cobaltstrike | c1231e76678419f36063237a6bbf4e41feadafa291a19361584e20f53613c8f5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-lelpnabc78
SHA256 c1231e76678419f36063237a6bbf4e41feadafa291a19361584e20f53613c8f5
MD5 096987b2d366cca20587587ce664518f
SHA1 fe45ae4d73d1273dec38f8f04dcf836a1b47ac67
SHA512 1dc515e52e0d6d4a4b051bfa6fedb7566ae5142255b56520400a92ea22f57f9b44c233b5e7d0780d24f0473d4e1abd8b0a91e2fc09138f7c93c0bc76570c8ea8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002347e-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023485-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023486-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023487-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023489-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023488-33.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348a-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348b-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348d-57.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348e-62.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348f-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023490-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023492-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023493-86.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023496-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023498-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023497-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023495-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023494-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023491-79.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348c-52.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000900000002347e-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023485-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023486-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023487-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023489-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023488-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348a-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348b-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348d-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348e-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348f-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023490-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023492-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023493-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023496-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023498-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023497-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023495-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023494-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023491-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348c-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	UPX
behavioral2/files/0x000900000002347e-4.dat	UPX
behavioral2/files/0x0007000000023485-11.dat	UPX
behavioral2/files/0x0007000000023486-10.dat	UPX
behavioral2/memory/4480-14-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	UPX
behavioral2/memory/3080-9-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	UPX
behavioral2/memory/4904-20-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	UPX
behavioral2/files/0x0007000000023487-24.dat	UPX
behavioral2/files/0x0007000000023489-32.dat	UPX
behavioral2/files/0x0007000000023488-33.dat	UPX
behavioral2/memory/1888-30-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	UPX
behavioral2/memory/2432-29-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	UPX
behavioral2/memory/5080-37-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	UPX
behavioral2/files/0x000700000002348a-41.dat	UPX
behavioral2/files/0x000700000002348b-47.dat	UPX
behavioral2/files/0x000700000002348d-57.dat	UPX
behavioral2/files/0x000700000002348e-62.dat	UPX
behavioral2/files/0x000700000002348f-66.dat	UPX
behavioral2/files/0x0007000000023490-71.dat	UPX
behavioral2/files/0x0007000000023492-82.dat	UPX
behavioral2/files/0x0007000000023493-86.dat	UPX
behavioral2/files/0x0007000000023496-99.dat	UPX
behavioral2/files/0x0007000000023498-111.dat	UPX
behavioral2/files/0x0007000000023497-109.dat	UPX
behavioral2/files/0x0007000000023495-102.dat	UPX
behavioral2/files/0x0007000000023494-97.dat	UPX
behavioral2/files/0x0007000000023491-79.dat	UPX
behavioral2/files/0x000700000002348c-52.dat	UPX
behavioral2/memory/3132-113-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	UPX
behavioral2/memory/1068-116-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	UPX
behavioral2/memory/1608-118-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	UPX
behavioral2/memory/3796-117-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	UPX
behavioral2/memory/4016-119-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	UPX
behavioral2/memory/3940-115-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	UPX
behavioral2/memory/4948-114-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	UPX
behavioral2/memory/4524-121-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	UPX
behavioral2/memory/3348-120-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	UPX
behavioral2/memory/3888-122-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	UPX
behavioral2/memory/4920-125-0x00007FF6AC100000-0x00007FF6AC454000-memory.dmp	UPX
behavioral2/memory/1116-126-0x00007FF760C70000-0x00007FF760FC4000-memory.dmp	UPX
behavioral2/memory/5076-127-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	UPX
behavioral2/memory/2428-124-0x00007FF6D6B80000-0x00007FF6D6ED4000-memory.dmp	UPX
behavioral2/memory/5028-123-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	UPX
behavioral2/memory/1572-128-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	UPX
behavioral2/memory/2432-129-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	UPX
behavioral2/memory/1888-130-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	UPX
behavioral2/memory/3080-131-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	UPX
behavioral2/memory/4480-132-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	UPX
behavioral2/memory/4904-133-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	UPX
behavioral2/memory/2432-134-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	UPX
behavioral2/memory/1888-135-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	UPX
behavioral2/memory/5080-136-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	UPX
behavioral2/memory/3132-137-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	UPX
behavioral2/memory/4948-138-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	UPX
behavioral2/memory/3796-139-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	UPX
behavioral2/memory/1068-140-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	UPX
behavioral2/memory/3348-142-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	UPX
behavioral2/memory/4016-144-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	UPX
behavioral2/memory/4524-143-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	UPX
behavioral2/memory/3940-141-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	UPX
behavioral2/memory/5076-146-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	UPX
behavioral2/memory/1608-145-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	UPX
behavioral2/memory/3888-151-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	UPX
behavioral2/memory/5028-150-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	xmrig
behavioral2/files/0x000900000002347e-4.dat	xmrig
behavioral2/files/0x0007000000023485-11.dat	xmrig
behavioral2/files/0x0007000000023486-10.dat	xmrig
behavioral2/memory/4480-14-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	xmrig
behavioral2/memory/3080-9-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	xmrig
behavioral2/memory/4904-20-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	xmrig
behavioral2/files/0x0007000000023487-24.dat	xmrig
behavioral2/files/0x0007000000023489-32.dat	xmrig
behavioral2/files/0x0007000000023488-33.dat	xmrig
behavioral2/memory/1888-30-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	xmrig
behavioral2/memory/2432-29-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	xmrig
behavioral2/memory/5080-37-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002348a-41.dat	xmrig
behavioral2/files/0x000700000002348b-47.dat	xmrig
behavioral2/files/0x000700000002348d-57.dat	xmrig
behavioral2/files/0x000700000002348e-62.dat	xmrig
behavioral2/files/0x000700000002348f-66.dat	xmrig
behavioral2/files/0x0007000000023490-71.dat	xmrig
behavioral2/files/0x0007000000023492-82.dat	xmrig
behavioral2/files/0x0007000000023493-86.dat	xmrig
behavioral2/files/0x0007000000023496-99.dat	xmrig
behavioral2/files/0x0007000000023498-111.dat	xmrig
behavioral2/files/0x0007000000023497-109.dat	xmrig
behavioral2/files/0x0007000000023495-102.dat	xmrig
behavioral2/files/0x0007000000023494-97.dat	xmrig
behavioral2/files/0x0007000000023491-79.dat	xmrig
behavioral2/files/0x000700000002348c-52.dat	xmrig
behavioral2/memory/3132-113-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	xmrig
behavioral2/memory/1068-116-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	xmrig
behavioral2/memory/1608-118-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	xmrig
behavioral2/memory/3796-117-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	xmrig
behavioral2/memory/4016-119-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	xmrig
behavioral2/memory/3940-115-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	xmrig
behavioral2/memory/4948-114-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	xmrig
behavioral2/memory/4524-121-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	xmrig
behavioral2/memory/3348-120-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	xmrig
behavioral2/memory/3888-122-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	xmrig
behavioral2/memory/4920-125-0x00007FF6AC100000-0x00007FF6AC454000-memory.dmp	xmrig
behavioral2/memory/1116-126-0x00007FF760C70000-0x00007FF760FC4000-memory.dmp	xmrig
behavioral2/memory/5076-127-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	xmrig
behavioral2/memory/2428-124-0x00007FF6D6B80000-0x00007FF6D6ED4000-memory.dmp	xmrig
behavioral2/memory/5028-123-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	xmrig
behavioral2/memory/1572-128-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	xmrig
behavioral2/memory/2432-129-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	xmrig
behavioral2/memory/1888-130-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	xmrig
behavioral2/memory/3080-131-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	xmrig
behavioral2/memory/4480-132-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	xmrig
behavioral2/memory/4904-133-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	xmrig
behavioral2/memory/2432-134-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	xmrig
behavioral2/memory/1888-135-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	xmrig
behavioral2/memory/5080-136-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	xmrig
behavioral2/memory/3132-137-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	xmrig
behavioral2/memory/4948-138-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	xmrig
behavioral2/memory/3796-139-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	xmrig
behavioral2/memory/1068-140-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	xmrig
behavioral2/memory/3348-142-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	xmrig
behavioral2/memory/4016-144-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	xmrig
behavioral2/memory/4524-143-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	xmrig
behavioral2/memory/3940-141-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	xmrig
behavioral2/memory/5076-146-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	xmrig
behavioral2/memory/1608-145-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	xmrig
behavioral2/memory/3888-151-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	xmrig
behavioral2/memory/5028-150-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3080	uhmDvfy.exe
4480	ZLwIxsg.exe
4904	gCKCDwZ.exe
2432	KGDcBtd.exe
1888	FlTQsKJ.exe
5080	GVqWEbX.exe
3132	JFTjyqE.exe
4948	XVZjUzU.exe
3940	wLmSuBY.exe
1068	ghhspaP.exe
3796	iwWJfcf.exe
1608	gztnvpE.exe
4016	YlmyhoP.exe
3348	gBhzdEa.exe
4524	CSVbaGb.exe
3888	pKyzhLt.exe
5028	LtZdGTF.exe
2428	guBHrYd.exe
4920	GWiNLpT.exe
1116	AtqcwsM.exe
5076	KPrZEBs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1572-0-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	upx
behavioral2/files/0x000900000002347e-4.dat	upx
behavioral2/files/0x0007000000023485-11.dat	upx
behavioral2/files/0x0007000000023486-10.dat	upx
behavioral2/memory/4480-14-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	upx
behavioral2/memory/3080-9-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	upx
behavioral2/memory/4904-20-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	upx
behavioral2/files/0x0007000000023487-24.dat	upx
behavioral2/files/0x0007000000023489-32.dat	upx
behavioral2/files/0x0007000000023488-33.dat	upx
behavioral2/memory/1888-30-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	upx
behavioral2/memory/2432-29-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	upx
behavioral2/memory/5080-37-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	upx
behavioral2/files/0x000700000002348a-41.dat	upx
behavioral2/files/0x000700000002348b-47.dat	upx
behavioral2/files/0x000700000002348d-57.dat	upx
behavioral2/files/0x000700000002348e-62.dat	upx
behavioral2/files/0x000700000002348f-66.dat	upx
behavioral2/files/0x0007000000023490-71.dat	upx
behavioral2/files/0x0007000000023492-82.dat	upx
behavioral2/files/0x0007000000023493-86.dat	upx
behavioral2/files/0x0007000000023496-99.dat	upx
behavioral2/files/0x0007000000023498-111.dat	upx
behavioral2/files/0x0007000000023497-109.dat	upx
behavioral2/files/0x0007000000023495-102.dat	upx
behavioral2/files/0x0007000000023494-97.dat	upx
behavioral2/files/0x0007000000023491-79.dat	upx
behavioral2/files/0x000700000002348c-52.dat	upx
behavioral2/memory/3132-113-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	upx
behavioral2/memory/1068-116-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	upx
behavioral2/memory/1608-118-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	upx
behavioral2/memory/3796-117-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	upx
behavioral2/memory/4016-119-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	upx
behavioral2/memory/3940-115-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	upx
behavioral2/memory/4948-114-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	upx
behavioral2/memory/4524-121-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	upx
behavioral2/memory/3348-120-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	upx
behavioral2/memory/3888-122-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	upx
behavioral2/memory/4920-125-0x00007FF6AC100000-0x00007FF6AC454000-memory.dmp	upx
behavioral2/memory/1116-126-0x00007FF760C70000-0x00007FF760FC4000-memory.dmp	upx
behavioral2/memory/5076-127-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	upx
behavioral2/memory/2428-124-0x00007FF6D6B80000-0x00007FF6D6ED4000-memory.dmp	upx
behavioral2/memory/5028-123-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	upx
behavioral2/memory/1572-128-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp	upx
behavioral2/memory/2432-129-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	upx
behavioral2/memory/1888-130-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	upx
behavioral2/memory/3080-131-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp	upx
behavioral2/memory/4480-132-0x00007FF604EF0000-0x00007FF605244000-memory.dmp	upx
behavioral2/memory/4904-133-0x00007FF7695D0000-0x00007FF769924000-memory.dmp	upx
behavioral2/memory/2432-134-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp	upx
behavioral2/memory/1888-135-0x00007FF75D620000-0x00007FF75D974000-memory.dmp	upx
behavioral2/memory/5080-136-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp	upx
behavioral2/memory/3132-137-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp	upx
behavioral2/memory/4948-138-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp	upx
behavioral2/memory/3796-139-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp	upx
behavioral2/memory/1068-140-0x00007FF742C00000-0x00007FF742F54000-memory.dmp	upx
behavioral2/memory/3348-142-0x00007FF7562D0000-0x00007FF756624000-memory.dmp	upx
behavioral2/memory/4016-144-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp	upx
behavioral2/memory/4524-143-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp	upx
behavioral2/memory/3940-141-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp	upx
behavioral2/memory/5076-146-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp	upx
behavioral2/memory/1608-145-0x00007FF756650000-0x00007FF7569A4000-memory.dmp	upx
behavioral2/memory/3888-151-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp	upx
behavioral2/memory/5028-150-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KPrZEBs.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wLmSuBY.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YlmyhoP.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\guBHrYd.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CSVbaGb.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GWiNLpT.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZLwIxsg.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gCKCDwZ.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iwWJfcf.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XVZjUzU.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gztnvpE.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gBhzdEa.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LtZdGTF.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KGDcBtd.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FlTQsKJ.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JFTjyqE.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pKyzhLt.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AtqcwsM.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uhmDvfy.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GVqWEbX.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ghhspaP.exe	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 3080	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	83
PID 1572 wrote to memory of 3080	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	83
PID 1572 wrote to memory of 4480	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	84
PID 1572 wrote to memory of 4480	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	84
PID 1572 wrote to memory of 4904	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	85
PID 1572 wrote to memory of 4904	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	85
PID 1572 wrote to memory of 2432	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	86
PID 1572 wrote to memory of 2432	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	86
PID 1572 wrote to memory of 1888	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	88
PID 1572 wrote to memory of 1888	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	88
PID 1572 wrote to memory of 5080	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	90
PID 1572 wrote to memory of 5080	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	90
PID 1572 wrote to memory of 3132	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	91
PID 1572 wrote to memory of 3132	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	91
PID 1572 wrote to memory of 4948	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	92
PID 1572 wrote to memory of 4948	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	92
PID 1572 wrote to memory of 3940	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	93
PID 1572 wrote to memory of 3940	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	93
PID 1572 wrote to memory of 1068	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	94
PID 1572 wrote to memory of 1068	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	94
PID 1572 wrote to memory of 3796	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	95
PID 1572 wrote to memory of 3796	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	95
PID 1572 wrote to memory of 1608	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	96
PID 1572 wrote to memory of 1608	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	96
PID 1572 wrote to memory of 4016	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	97
PID 1572 wrote to memory of 4016	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	97
PID 1572 wrote to memory of 3348	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	98
PID 1572 wrote to memory of 3348	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	98
PID 1572 wrote to memory of 4524	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	99
PID 1572 wrote to memory of 4524	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	99
PID 1572 wrote to memory of 3888	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	100
PID 1572 wrote to memory of 3888	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	100
PID 1572 wrote to memory of 5028	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	101
PID 1572 wrote to memory of 5028	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	101
PID 1572 wrote to memory of 2428	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	102
PID 1572 wrote to memory of 2428	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	102
PID 1572 wrote to memory of 4920	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	103
PID 1572 wrote to memory of 4920	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	103
PID 1572 wrote to memory of 1116	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	104
PID 1572 wrote to memory of 1116	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	104
PID 1572 wrote to memory of 5076	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	105
PID 1572 wrote to memory of 5076	1572	2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_096987b2d366cca20587587ce664518f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\System\uhmDvfy.exe
  C:\Windows\System\uhmDvfy.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ZLwIxsg.exe
  C:\Windows\System\ZLwIxsg.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\gCKCDwZ.exe
  C:\Windows\System\gCKCDwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\KGDcBtd.exe
  C:\Windows\System\KGDcBtd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\FlTQsKJ.exe
  C:\Windows\System\FlTQsKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\GVqWEbX.exe
  C:\Windows\System\GVqWEbX.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\JFTjyqE.exe
  C:\Windows\System\JFTjyqE.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\XVZjUzU.exe
  C:\Windows\System\XVZjUzU.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\wLmSuBY.exe
  C:\Windows\System\wLmSuBY.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\ghhspaP.exe
  C:\Windows\System\ghhspaP.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\iwWJfcf.exe
  C:\Windows\System\iwWJfcf.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\gztnvpE.exe
  C:\Windows\System\gztnvpE.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\YlmyhoP.exe
  C:\Windows\System\YlmyhoP.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\gBhzdEa.exe
  C:\Windows\System\gBhzdEa.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\CSVbaGb.exe
  C:\Windows\System\CSVbaGb.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\pKyzhLt.exe
  C:\Windows\System\pKyzhLt.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\LtZdGTF.exe
  C:\Windows\System\LtZdGTF.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\guBHrYd.exe
  C:\Windows\System\guBHrYd.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GWiNLpT.exe
  C:\Windows\System\GWiNLpT.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\AtqcwsM.exe
  C:\Windows\System\AtqcwsM.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\KPrZEBs.exe
  C:\Windows\System\KPrZEBs.exe
  2⤵
  - Executes dropped EXE
  PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AtqcwsM.exe

Path C:\Windows\System\AtqcwsM.exe
Size 5.9MB
SHA256 4cae3588eee9c66cf1481ca482d049be695a43475373ad175bef68676af98922
MD5 d421a9a9d72f5eaa6141ca1cebc3f7e6
SHA1 dd9f3914b023c98c04082a6cdbb77a0438659e01
SHA512 f7d43672518c12e6277f99c28cab0ee08e44f2c4a73642bae16434847329c4a66fa4ca68d88f1fa958c63fc1e70ed92e96486b5853a0faeefc30506639de6e23
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSVbaGb.exe

Path C:\Windows\System\CSVbaGb.exe
Size 5.9MB
SHA256 56b688f43a97541a12693c6a6a91c825ce15a52a8c98c403be6cb50bb75ca359
MD5 40a836c864590030ed017bcfa278bd98
SHA1 4db0ce79a39ea63186834386644ecf0db34bacb3
SHA512 1a5488a1be9b5c5a9e5ebd8ebe59bc558faa2ba2a6f9b2134e8580d977420e2f3725ed4f843bbb66caae29d0dd0949fbe39c7234896f918cc0e06b1685ad2414
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlTQsKJ.exe

Path C:\Windows\System\FlTQsKJ.exe
Size 5.9MB
SHA256 e98065c6c0b3b6308375546b984b94b900d745a51c3861029d88c5a418208ae2
MD5 3ad4ad915368fe74131557707e11bbfd
SHA1 ca401ee7f1b975ac0fc8c28bccb5ecd303a25085
SHA512 9e0fbb0aa9cc3e42bcce4c5a1e7e90626454b980e69db063c833ab0ac31a45a7775bbed35aa221c1e202f21e4ba892d6ad347f1ba0e06a41eb3d337104359a36
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

GVqWEbX.exe

Path C:\Windows\System\GVqWEbX.exe
Size 5.9MB
SHA256 0a44d026a811a3bcae35626c6e94db183264a6f027ed07ec1e8d0bcc7169b1f7
MD5 4799905aceddf2bc2fa08fffeb7bc8c4
SHA1 ad43829aab55e53c036e24c5909f77982f2a70dc
SHA512 61ea3703ee643c476661ef7742b1c8746ed02f616d6aab6e541e482bf08d8b7283bf067ef1be8cdbbe26d254efff06cde2069d0af70491ab0e683e5d13914670
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

GWiNLpT.exe

Path C:\Windows\System\GWiNLpT.exe
Size 5.9MB
SHA256 b75ab016fa519673255567556233bf6b6f4394e3869b8d093b2146d3dbe91fb4
MD5 d0e0875b03804ce14ecf7bcd99da3d30
SHA1 d2d9f9b6e62b9cf120cb2cf19d9481bf9f226a69
SHA512 36898ad09516ed21ef9888371fa97180972787684714881628feaecc7603162e76dbb83b75819b205e1d8b7e678018d78cfcad3433f9b661fee76933c46f3cb0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

JFTjyqE.exe

Path C:\Windows\System\JFTjyqE.exe
Size 5.9MB
SHA256 9098df62e35a39c85798ae06b96165bc07bdb9f197c0b892353f0a63075fd832
MD5 7e5c8a00b685f15619719cde37cd9aed
SHA1 88729265de1e38197d676a0867d8a2b2e1ac60be
SHA512 c03e490b35fee1d1de8a97eddf76d5b3a5814b68f095759c1aaa7e4bf26c45a6bc2a1836c2c07cba282eff84c3ebc079f61608d1cbf3bfe0c0c7f036a87bd223
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

KGDcBtd.exe

Path C:\Windows\System\KGDcBtd.exe
Size 5.9MB
SHA256 d64f5c663cab292b733f409ee86fef8c3f0fe170a1ffae6bf64835cbd4735278
MD5 2977ae5fb496550818855add817d2a39
SHA1 9b9a843c19baea90398844b0785f104661ec0ba7
SHA512 444b54ba547d981732f0a5e1ed24c32a93e214a0085f1f41571128fbfc6b0836f34ba2e4312124bb89c0ce34538dc135871eeec0241cb0dbdc525cf3f286c0ea
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

KPrZEBs.exe

Path C:\Windows\System\KPrZEBs.exe
Size 5.9MB
SHA256 06da3cc58961b7f4861f5c106587c182dd2f82e6864b866b9234a95c5ccdad19
MD5 c74c58a3c9fdb190a4c88bf42f20af69
SHA1 5dbbfc0db8bae5cc0edbb55550d19971ff834e46
SHA512 c56b42af4478a8b888725af14bd06c51f5dfa46726158745bfa32c2f9d543bb42722b6663eca628e508030e37744e63e8530b065e3478ca02a10d382ef2c7ee3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

LtZdGTF.exe

Path C:\Windows\System\LtZdGTF.exe
Size 5.9MB
SHA256 848090c4378a81691f74d255d1cf048a26b3c582814d27cf473ca209d1f301a6
MD5 0b6b075a930a0096f31b7426d439cdd0
SHA1 3dfd785b966ba185a82e2701fe93b3dcdc92e0f4
SHA512 5afb6587440c81bbf3e0c18652ce4274094a789372bb1ade98894f5f2b1a9484814e3999a6b859935cf6b98ab3ef6d65e544ddcbd86aaaa683550d5ac7bad0fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVZjUzU.exe

Path C:\Windows\System\XVZjUzU.exe
Size 5.9MB
SHA256 7350af78582d656577be654b2640d450d86e0dcee43fc38cc058581185fb3d12
MD5 0a57e679f590979f769f38ad123fad29
SHA1 850677d6285dcec78deaed75300d2d0f07b1d0d3
SHA512 1c8afdc754924089f1a0229b2aed1faba08eba1e724133f4af510c73d2256b01f33bfbc0d452cf2313a1f070a345b0c6a5f0261492359d911f83fb721d4112b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

YlmyhoP.exe

Path C:\Windows\System\YlmyhoP.exe
Size 5.9MB
SHA256 4071e0fe598bcd71cdf0e3b3b4b3b7d38e72a39d18994e9eb9df21008218f268
MD5 8f9f87d72f3c6d71c338513fc41eabb6
SHA1 94b5983dbd9f1cf491e8229657df86d23f969b96
SHA512 d7f29ab0b826ad87223866828004847417ab14dfd056848e40724a9e4a805eaea5eb887d7e873e3c565d799411676a586e53fb0b20216048e50facb7f5fd926c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZLwIxsg.exe

Path C:\Windows\System\ZLwIxsg.exe
Size 5.9MB
SHA256 4c793572f805bfdf8f87b9c88a8f6c1bf5faf34b0776941516dd6b5678503292
MD5 e3d36b87689f78cbb9e9a619b077056e
SHA1 12ccb5e765fc8e6cc3ecafcbc1dca58c3f3d05dd
SHA512 c54f95e385ef9148edd733f792b512c9c28f79ebbe8c7b6358e901e4ea9333c24d61b8954d0c19aa3cb8e6924fee4eb690a400763f9f20f789d68cf5c7c726b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

gBhzdEa.exe

Path C:\Windows\System\gBhzdEa.exe
Size 5.9MB
SHA256 b2b5d24145d68a6ee98e2a48bb998fb3fef2fc92f722ceb032adcb8003d2e3d1
MD5 d5dd2b50862048b63e44c775bb8682c1
SHA1 3dbd131a1460ca43493eacd8af5f65bbe341f147
SHA512 725892807831003f203501f2fd1181b8c46280a10632964b412662495ec998abedb64479ee6607e5cf3e495edcbe4c487441e8682b9d6deaebec221c8d93f4b3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCKCDwZ.exe

Path C:\Windows\System\gCKCDwZ.exe
Size 5.9MB
SHA256 400c6074962f1d5f82e8bad61fb753712dc663f5d9ac7b6c833c6770d7c00178
MD5 b56d908ed9f40b225cfc916ff7e6bb0c
SHA1 ac9cc51bea1d62f851352c1aa20aa171a9ebf1b5
SHA512 534887f214fdf4c908870edc97bb7d6d235557577b2305600ffc52e4e2a221f5b0d6c96273e5e3849dea6cd1846426d236b5c16cc49f275836fec6526173f258
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghhspaP.exe

Path C:\Windows\System\ghhspaP.exe
Size 5.9MB
SHA256 ae089cef768d9d21c06f6fe5f3440fcef6e2d46e940625f8605e25bee0eb86c1
MD5 d6f04612ae6cfc6f2121c7267acbead4
SHA1 c33ac4f533313ba9ea4b162344aa8e53966b1147
SHA512 42436e8fd80ff07381fc8729c5fbbafbca9cd0c98cf70baeaed9153e91bcd14d808c0d7b69e1f5f809ae452ecd570e078472699b1067ef59effac3df09d1c183
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

guBHrYd.exe

Path C:\Windows\System\guBHrYd.exe
Size 5.9MB
SHA256 a960a0e12bd85725f23ea24b89c258eacbea30120f63d17afaf765b9170c432d
MD5 91710e43aee1ab267782883b714f6dbc
SHA1 b00415effccd02800de090466e5a467e598b068c
SHA512 6c299548f402204ea7ae1090a42eeed5ceace6a1464601ed14ebf6d5d276c81dc8bffa17a8911f9b697cfd86b04ba07c798d236481b2a341163d94da6c9f86db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

gztnvpE.exe

Path C:\Windows\System\gztnvpE.exe
Size 5.9MB
SHA256 71c986d9948fc233d0aa19c3965e7f221187ced66251c284c804ec6d0c171270
MD5 8ae842cf782830a9be9c193ac4121fba
SHA1 9648e1e097061f4b4bb90d04f447a34c3a86d366
SHA512 8730c5c1c17064229915304e7fa3b8cec506bc20d397b110527f63ae2096f57466614068577198ff5aef330e49b8851aff82a3435ba61c6dd093ad5009bf3cfc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

iwWJfcf.exe

Path C:\Windows\System\iwWJfcf.exe
Size 5.9MB
SHA256 f9282743f30b0040c60663dbe4a69072b85fc00d1a2f14d4dcde77624eadd94f
MD5 cf75be49eee028b11dff1356aff922e5
SHA1 24c5a91ae174e70e04663b0ebc447273bc58f435
SHA512 edc67d9d36122b7b7eea049ed4b7d2325376f7f731062e5390f9d506b49e4c54d9c3b7a27c2857ddf058d53fd8791149728ef519adb248425935e13ce5164f3e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

pKyzhLt.exe

Path C:\Windows\System\pKyzhLt.exe
Size 5.9MB
SHA256 4579165d2b5d7c0ebc31467352747ad912184c3c8a18a9a58b6ba54735f2aebd
MD5 7fb12c2187ff4e33ef5072a057a70124
SHA1 16c6160aae5c9813eb9829eabed4fb3d28ddc508
SHA512 83d1c6c0089d07f8cefd4597d3f5dd8af54014aaf09df1241d656cc735284e368e069cb90d08a0c8097d1cdb35019795a790068cf8f35d473939c33c163a7da5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhmDvfy.exe

Path C:\Windows\System\uhmDvfy.exe
Size 5.9MB
SHA256 688008699fa3d0892cdb5338ed9dbc2a749059ff0cc9fcf288f63d370c22ea89
MD5 c9b7249e5e0eae090e78ae3dad7f898f
SHA1 3cc73122a403bb13b3cb39fb5d4b49c4111331d6
SHA512 751d4b0aeb10ecd560382f0562fd197b8addee129f79384de75cdb409edce5f8b615af5a3ec97ffff7e8f791336369d009878f4a85aaa7b8643dd28a671679d1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLmSuBY.exe

Path C:\Windows\System\wLmSuBY.exe
Size 5.9MB
SHA256 d29f0f0a12de736c9eec6cb8cce1944a8593ef987a40aaed93739bf01e486d45
MD5 d5f5e8c8e974d3261c0773e08f4c8296
SHA1 6bbf39d8de691005473b7a831686ce9031fc238b
SHA512 e96aaafc656a6c479a07a80efc9275dbf0eb4eb7335f5885f327da31f91847354dabff5c9b0ffedd5c06c969611a2243f13bddc64ff0c764977cda7ffd5e8e5e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-140-0x00007FF742C00000-0x00007FF742F54000-memory.dmp

Download

memory/1068-116-0x00007FF742C00000-0x00007FF742F54000-memory.dmp

Download

memory/1116-148-0x00007FF760C70000-0x00007FF760FC4000-memory.dmp

Download

memory/1116-126-0x00007FF760C70000-0x00007FF760FC4000-memory.dmp

Download

memory/1572-128-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp

Download

memory/1572-1-0x000002E7E2B00000-0x000002E7E2B10000-memory.dmp

Download

memory/1572-0-0x00007FF6AFE30000-0x00007FF6B0184000-memory.dmp

Download

memory/1608-118-0x00007FF756650000-0x00007FF7569A4000-memory.dmp

Download

memory/1608-145-0x00007FF756650000-0x00007FF7569A4000-memory.dmp

Download

memory/1888-30-0x00007FF75D620000-0x00007FF75D974000-memory.dmp

Download

memory/1888-135-0x00007FF75D620000-0x00007FF75D974000-memory.dmp

Download

memory/1888-130-0x00007FF75D620000-0x00007FF75D974000-memory.dmp

Download

memory/2428-149-0x00007FF6D6B80000-0x00007FF6D6ED4000-memory.dmp

Download

memory/2428-124-0x00007FF6D6B80000-0x00007FF6D6ED4000-memory.dmp

Download

memory/2432-134-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp

Download

memory/2432-29-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp

Download

memory/2432-129-0x00007FF7A0870000-0x00007FF7A0BC4000-memory.dmp

Download

memory/3080-9-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp

Download

memory/3080-131-0x00007FF6AD360000-0x00007FF6AD6B4000-memory.dmp

Download

memory/3132-113-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp

Download

memory/3132-137-0x00007FF796BE0000-0x00007FF796F34000-memory.dmp

Download

memory/3348-142-0x00007FF7562D0000-0x00007FF756624000-memory.dmp

Download

memory/3348-120-0x00007FF7562D0000-0x00007FF756624000-memory.dmp

Download

memory/3796-117-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp

Download

memory/3796-139-0x00007FF799CD0000-0x00007FF79A024000-memory.dmp

Download

memory/3888-151-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp

Download

memory/3888-122-0x00007FF7CED00000-0x00007FF7CF054000-memory.dmp

Download

memory/3940-141-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp

Download

memory/3940-115-0x00007FF7ECC50000-0x00007FF7ECFA4000-memory.dmp

Download

memory/4016-119-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp

Download

memory/4016-144-0x00007FF7E3E30000-0x00007FF7E4184000-memory.dmp

Download

memory/4480-132-0x00007FF604EF0000-0x00007FF605244000-memory.dmp

Download

memory/4480-14-0x00007FF604EF0000-0x00007FF605244000-memory.dmp

Download

memory/4524-143-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp

Download

memory/4524-121-0x00007FF7B87D0000-0x00007FF7B8B24000-memory.dmp

Download

memory/4904-20-0x00007FF7695D0000-0x00007FF769924000-memory.dmp

Download

memory/4904-133-0x00007FF7695D0000-0x00007FF769924000-memory.dmp

Download

memory/4920-147-0x00007FF6AC100000-0x00007FF6AC454000-memory.dmp

Download

memory/4920-125-0x00007FF6AC100000-0x00007FF6AC454000-memory.dmp

Download

memory/4948-138-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp

Download

memory/4948-114-0x00007FF618B80000-0x00007FF618ED4000-memory.dmp

Download

memory/5028-150-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp

Download

memory/5028-123-0x00007FF6D09C0000-0x00007FF6D0D14000-memory.dmp

Download

memory/5076-146-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp

Download

memory/5076-127-0x00007FF60DA70000-0x00007FF60DDC4000-memory.dmp

Download

memory/5080-37-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp

Download

memory/5080-136-0x00007FF62DE60000-0x00007FF62E1B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads