cobaltstrike | f4b522801351ece9ad66ff6963a15916b1ed05e0509915fc51512fa47790ca33

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240603-ll2pfsbe92
SHA256 f4b522801351ece9ad66ff6963a15916b1ed05e0509915fc51512fa47790ca33
MD5 8021f004ae65fdf99b00057c44b047ca
SHA1 06ed1bfcb97803faa9ed92547dd6f626e51b72b3
SHA512 e539afbdcbcf71ada8f46a97b01e494585753ebd871c130a15530ee3b2ab7abe72bbd87e6f4bf63048b6fc7dc548969f57943c7e354f06fc959843081bb32e0e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000b0000000233fa-5.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023412-11.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023413-18.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-30.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023406-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-53.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-62.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-102.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000233fa-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023412-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023413-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023406-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4472-0-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	UPX
behavioral2/files/0x000b0000000233fa-5.dat	UPX
behavioral2/memory/4644-8-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX
behavioral2/files/0x0008000000023412-11.dat	UPX
behavioral2/files/0x0008000000023413-18.dat	UPX
behavioral2/memory/1372-16-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-23.dat	UPX
behavioral2/memory/3552-22-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	UPX
behavioral2/memory/4684-26-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-30.dat	UPX
behavioral2/files/0x0009000000023406-34.dat	UPX
behavioral2/files/0x0007000000023417-41.dat	UPX
behavioral2/memory/4392-44-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	UPX
behavioral2/memory/3232-37-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	UPX
behavioral2/memory/916-35-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-47.dat	UPX
behavioral2/memory/2104-50-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-53.dat	UPX
behavioral2/files/0x000700000002341a-59.dat	UPX
behavioral2/files/0x000700000002341b-62.dat	UPX
behavioral2/files/0x000700000002341c-71.dat	UPX
behavioral2/memory/4472-68-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	UPX
behavioral2/memory/1372-74-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	UPX
behavioral2/files/0x000700000002341d-78.dat	UPX
behavioral2/files/0x000700000002341e-84.dat	UPX
behavioral2/memory/2432-88-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	UPX
behavioral2/memory/3552-87-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-93.dat	UPX
behavioral2/files/0x0007000000023422-108.dat	UPX
behavioral2/files/0x0007000000023423-111.dat	UPX
behavioral2/files/0x0007000000023424-116.dat	UPX
behavioral2/files/0x0007000000023425-123.dat	UPX
behavioral2/files/0x0007000000023421-106.dat	UPX
behavioral2/files/0x0007000000023420-102.dat	UPX
behavioral2/memory/3268-83-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	UPX
behavioral2/memory/3064-75-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	UPX
behavioral2/memory/4644-73-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX
behavioral2/memory/2084-72-0x00007FF77A210000-0x00007FF77A561000-memory.dmp	UPX
behavioral2/memory/3864-61-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	UPX
behavioral2/memory/3076-54-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	UPX
behavioral2/memory/4472-125-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	UPX
behavioral2/memory/3232-131-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	UPX
behavioral2/memory/2104-133-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX
behavioral2/memory/648-136-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp	UPX
behavioral2/memory/1144-138-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp	UPX
behavioral2/memory/4412-137-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp	UPX
behavioral2/memory/556-135-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp	UPX
behavioral2/memory/1068-134-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp	UPX
behavioral2/memory/432-139-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp	UPX
behavioral2/memory/4304-140-0x00007FF783B00000-0x00007FF783E51000-memory.dmp	UPX
behavioral2/memory/3064-144-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	UPX
behavioral2/memory/2432-146-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	UPX
behavioral2/memory/3268-145-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	UPX
behavioral2/memory/3864-142-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	UPX
behavioral2/memory/3076-141-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	UPX
behavioral2/memory/4472-154-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	UPX
behavioral2/memory/4644-199-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX
behavioral2/memory/1372-201-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	UPX
behavioral2/memory/3552-209-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	UPX
behavioral2/memory/4684-211-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	UPX
behavioral2/memory/916-213-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	UPX
behavioral2/memory/4392-215-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	UPX
behavioral2/memory/3232-217-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	UPX
behavioral2/memory/2104-220-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4684-26-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	xmrig
behavioral2/memory/4392-44-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	xmrig
behavioral2/memory/916-35-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	xmrig
behavioral2/memory/2104-50-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	xmrig
behavioral2/memory/4472-68-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	xmrig
behavioral2/memory/1372-74-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	xmrig
behavioral2/memory/3552-87-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	xmrig
behavioral2/memory/4644-73-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	xmrig
behavioral2/memory/2084-72-0x00007FF77A210000-0x00007FF77A561000-memory.dmp	xmrig
behavioral2/memory/4472-125-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	xmrig
behavioral2/memory/3232-131-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	xmrig
behavioral2/memory/2104-133-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	xmrig
behavioral2/memory/648-136-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp	xmrig
behavioral2/memory/1144-138-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp	xmrig
behavioral2/memory/4412-137-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp	xmrig
behavioral2/memory/556-135-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp	xmrig
behavioral2/memory/1068-134-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp	xmrig
behavioral2/memory/432-139-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp	xmrig
behavioral2/memory/4304-140-0x00007FF783B00000-0x00007FF783E51000-memory.dmp	xmrig
behavioral2/memory/3064-144-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	xmrig
behavioral2/memory/2432-146-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	xmrig
behavioral2/memory/3268-145-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	xmrig
behavioral2/memory/3864-142-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	xmrig
behavioral2/memory/3076-141-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	xmrig
behavioral2/memory/4472-154-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	xmrig
behavioral2/memory/4644-199-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	xmrig
behavioral2/memory/1372-201-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	xmrig
behavioral2/memory/3552-209-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	xmrig
behavioral2/memory/4684-211-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	xmrig
behavioral2/memory/916-213-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	xmrig
behavioral2/memory/4392-215-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	xmrig
behavioral2/memory/3232-217-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	xmrig
behavioral2/memory/2104-220-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	xmrig
behavioral2/memory/3076-229-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	xmrig
behavioral2/memory/3864-231-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	xmrig
behavioral2/memory/2084-233-0x00007FF77A210000-0x00007FF77A561000-memory.dmp	xmrig
behavioral2/memory/3268-235-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	xmrig
behavioral2/memory/3064-237-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	xmrig
behavioral2/memory/2432-239-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	xmrig
behavioral2/memory/1068-241-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp	xmrig
behavioral2/memory/556-243-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp	xmrig
behavioral2/memory/648-245-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp	xmrig
behavioral2/memory/4412-247-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp	xmrig
behavioral2/memory/432-251-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp	xmrig
behavioral2/memory/4304-253-0x00007FF783B00000-0x00007FF783E51000-memory.dmp	xmrig
behavioral2/memory/1144-249-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4644	LbWZCnO.exe
1372	NxuRpGt.exe
3552	ynkmiRo.exe
4684	MyhnUGy.exe
916	TFeQNat.exe
3232	MuopkIy.exe
4392	gbBSMMt.exe
2104	PCpgUwb.exe
3076	GBLxasQ.exe
3864	gDbWJMY.exe
2084	bYofYfq.exe
3064	qbuBPuI.exe
3268	DcpTTHE.exe
2432	lstnQUc.exe
1068	xXXJtau.exe
556	RzPDVNV.exe
648	jEloGZD.exe
4412	GSsZvpc.exe
1144	uVhKJAK.exe
432	NLwtgLo.exe
4304	sNNySCG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4472-0-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	upx
behavioral2/files/0x000b0000000233fa-5.dat	upx
behavioral2/memory/4644-8-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx
behavioral2/files/0x0008000000023412-11.dat	upx
behavioral2/files/0x0008000000023413-18.dat	upx
behavioral2/memory/1372-16-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	upx
behavioral2/files/0x0007000000023414-23.dat	upx
behavioral2/memory/3552-22-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	upx
behavioral2/memory/4684-26-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	upx
behavioral2/files/0x0007000000023415-30.dat	upx
behavioral2/files/0x0009000000023406-34.dat	upx
behavioral2/files/0x0007000000023417-41.dat	upx
behavioral2/memory/4392-44-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	upx
behavioral2/memory/3232-37-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	upx
behavioral2/memory/916-35-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	upx
behavioral2/files/0x0007000000023418-47.dat	upx
behavioral2/memory/2104-50-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx
behavioral2/files/0x0007000000023419-53.dat	upx
behavioral2/files/0x000700000002341a-59.dat	upx
behavioral2/files/0x000700000002341b-62.dat	upx
behavioral2/files/0x000700000002341c-71.dat	upx
behavioral2/memory/4472-68-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	upx
behavioral2/memory/1372-74-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	upx
behavioral2/files/0x000700000002341d-78.dat	upx
behavioral2/files/0x000700000002341e-84.dat	upx
behavioral2/memory/2432-88-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	upx
behavioral2/memory/3552-87-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	upx
behavioral2/files/0x000700000002341f-93.dat	upx
behavioral2/files/0x0007000000023422-108.dat	upx
behavioral2/files/0x0007000000023423-111.dat	upx
behavioral2/files/0x0007000000023424-116.dat	upx
behavioral2/files/0x0007000000023425-123.dat	upx
behavioral2/files/0x0007000000023421-106.dat	upx
behavioral2/files/0x0007000000023420-102.dat	upx
behavioral2/memory/3268-83-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	upx
behavioral2/memory/3064-75-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	upx
behavioral2/memory/4644-73-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx
behavioral2/memory/2084-72-0x00007FF77A210000-0x00007FF77A561000-memory.dmp	upx
behavioral2/memory/3864-61-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	upx
behavioral2/memory/3076-54-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	upx
behavioral2/memory/4472-125-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	upx
behavioral2/memory/3232-131-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	upx
behavioral2/memory/2104-133-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx
behavioral2/memory/648-136-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp	upx
behavioral2/memory/1144-138-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp	upx
behavioral2/memory/4412-137-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp	upx
behavioral2/memory/556-135-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp	upx
behavioral2/memory/1068-134-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp	upx
behavioral2/memory/432-139-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp	upx
behavioral2/memory/4304-140-0x00007FF783B00000-0x00007FF783E51000-memory.dmp	upx
behavioral2/memory/3064-144-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp	upx
behavioral2/memory/2432-146-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp	upx
behavioral2/memory/3268-145-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp	upx
behavioral2/memory/3864-142-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp	upx
behavioral2/memory/3076-141-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp	upx
behavioral2/memory/4472-154-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp	upx
behavioral2/memory/4644-199-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx
behavioral2/memory/1372-201-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp	upx
behavioral2/memory/3552-209-0x00007FF613470000-0x00007FF6137C1000-memory.dmp	upx
behavioral2/memory/4684-211-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp	upx
behavioral2/memory/916-213-0x00007FF69C310000-0x00007FF69C661000-memory.dmp	upx
behavioral2/memory/4392-215-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp	upx
behavioral2/memory/3232-217-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp	upx
behavioral2/memory/2104-220-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\bYofYfq.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qbuBPuI.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uVhKJAK.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NxuRpGt.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gbBSMMt.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gDbWJMY.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xXXJtau.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jEloGZD.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TFeQNat.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ynkmiRo.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MyhnUGy.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lstnQUc.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RzPDVNV.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sNNySCG.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LbWZCnO.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PCpgUwb.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GBLxasQ.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DcpTTHE.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GSsZvpc.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NLwtgLo.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MuopkIy.exe	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4644	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	84
PID 4472 wrote to memory of 4644	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	84
PID 4472 wrote to memory of 1372	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	85
PID 4472 wrote to memory of 1372	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	85
PID 4472 wrote to memory of 3552	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	86
PID 4472 wrote to memory of 3552	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	86
PID 4472 wrote to memory of 4684	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	87
PID 4472 wrote to memory of 4684	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	87
PID 4472 wrote to memory of 916	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	88
PID 4472 wrote to memory of 916	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	88
PID 4472 wrote to memory of 3232	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	89
PID 4472 wrote to memory of 3232	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	89
PID 4472 wrote to memory of 4392	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	90
PID 4472 wrote to memory of 4392	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	90
PID 4472 wrote to memory of 2104	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	91
PID 4472 wrote to memory of 2104	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	91
PID 4472 wrote to memory of 3076	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	92
PID 4472 wrote to memory of 3076	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	92
PID 4472 wrote to memory of 3864	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	93
PID 4472 wrote to memory of 3864	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	93
PID 4472 wrote to memory of 2084	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	94
PID 4472 wrote to memory of 2084	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	94
PID 4472 wrote to memory of 3064	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	95
PID 4472 wrote to memory of 3064	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	95
PID 4472 wrote to memory of 3268	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	96
PID 4472 wrote to memory of 3268	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	96
PID 4472 wrote to memory of 2432	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	98
PID 4472 wrote to memory of 2432	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	98
PID 4472 wrote to memory of 1068	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	99
PID 4472 wrote to memory of 1068	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	99
PID 4472 wrote to memory of 556	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	102
PID 4472 wrote to memory of 556	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	102
PID 4472 wrote to memory of 648	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	103
PID 4472 wrote to memory of 648	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	103
PID 4472 wrote to memory of 4412	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	104
PID 4472 wrote to memory of 4412	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	104
PID 4472 wrote to memory of 1144	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	105
PID 4472 wrote to memory of 1144	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	105
PID 4472 wrote to memory of 432	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	106
PID 4472 wrote to memory of 432	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	106
PID 4472 wrote to memory of 4304	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	107
PID 4472 wrote to memory of 4304	4472	2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_8021f004ae65fdf99b00057c44b047ca_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System\LbWZCnO.exe
  C:\Windows\System\LbWZCnO.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\NxuRpGt.exe
  C:\Windows\System\NxuRpGt.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ynkmiRo.exe
  C:\Windows\System\ynkmiRo.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\MyhnUGy.exe
  C:\Windows\System\MyhnUGy.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\TFeQNat.exe
  C:\Windows\System\TFeQNat.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\MuopkIy.exe
  C:\Windows\System\MuopkIy.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\gbBSMMt.exe
  C:\Windows\System\gbBSMMt.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\PCpgUwb.exe
  C:\Windows\System\PCpgUwb.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\GBLxasQ.exe
  C:\Windows\System\GBLxasQ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\gDbWJMY.exe
  C:\Windows\System\gDbWJMY.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\bYofYfq.exe
  C:\Windows\System\bYofYfq.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\qbuBPuI.exe
  C:\Windows\System\qbuBPuI.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\DcpTTHE.exe
  C:\Windows\System\DcpTTHE.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\lstnQUc.exe
  C:\Windows\System\lstnQUc.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\xXXJtau.exe
  C:\Windows\System\xXXJtau.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\RzPDVNV.exe
  C:\Windows\System\RzPDVNV.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\jEloGZD.exe
  C:\Windows\System\jEloGZD.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\GSsZvpc.exe
  C:\Windows\System\GSsZvpc.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\uVhKJAK.exe
  C:\Windows\System\uVhKJAK.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\NLwtgLo.exe
  C:\Windows\System\NLwtgLo.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\sNNySCG.exe
  C:\Windows\System\sNNySCG.exe
  2⤵
  - Executes dropped EXE
  PID:4304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DcpTTHE.exe

Path C:\Windows\System\DcpTTHE.exe
Size 5.2MB
SHA256 5b410413f179ef86a5036d98868f482b472b14905decffd89e7f8f50a9881f03
MD5 006969b961167138baacae0780c4732f
SHA1 f32657514f1838c26e21dfdd37791e33fb21bf90
SHA512 56fd8ac1aa8b8e945ef2ce5e9d0e022a87f48362269e0601a4e22a0a24d593a9ae35302e5c6bd4438963115c3e177a5f4beb38c3310f6fcbe933783962bb788b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBLxasQ.exe

Path C:\Windows\System\GBLxasQ.exe
Size 5.2MB
SHA256 06e8d7ee1d5526e65107de416f62f7b3d1b9b950c93a27983c300a79d3c733e2
MD5 c6bc51be64e538816ee38aa6021043e1
SHA1 07390decafca18dfcd0e5d1b450f5948e9520a74
SHA512 83271a07735fcb1142959a7612358fcc199f8af3a1991d361dabe65a10ec0d47e27f43ff1a01978e100dfc420b0dbc10e40b2d923aeb6842f0e49408812e9868
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GSsZvpc.exe

Path C:\Windows\System\GSsZvpc.exe
Size 5.2MB
SHA256 3b833a8fef0c72a14545a6852d056b929b48fd5871ec1bfd47c47547cff3c4cb
MD5 0da863bb737e37404f91b79e160c3b2a
SHA1 2a49013d35ddac5ebbf8d37179374f5b67f63d6f
SHA512 d2764b2ec5f4168a4763c16be4eb5b89e3268ee9786dc3f56487e5bd01e0748c82848ed170b6a12df0933a28215af7bd1a707e8f97af8deddd135dae6f591fa0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

LbWZCnO.exe

Path C:\Windows\System\LbWZCnO.exe
Size 5.2MB
SHA256 2f81a331288ba2a3ab9599d5eb1a058a947ac8f13a35bda8ff75ce6e22bd2ef0
MD5 58efd6ad159242a9036914dbf11dafb4
SHA1 2cc70e617d62f5f07dce812402ce1c6f70cbe607
SHA512 a11dd8d1c5c201c75475315e6a37a38b02dfd550ea44a898fb04effab81a50eadf3861690cba4fb68f85fa6e2b7efbefa7f9e786361bb0396f0010aa9646317d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MuopkIy.exe

Path C:\Windows\System\MuopkIy.exe
Size 5.2MB
SHA256 31bd63d30e4d7fea346d7e30c0372baf8edb48c51c119a21b6b763826887a0d8
MD5 3c64f2d0c407570bea687edca40c3684
SHA1 25b4adecb1be7bdc519c924331c03485740549ab
SHA512 687115d1f62c835ae533ba992fc0485d84ffbd0bcb6a1b69d9ebfe6b432a7151b1381e0a1c596c27b6e27c3ee276a3203f3b7693f6eb287e8e94cc87cedbb324
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyhnUGy.exe

Path C:\Windows\System\MyhnUGy.exe
Size 5.2MB
SHA256 a63944753acfad751243d68dc97487de105406d8edc9b351f1d3dac0203f6955
MD5 477a20639e856beb1ec65f2fa3b8fdf5
SHA1 6b42433a3815c9347fbb19ccb4fc2e98d4eb7121
SHA512 257367c1253b79366ee99f21249c44a5f1a7b128f61d88c4f05c4db190a20229ffe2d53df4234267255bf3c48e1fb0556ef787e9bf77af8ca812684abf62f802
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lU2
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLwtgLo.exe

Path C:\Windows\System\NLwtgLo.exe
Size 5.2MB
SHA256 ed846f9e8ad71576c1a92fef6dba68b7fd07f3b1f63c0ab7e0e14477cdd7c70b
MD5 47b6e261a8b0fbfc6835347187998f05
SHA1 aa04c28e55a1ba830c52212eecc589328d9073f8
SHA512 e4e9c52009b8ed2dc69147707203df3e0d4cc9902d8c1b6c5f2db9c942eb2642ed6eeaac9859d13977e90ce8b1b8bb01d18fdd13e46a57be415eccf85a683c97
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NxuRpGt.exe

Path C:\Windows\System\NxuRpGt.exe
Size 5.2MB
SHA256 da770e8605ed0aa4dd7180b3fcaf9973b98accf248a243558da07d793411d0f1
MD5 201d8af2e2135b3b8949c2f368916fca
SHA1 e0b564c71ea3fe3d76d9053bcdf7b6d6573cbc72
SHA512 1f7d449aed2675033319ad6a7184fd08b5ef10bdb062316975b10fd207b2d622b845e811566c7621d750b7cdb8cb5cee42cad3ddb49f3f43e88f505abdaa0805
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCpgUwb.exe

Path C:\Windows\System\PCpgUwb.exe
Size 5.2MB
SHA256 32392cf27968502f31c5865da078f32a0dc2e1ae9fedabc35f0be73eeff3bd55
MD5 ab55e165381302c2c1f5b298303a80d6
SHA1 df8ebf42f4fe822d7b76726a2f61e0ad90b27efe
SHA512 cdd77fe6a1bac7b20f8502a022364d9a86672ccde9ee64ac5adc3981b128f271988b3bd65d2939e3cbd7f30359c4b0387d3e7d45d4f5c843b9fc51a8b89d8a4a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

RzPDVNV.exe

Path C:\Windows\System\RzPDVNV.exe
Size 5.2MB
SHA256 597b07b0f31ba1fc5bd3b8be7f6bdc74444cbd5ab0f58274b2b0280ea75df6f1
MD5 535b6ae8c875b84619f3dab5f96d9a92
SHA1 c669265ca87620e98ebccade03024d0fac50aeca
SHA512 8b0a32e4a75aec4e77bb4ec1990f30f0784c32b4d0c6df7dfa3c43e7f90d11a251ce814738b6de9684b68fdbf060dedb14745dc5fc7a86727bec333f675f9f89
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TFeQNat.exe

Path C:\Windows\System\TFeQNat.exe
Size 5.2MB
SHA256 5a4c810015f6155cec88acc5823ba350c445df2ec404aaa55b616fb865297e29
MD5 499d096799f6c0d28564b6271733e3f5
SHA1 bb2c0dd231d5ef6678885dab596b379d6c4140c3
SHA512 fb3ee407a1ad603061c2780c62fc36789aebbaae7539b2c1d9edb0e3bfd1d1b9cd0d83d662c716d9f50748b240499731edfb8c14bf03270b32e020407d5b09fa
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

bYofYfq.exe

Path C:\Windows\System\bYofYfq.exe
Size 5.2MB
SHA256 2644969175ed305d4498714231fce03d8ef204cf970fe2192ecafd7ed74da6b5
MD5 6a6692dcc256f934f062b632c85a4cbb
SHA1 8b99467fdeab69722ecd5eb3f50a7da029787632
SHA512 4eda5beee8f5d961bbb862638e9bcf95da7ff0b75d5d048db82addba9c8df2aef128a46e216e7f36cc8f904cccf83c982cf9330da98840b1941698f214614235
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDbWJMY.exe

Path C:\Windows\System\gDbWJMY.exe
Size 5.2MB
SHA256 ee701b25f2485328b9ef686926fcddbadff573615114efffd1168ecc869fd04f
MD5 c97eae990e928e512db32c9e6a41c9f8
SHA1 cf63a8a6c1919280606ccde68ff4e5f5fa44c3da
SHA512 741e921dae94159c5f8a51cc51239c054376de482db59ec27b1a22858de12e8ea2bfcfe3d4163da5b7e7ba5410ca71d8a85887eb68c4b8bf93fe37c6ef5675b3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbBSMMt.exe

Path C:\Windows\System\gbBSMMt.exe
Size 5.2MB
SHA256 9f91a2e36312b03b45f8e9282d1ee403d9ecf443fd2a1204df40b47660ed61fb
MD5 8dd24e745562da84ad590c17ca39060f
SHA1 de7edba68d9cb7c6bbb04c042050b890b02a6605
SHA512 f582c1d15d7e09fe0e6124ce0840c96e91308826098bdb97b19c958e448ba15162d2ac323b9dee1b5c1110deec3026115d9188de7727d6a3d1a1b1b734d51d3c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

jEloGZD.exe

Path C:\Windows\System\jEloGZD.exe
Size 5.2MB
SHA256 6731f8e394d8de7001ac4307a6e426362a4a8ce51bb4467339b894a091af689d
MD5 24046fa3344f057aa774a119a28f8aa4
SHA1 4009e383d2ffe31de09a27db616f438b1a342c3c
SHA512 f0b20efae1f42e17a6d7119f072cb6da5ee91e7b9c50f8cc394e625dbdb6aa0b676373d9300b1c04aa10551ce253ffb6fee16d2b763b7c17d4ffc0ee991ed2de
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lstnQUc.exe

Path C:\Windows\System\lstnQUc.exe
Size 5.2MB
SHA256 ab3c6ad45f2a9a3e3cda4687e2f04e18636bf37d3910d151f9645e98c317ac96
MD5 faed98546886f552c27f2c63e34c3b2b
SHA1 428a9a60937f7b2eab0277b167f9bc3f1ae39780
SHA512 0cbcb5e1fcedfa3681dee4fe5124cf52ce3953b462cbeb5510b64668688f1345a1c304d214598d0bc170e826ee632da7944400888240a276f26079416657b0a0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qbuBPuI.exe

Path C:\Windows\System\qbuBPuI.exe
Size 5.2MB
SHA256 d002fa32d3d7a1a3d03d6d89ddcdc443fd9b65b30ded5648dd395a40b6f3897d
MD5 483cb1ac1714292441ecbdfadd925af9
SHA1 e15274c6f1b131284e8ff1026c99804d21dc6cc8
SHA512 af59bd52fda2c6991cb07cc48e8c3e2f6090ea72de47065aa2dd946b23fa6c087169b3ceb5f6d00c09ab6b409dea59bda830ee8f1b23ab8ff0f4561e30d13732
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

sNNySCG.exe

Path C:\Windows\System\sNNySCG.exe
Size 5.2MB
SHA256 2756bee73ce8bdb6d4ad8baa95ca5ea77630a2392ef8b16fe361891a89d1128a
MD5 c588033ebd62900a3c3a53775eb06ea0
SHA1 14274d6f1b8771889f5ea20b73772397941d40b8
SHA512 9ac8c1a3cd7c7de4869daf58df1cd47c4f6b100c69e1d014304dba6b69dd7ac48ea5e8921d0370239a0a6d9c38fa6faf1a5a57fe8415b520f037afc60fa2bb85
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

uVhKJAK.exe

Path C:\Windows\System\uVhKJAK.exe
Size 5.2MB
SHA256 1765053da31b589a49cb2bb193686314086e7cd6435604439f6ee40e4a4d4320
MD5 32ba05e3db948149cbbe3c96a6f1254f
SHA1 847589d7d3cb3c4e0c08b31102b9f198e1e898ef
SHA512 4df8b579ea4c57c3b64e7a39a1b130e23c6d34930ed39cc2f0b6342a8e7fa41fb346b5958496ce7f9cfd854ad18029c1a9daaa3af1558dfe3653bee535df831a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

xXXJtau.exe

Path C:\Windows\System\xXXJtau.exe
Size 5.2MB
SHA256 8a8db107ea5c9c988008f72c3051e61c51058d0b68e8202977740ad9e358f807
MD5 9aa60f6af405bc888fff2497926abd2f
SHA1 62732f7618443f536b13b3ff902330f33daafe89
SHA512 859c8e992c26616121bff4aa76b3ec060bbf68caeb31916e03ca96ccb3ab332e69b5d33a714e8af8bf0235d3843a724a4b59005f17370828d64730fbfe77084e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ynkmiRo.exe

Path C:\Windows\System\ynkmiRo.exe
Size 5.2MB
SHA256 5abb4c3c9bf41305ccc839c8237cd468984ffd3fe9da06b3def16231896f70a2
MD5 1e2d88cadbd8f1776922c159dc2428a2
SHA1 c243df864fece10ee12d1869b35a8ff77a94e365
SHA512 66b37760cca46bf82fb5f8921e19123aa9eca9f65b7e344aaed31fb4a87648b63f01ff262529a6fb73ae21b6b2801c5e7f5380f662184ae490ddf1d0b2f3112c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-251-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp

Download

memory/432-139-0x00007FF7A1780000-0x00007FF7A1AD1000-memory.dmp

Download

memory/556-135-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp

Download

memory/556-243-0x00007FF7F8A70000-0x00007FF7F8DC1000-memory.dmp

Download

memory/648-136-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp

Download

memory/648-245-0x00007FF6B6620000-0x00007FF6B6971000-memory.dmp

Download

memory/916-35-0x00007FF69C310000-0x00007FF69C661000-memory.dmp

Download

memory/916-213-0x00007FF69C310000-0x00007FF69C661000-memory.dmp

Download

memory/1068-241-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp

Download

memory/1068-134-0x00007FF7BF3A0000-0x00007FF7BF6F1000-memory.dmp

Download

memory/1144-138-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp

Download

memory/1144-249-0x00007FF77E680000-0x00007FF77E9D1000-memory.dmp

Download

memory/1372-74-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp

Download

memory/1372-201-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp

Download

memory/1372-16-0x00007FF7C67B0000-0x00007FF7C6B01000-memory.dmp

Download

memory/2084-72-0x00007FF77A210000-0x00007FF77A561000-memory.dmp

Download

memory/2084-233-0x00007FF77A210000-0x00007FF77A561000-memory.dmp

Download

memory/2104-133-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/2104-220-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/2104-50-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/2432-146-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp

Download

memory/2432-239-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp

Download

memory/2432-88-0x00007FF723BA0000-0x00007FF723EF1000-memory.dmp

Download

memory/3064-237-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp

Download

memory/3064-144-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp

Download

memory/3064-75-0x00007FF6BCF30000-0x00007FF6BD281000-memory.dmp

Download

memory/3076-54-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp

Download

memory/3076-229-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp

Download

memory/3076-141-0x00007FF7849E0000-0x00007FF784D31000-memory.dmp

Download

memory/3232-131-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp

Download

memory/3232-217-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp

Download

memory/3232-37-0x00007FF68CDD0000-0x00007FF68D121000-memory.dmp

Download

memory/3268-145-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp

Download

memory/3268-235-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp

Download

memory/3268-83-0x00007FF6CFAA0000-0x00007FF6CFDF1000-memory.dmp

Download

memory/3552-22-0x00007FF613470000-0x00007FF6137C1000-memory.dmp

Download

memory/3552-87-0x00007FF613470000-0x00007FF6137C1000-memory.dmp

Download

memory/3552-209-0x00007FF613470000-0x00007FF6137C1000-memory.dmp

Download

memory/3864-61-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp

Download

memory/3864-142-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp

Download

memory/3864-231-0x00007FF708E90000-0x00007FF7091E1000-memory.dmp

Download

memory/4304-253-0x00007FF783B00000-0x00007FF783E51000-memory.dmp

Download

memory/4304-140-0x00007FF783B00000-0x00007FF783E51000-memory.dmp

Download

memory/4392-44-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp

Download

memory/4392-215-0x00007FF75BED0000-0x00007FF75C221000-memory.dmp

Download

memory/4412-247-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp

Download

memory/4412-137-0x00007FF661D90000-0x00007FF6620E1000-memory.dmp

Download

memory/4472-125-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp

Download

memory/4472-0-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp

Download

memory/4472-68-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp

Download

memory/4472-154-0x00007FF74D7A0000-0x00007FF74DAF1000-memory.dmp

Download

memory/4472-1-0x000002D219190000-0x000002D2191A0000-memory.dmp

Download

memory/4644-73-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/4644-8-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/4644-199-0x00007FF6AEEB0000-0x00007FF6AF201000-memory.dmp

Download

memory/4684-211-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp

Download

memory/4684-26-0x00007FF627BB0000-0x00007FF627F01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads