064-137-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp

Download

memory/3064-10-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp

Download

memory/3064-129-0x00007FF6EC990000-0x00007FF6ECCE4000-memory.dmp

Download

memory/3088-92-0x00007FF7FE530000-0x00007FF7FE884000-memory.dmp

Download

memory/3088-150-0x00007FF7FE530000-0x00007FF7FE884000-memory.dmp

Download

memory/3328-153-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp

Download

memory/3328-134-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp

Download

memory/3328-114-0x00007FF6218F0000-0x00007FF621C44000-memory.dmp

Download

memory/3676-66-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp

Download

memory/3676-146-0x00007FF7CAB70000-0x00007FF7CAEC4000-memory.dmp

Download

memory/3964-139-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp

Download

memory/3964-41-0x00007FF6C2B60000-0x00007FF6C2EB4000-memory.dmp

Download

memory/4092-128-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp

Download

memory/4092-0-0x00007FF7D8160000-0x00007FF7D84B4000-memory.dmp

Download

memory/4092-1-0x000001E289FB0000-0x000001E289FC0000-memory.dmp

Download

memory/4176-116-0x00007FF6AF4D0000-0x00007FF6AF824000-memory.dmp

Download

memory/4176-154-0x00007FF6AF4D0000-0x00007FF6AF824000-memory.dmp

Download

memory/4468-91-0x00007FF72C0E0000-0x00007FF72C434000-memory.dmp

Download

memory/4468-151-0x00007FF72C0E0000-0x00007FF72C434000-memory.dmp

Download

memory/4496-140-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp

Download

memory/4496-60-0x00007FF7F86B0000-0x00007FF7F8A04000-memory.dmp

Download

memory/4784-149-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp

Download

memory/4784-56-0x00007FF76EE60000-0x00007FF76F1B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads