cobaltstrike | 03172a9edb6cf427c41d6ec25763e18b1e47ba06e758cfae030ec9ce73623042

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-mwr4fadb72
SHA256 03172a9edb6cf427c41d6ec25763e18b1e47ba06e758cfae030ec9ce73623042
MD5 5e14e5f50580c5f31a57721608504757
SHA1 12ed9fe3f5f85b674981533c192104aedb340a30
SHA512 1385fb38b682a13eae3ce0c03353948f9e12f7c836d15ed22ce6e98063b12df6b79d4c4ca911108c9091ba46e1f66d6a382cbc6bd000f8d699baf534d6fcb3dc
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUy:Q+u56utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023408-3.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-26.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-49.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-55.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023409-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-66.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000022a94-72.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002335d-76.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002335e-80.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000002335f-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-107.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-128.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-125.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023408-3.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023409-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000022a94-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002335d-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002335e-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000002335f-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2468-0-0x00007FF742620000-0x00007FF742974000-memory.dmp	UPX
behavioral2/files/0x0008000000023408-3.dat	UPX
behavioral2/memory/4032-7-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-10.dat	UPX
behavioral2/files/0x000700000002340d-11.dat	UPX
behavioral2/memory/4168-14-0x00007FF734E10000-0x00007FF735164000-memory.dmp	UPX
behavioral2/memory/5004-20-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-22.dat	UPX
behavioral2/files/0x000700000002340f-26.dat	UPX
behavioral2/memory/1476-31-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-33.dat	UPX
behavioral2/files/0x0007000000023411-45.dat	UPX
behavioral2/files/0x0007000000023412-49.dat	UPX
behavioral2/files/0x0007000000023413-55.dat	UPX
behavioral2/memory/5008-59-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	UPX
behavioral2/memory/4968-62-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	UPX
behavioral2/memory/2056-56-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	UPX
behavioral2/memory/2252-53-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	UPX
behavioral2/files/0x0008000000023409-48.dat	UPX
behavioral2/memory/1760-41-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	UPX
behavioral2/memory/5100-39-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-66.dat	UPX
behavioral2/files/0x000a000000022a94-72.dat	UPX
behavioral2/files/0x000b00000002335d-76.dat	UPX
behavioral2/memory/1732-74-0x00007FF732040000-0x00007FF732394000-memory.dmp	UPX
behavioral2/files/0x000b00000002335e-80.dat	UPX
behavioral2/memory/2468-82-0x00007FF742620000-0x00007FF742974000-memory.dmp	UPX
behavioral2/memory/2588-85-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	UPX
behavioral2/memory/3784-88-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	UPX
behavioral2/memory/4032-93-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	UPX
behavioral2/memory/2196-94-0x00007FF7A9930000-0x00007FF7A9C84000-memory.dmp	UPX
behavioral2/files/0x000c00000002335f-89.dat	UPX
behavioral2/memory/4404-68-0x00007FF608F00000-0x00007FF609254000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-98.dat	UPX
behavioral2/memory/1476-102-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	UPX
behavioral2/memory/1248-104-0x00007FF62C240000-0x00007FF62C594000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-111.dat	UPX
behavioral2/files/0x0007000000023419-117.dat	UPX
behavioral2/memory/4072-115-0x00007FF7FF100000-0x00007FF7FF454000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-107.dat	UPX
behavioral2/memory/1748-105-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	UPX
behavioral2/memory/2056-122-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-128.dat	UPX
behavioral2/memory/404-131-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	UPX
behavioral2/memory/1728-132-0x00007FF611F70000-0x00007FF6122C4000-memory.dmp	UPX
behavioral2/memory/5008-127-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-125.dat	UPX
behavioral2/memory/2404-124-0x00007FF668930000-0x00007FF668C84000-memory.dmp	UPX
behavioral2/memory/3784-133-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	UPX
behavioral2/memory/1748-134-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	UPX
behavioral2/memory/404-135-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	UPX
behavioral2/memory/4032-136-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	UPX
behavioral2/memory/4168-137-0x00007FF734E10000-0x00007FF735164000-memory.dmp	UPX
behavioral2/memory/5004-138-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	UPX
behavioral2/memory/1476-139-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	UPX
behavioral2/memory/5100-140-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	UPX
behavioral2/memory/1760-141-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	UPX
behavioral2/memory/2252-142-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	UPX
behavioral2/memory/2056-143-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	UPX
behavioral2/memory/5008-144-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	UPX
behavioral2/memory/4968-145-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	UPX
behavioral2/memory/4404-146-0x00007FF608F00000-0x00007FF609254000-memory.dmp	UPX
behavioral2/memory/1732-147-0x00007FF732040000-0x00007FF732394000-memory.dmp	UPX
behavioral2/memory/2588-148-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2468-0-0x00007FF742620000-0x00007FF742974000-memory.dmp	xmrig
behavioral2/files/0x0008000000023408-3.dat	xmrig
behavioral2/memory/4032-7-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-10.dat	xmrig
behavioral2/files/0x000700000002340d-11.dat	xmrig
behavioral2/memory/4168-14-0x00007FF734E10000-0x00007FF735164000-memory.dmp	xmrig
behavioral2/memory/5004-20-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-22.dat	xmrig
behavioral2/files/0x000700000002340f-26.dat	xmrig
behavioral2/memory/1476-31-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-33.dat	xmrig
behavioral2/files/0x0007000000023411-45.dat	xmrig
behavioral2/files/0x0007000000023412-49.dat	xmrig
behavioral2/files/0x0007000000023413-55.dat	xmrig
behavioral2/memory/5008-59-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	xmrig
behavioral2/memory/4968-62-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	xmrig
behavioral2/memory/2056-56-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	xmrig
behavioral2/memory/2252-53-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023409-48.dat	xmrig
behavioral2/memory/1760-41-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	xmrig
behavioral2/memory/5100-39-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-66.dat	xmrig
behavioral2/files/0x000a000000022a94-72.dat	xmrig
behavioral2/files/0x000b00000002335d-76.dat	xmrig
behavioral2/memory/1732-74-0x00007FF732040000-0x00007FF732394000-memory.dmp	xmrig
behavioral2/files/0x000b00000002335e-80.dat	xmrig
behavioral2/memory/2468-82-0x00007FF742620000-0x00007FF742974000-memory.dmp	xmrig
behavioral2/memory/2588-85-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	xmrig
behavioral2/memory/3784-88-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	xmrig
behavioral2/memory/4032-93-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	xmrig
behavioral2/memory/2196-94-0x00007FF7A9930000-0x00007FF7A9C84000-memory.dmp	xmrig
behavioral2/files/0x000c00000002335f-89.dat	xmrig
behavioral2/memory/4404-68-0x00007FF608F00000-0x00007FF609254000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-98.dat	xmrig
behavioral2/memory/1476-102-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	xmrig
behavioral2/memory/1248-104-0x00007FF62C240000-0x00007FF62C594000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-111.dat	xmrig
behavioral2/files/0x0007000000023419-117.dat	xmrig
behavioral2/memory/4072-115-0x00007FF7FF100000-0x00007FF7FF454000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-107.dat	xmrig
behavioral2/memory/1748-105-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	xmrig
behavioral2/memory/2056-122-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-128.dat	xmrig
behavioral2/memory/404-131-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	xmrig
behavioral2/memory/1728-132-0x00007FF611F70000-0x00007FF6122C4000-memory.dmp	xmrig
behavioral2/memory/5008-127-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-125.dat	xmrig
behavioral2/memory/2404-124-0x00007FF668930000-0x00007FF668C84000-memory.dmp	xmrig
behavioral2/memory/3784-133-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	xmrig
behavioral2/memory/1748-134-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	xmrig
behavioral2/memory/404-135-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	xmrig
behavioral2/memory/4032-136-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	xmrig
behavioral2/memory/4168-137-0x00007FF734E10000-0x00007FF735164000-memory.dmp	xmrig
behavioral2/memory/5004-138-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	xmrig
behavioral2/memory/1476-139-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	xmrig
behavioral2/memory/5100-140-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	xmrig
behavioral2/memory/1760-141-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	xmrig
behavioral2/memory/2252-142-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	xmrig
behavioral2/memory/2056-143-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	xmrig
behavioral2/memory/5008-144-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	xmrig
behavioral2/memory/4968-145-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	xmrig
behavioral2/memory/4404-146-0x00007FF608F00000-0x00007FF609254000-memory.dmp	xmrig
behavioral2/memory/1732-147-0x00007FF732040000-0x00007FF732394000-memory.dmp	xmrig
behavioral2/memory/2588-148-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4032	VYuMXYa.exe
4168	ODkKVLe.exe
5004	ADnEQHT.exe
1476	BssYjKf.exe
5100	GUHGFGK.exe
1760	UMcSZaK.exe
2252	wNdKeyF.exe
2056	tGcKVDm.exe
5008	EKGJygQ.exe
4968	xXQlypE.exe
4404	zmOwPtL.exe
1732	ylJvDpe.exe
2588	pPuOLDV.exe
3784	bJOCxWB.exe
2196	iiVZtyP.exe
1248	hROELyG.exe
1748	rIxeDRj.exe
4072	bqHVxNM.exe
2404	eXAAFvl.exe
404	CMxxCsK.exe
1728	kvvfQHB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2468-0-0x00007FF742620000-0x00007FF742974000-memory.dmp	upx
behavioral2/files/0x0008000000023408-3.dat	upx
behavioral2/memory/4032-7-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	upx
behavioral2/files/0x000700000002340c-10.dat	upx
behavioral2/files/0x000700000002340d-11.dat	upx
behavioral2/memory/4168-14-0x00007FF734E10000-0x00007FF735164000-memory.dmp	upx
behavioral2/memory/5004-20-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	upx
behavioral2/files/0x000700000002340e-22.dat	upx
behavioral2/files/0x000700000002340f-26.dat	upx
behavioral2/memory/1476-31-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	upx
behavioral2/files/0x0007000000023410-33.dat	upx
behavioral2/files/0x0007000000023411-45.dat	upx
behavioral2/files/0x0007000000023412-49.dat	upx
behavioral2/files/0x0007000000023413-55.dat	upx
behavioral2/memory/5008-59-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	upx
behavioral2/memory/4968-62-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	upx
behavioral2/memory/2056-56-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	upx
behavioral2/memory/2252-53-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	upx
behavioral2/files/0x0008000000023409-48.dat	upx
behavioral2/memory/1760-41-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	upx
behavioral2/memory/5100-39-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	upx
behavioral2/files/0x0007000000023414-66.dat	upx
behavioral2/files/0x000a000000022a94-72.dat	upx
behavioral2/files/0x000b00000002335d-76.dat	upx
behavioral2/memory/1732-74-0x00007FF732040000-0x00007FF732394000-memory.dmp	upx
behavioral2/files/0x000b00000002335e-80.dat	upx
behavioral2/memory/2468-82-0x00007FF742620000-0x00007FF742974000-memory.dmp	upx
behavioral2/memory/2588-85-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	upx
behavioral2/memory/3784-88-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	upx
behavioral2/memory/4032-93-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	upx
behavioral2/memory/2196-94-0x00007FF7A9930000-0x00007FF7A9C84000-memory.dmp	upx
behavioral2/files/0x000c00000002335f-89.dat	upx
behavioral2/memory/4404-68-0x00007FF608F00000-0x00007FF609254000-memory.dmp	upx
behavioral2/files/0x0007000000023416-98.dat	upx
behavioral2/memory/1476-102-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	upx
behavioral2/memory/1248-104-0x00007FF62C240000-0x00007FF62C594000-memory.dmp	upx
behavioral2/files/0x0007000000023418-111.dat	upx
behavioral2/files/0x0007000000023419-117.dat	upx
behavioral2/memory/4072-115-0x00007FF7FF100000-0x00007FF7FF454000-memory.dmp	upx
behavioral2/files/0x0007000000023417-107.dat	upx
behavioral2/memory/1748-105-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	upx
behavioral2/memory/2056-122-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	upx
behavioral2/files/0x000700000002341b-128.dat	upx
behavioral2/memory/404-131-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	upx
behavioral2/memory/1728-132-0x00007FF611F70000-0x00007FF6122C4000-memory.dmp	upx
behavioral2/memory/5008-127-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	upx
behavioral2/files/0x000700000002341a-125.dat	upx
behavioral2/memory/2404-124-0x00007FF668930000-0x00007FF668C84000-memory.dmp	upx
behavioral2/memory/3784-133-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp	upx
behavioral2/memory/1748-134-0x00007FF7122E0000-0x00007FF712634000-memory.dmp	upx
behavioral2/memory/404-135-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp	upx
behavioral2/memory/4032-136-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp	upx
behavioral2/memory/4168-137-0x00007FF734E10000-0x00007FF735164000-memory.dmp	upx
behavioral2/memory/5004-138-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp	upx
behavioral2/memory/1476-139-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	upx
behavioral2/memory/5100-140-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp	upx
behavioral2/memory/1760-141-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp	upx
behavioral2/memory/2252-142-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp	upx
behavioral2/memory/2056-143-0x00007FF7602B0000-0x00007FF760604000-memory.dmp	upx
behavioral2/memory/5008-144-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp	upx
behavioral2/memory/4968-145-0x00007FF6024F0000-0x00007FF602844000-memory.dmp	upx
behavioral2/memory/4404-146-0x00007FF608F00000-0x00007FF609254000-memory.dmp	upx
behavioral2/memory/1732-147-0x00007FF732040000-0x00007FF732394000-memory.dmp	upx
behavioral2/memory/2588-148-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ADnEQHT.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EKGJygQ.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ylJvDpe.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iiVZtyP.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hROELyG.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eXAAFvl.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CMxxCsK.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xXQlypE.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bJOCxWB.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rIxeDRj.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bqHVxNM.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VYuMXYa.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ODkKVLe.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wNdKeyF.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zmOwPtL.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pPuOLDV.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BssYjKf.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GUHGFGK.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UMcSZaK.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tGcKVDm.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kvvfQHB.exe	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4032	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	85
PID 2468 wrote to memory of 4032	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	85
PID 2468 wrote to memory of 4168	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	86
PID 2468 wrote to memory of 4168	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	86
PID 2468 wrote to memory of 5004	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	87
PID 2468 wrote to memory of 5004	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	87
PID 2468 wrote to memory of 1476	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	89
PID 2468 wrote to memory of 1476	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	89
PID 2468 wrote to memory of 5100	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	90
PID 2468 wrote to memory of 5100	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	90
PID 2468 wrote to memory of 1760	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	91
PID 2468 wrote to memory of 1760	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	91
PID 2468 wrote to memory of 2252	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	92
PID 2468 wrote to memory of 2252	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	92
PID 2468 wrote to memory of 2056	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	93
PID 2468 wrote to memory of 2056	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	93
PID 2468 wrote to memory of 5008	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	94
PID 2468 wrote to memory of 5008	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	94
PID 2468 wrote to memory of 4968	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	95
PID 2468 wrote to memory of 4968	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	95
PID 2468 wrote to memory of 4404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	96
PID 2468 wrote to memory of 4404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	96
PID 2468 wrote to memory of 1732	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	99
PID 2468 wrote to memory of 1732	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	99
PID 2468 wrote to memory of 2588	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	100
PID 2468 wrote to memory of 2588	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	100
PID 2468 wrote to memory of 3784	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	101
PID 2468 wrote to memory of 3784	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	101
PID 2468 wrote to memory of 2196	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	102
PID 2468 wrote to memory of 2196	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	102
PID 2468 wrote to memory of 1248	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	103
PID 2468 wrote to memory of 1248	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	103
PID 2468 wrote to memory of 1748	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	106
PID 2468 wrote to memory of 1748	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	106
PID 2468 wrote to memory of 4072	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	107
PID 2468 wrote to memory of 4072	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	107
PID 2468 wrote to memory of 2404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	108
PID 2468 wrote to memory of 2404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	108
PID 2468 wrote to memory of 404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	109
PID 2468 wrote to memory of 404	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	109
PID 2468 wrote to memory of 1728	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	110
PID 2468 wrote to memory of 1728	2468	2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_5e14e5f50580c5f31a57721608504757_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System\VYuMXYa.exe
  C:\Windows\System\VYuMXYa.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\ODkKVLe.exe
  C:\Windows\System\ODkKVLe.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\ADnEQHT.exe
  C:\Windows\System\ADnEQHT.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\BssYjKf.exe
  C:\Windows\System\BssYjKf.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\GUHGFGK.exe
  C:\Windows\System\GUHGFGK.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\UMcSZaK.exe
  C:\Windows\System\UMcSZaK.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\wNdKeyF.exe
  C:\Windows\System\wNdKeyF.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\tGcKVDm.exe
  C:\Windows\System\tGcKVDm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\EKGJygQ.exe
  C:\Windows\System\EKGJygQ.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\xXQlypE.exe
  C:\Windows\System\xXQlypE.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\zmOwPtL.exe
  C:\Windows\System\zmOwPtL.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\ylJvDpe.exe
  C:\Windows\System\ylJvDpe.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\pPuOLDV.exe
  C:\Windows\System\pPuOLDV.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bJOCxWB.exe
  C:\Windows\System\bJOCxWB.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\iiVZtyP.exe
  C:\Windows\System\iiVZtyP.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\hROELyG.exe
  C:\Windows\System\hROELyG.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\rIxeDRj.exe
  C:\Windows\System\rIxeDRj.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\bqHVxNM.exe
  C:\Windows\System\bqHVxNM.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\eXAAFvl.exe
  C:\Windows\System\eXAAFvl.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\CMxxCsK.exe
  C:\Windows\System\CMxxCsK.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\kvvfQHB.exe
  C:\Windows\System\kvvfQHB.exe
  2⤵
  - Executes dropped EXE
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ADnEQHT.exe

Path C:\Windows\System\ADnEQHT.exe
Size 5.9MB
SHA256 71f037e45055af3190530c37fe1d13b3bc858126eadef60a10abe65411e506ce
MD5 8e739c6de9a7829358a811726b5b7407
SHA1 5b66f855388abfee79142a4953989dcdf4974467
SHA512 efe8314ef459e8b7d46ada7f4e20cd0f22144e335e2e8ddb3e8a994ae27758ce345071ff275fad7aeab33bc40ecd401e11dea38d05ece78a56f021481251504f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUX:Q+u56utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

BssYjKf.exe

Path C:\Windows\System\BssYjKf.exe
Size 5.9MB
SHA256 e55d25c14fe8f3255f9205e023b1a3ea1001a85916cf8fde07d607beb280eaf9
MD5 80c79cdcd8b9ad3237ab9a8669b50f1f
SHA1 2eee3d14e799d9a9b24c8d9c438e945385fa67c5
SHA512 f7ec2dafec7590cc85821772ce2ec35a00a9767cd64df6a7bba1c590152c89b14d2d86189f8ae963201a9b61adf44462c78e63bd0241bf3d92ae10702811c0c2
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUD:Q+u56utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

CMxxCsK.exe

Path C:\Windows\System\CMxxCsK.exe
Size 5.9MB
SHA256 66b2eecc437f80413b6aacedfb88710db6cacf88e0519af0d0f7587655ad0e7b
MD5 357513b2d07e32eccf523d837a96a31d
SHA1 2fd00c17c3f8718234e5979e78213fe2c210e664
SHA512 f3937ecefb3122bb907331e25fd1ace3a35c87d3f1c8e4e700082b8d6a0a108386a22a2708c13294246a8ea68c8fb9a838c8f26d91762c82b8b41675dcf39c96
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUI:Q+u56utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

EKGJygQ.exe

Path C:\Windows\System\EKGJygQ.exe
Size 5.9MB
SHA256 ef9ff12a61313bb81c770c973d7b97aad40ca1ed529a2ce0cf4fc9916483674b
MD5 7d8296e507e4b5d32592e8929e19bab6
SHA1 e4c5abc3a24e1ac1b12655f09ddfa69731604b77
SHA512 fe41f0226a7954abcb1511f8f88f1f5b6868eb41cfb6ad6213f45acb4b5bb7a3071a0fa2dd4dd2aec4b9245d1659a7f7396110881a6372943e7cd50d087cab85
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUa:Q+u56utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

GUHGFGK.exe

Path C:\Windows\System\GUHGFGK.exe
Size 5.9MB
SHA256 1c9de75eb346a91a400da1c8693fa50c541d623f978ed5e87aeaf1d59da89efa
MD5 5303a5df53f70275199e9e2ef944508c
SHA1 a842a2726db04018174324f07f6802a1b6199958
SHA512 f081cecf1ec61002b37a2b915576ff0b19f34d799b326a5dd84fbe1b5114b8e2eaa11ced0c86468d6aaaecfed3128be07d0276fc27f08f274a73f83576026f44
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUt:Q+u56utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODkKVLe.exe

Path C:\Windows\System\ODkKVLe.exe
Size 5.9MB
SHA256 1f44c06bc7db219220eba7b1c211ef8697b534973354cfff0dac5b352663e5ff
MD5 b5a28c623de2b821e10e688adde58e9b
SHA1 7524279936e5be62a45cc81da2e3960083020a92
SHA512 b5937c5624f5348b4610d5370f1ec268d87c059e4d397adae1e0ff81fb0825c4292d748c6eb3263976f494f128d63735b90fa2b55a9645b3fc519caf9a9fb8d4
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU1:Q+u56utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

UMcSZaK.exe

Path C:\Windows\System\UMcSZaK.exe
Size 5.9MB
SHA256 b0247011c0cea8a7fe21e939eba6b5c0962e9fa8cb19518c34f6a925dd13b7e9
MD5 f242f3b4959b5b03cc1e8ca6df5e4ef6
SHA1 15b5c9b6bb7901b04872d2f4b2eddcccc219af04
SHA512 cd959c50c9c991bc3401def50716c62a9023d86e23f536dac1123c8abd2a325940e08eac4b6f0f92e9d9d9f97238f8fcd673a1110e42e2ae584feb4ccacfd30b
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUC:Q+u56utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

VYuMXYa.exe

Path C:\Windows\System\VYuMXYa.exe
Size 5.9MB
SHA256 d089a15d60058038bd940fc4559f0cf8e88640b273a7153532c2c23c6e432773
MD5 45e9b39479ce46d6d13146e3ab4bf640
SHA1 423cbeb85f7aa607ec06e74ef6fcb1cddb2314d1
SHA512 42224f023225de2259ca064aaf13c33b7cb9fd63821b0b821d47173c54df592128a177a3ac1deb24e023a0104fe8c7c89bbfa55c27e02517c08551d088a70829
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU2:Q+u56utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

bJOCxWB.exe

Path C:\Windows\System\bJOCxWB.exe
Size 5.9MB
SHA256 cb22e69e3a91e019c5a662cf7b759f7d72dcd35eb979f299712eab431dca51c2
MD5 fc6c5ef14f2e38ae7d7dbe63cc9ab5a1
SHA1 4e399fa78bd68a244303d92b5ea62342e9b1d4a2
SHA512 88587607d502b0a1c576bb80bddfcfd3f03c0c74dc0a434e78c0cff8173a2c25915e25f802a01d4dcd3200ac8e10143c20ade171b9a27361639fa2affd26bd43
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUn:Q+u56utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

bqHVxNM.exe

Path C:\Windows\System\bqHVxNM.exe
Size 5.9MB
SHA256 552577b2383e0e43f827bea246c47297fbf7829308b7c0e532786656ab15df22
MD5 99906d6e4512f1a57379cfac0903be06
SHA1 424b87e7503458a3e0934527d8771a46d64ff820
SHA512 987d33a79e1bb211bb11960179656823d400d3ae3f9eef4dc9de2b5ba3791fbff1e8d842fef406cfe278b78cfaf4d5bd0f7aebe5df0a870a858776b53a2f889c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU3:Q+u56utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXAAFvl.exe

Path C:\Windows\System\eXAAFvl.exe
Size 5.9MB
SHA256 053df8e7b7cb70903767e17020bb7985ca9f63467469b2b03d5bb0fd76f5c1bf
MD5 e3d6eb6e2b47982acddcca45835ec2f8
SHA1 debcdd458775c467659ed089097bfdf58e45ef0d
SHA512 d773521ebab484b71734254982feb0fd0f38ae6ba7147e52cc4d072d6b82aea4df5468a78098a51f9afd8b07614a9fdd857499e0e22df8da8c528d76501fbb50
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUd:Q+u56utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

hROELyG.exe

Path C:\Windows\System\hROELyG.exe
Size 5.9MB
SHA256 24e4e8b3c04805b30ea19b368d81f086f2411bf21f7fe7790619f97e4ec77fa8
MD5 2905e1b5858cb70e57cae39294f16217
SHA1 2c10c62b44eca6cb062a6d0ce58c429514d26e76
SHA512 49d1817446a267393c1ad600822740d298584141d7c146764569b81d9698bef63494f8d3b594edf05b14413915a9ef7c9d3c1223bea6b2f1574932e64dffd777
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUY:Q+u56utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

iiVZtyP.exe

Path C:\Windows\System\iiVZtyP.exe
Size 5.9MB
SHA256 6de7df6e656365def320d3ba27c4cee72c522c50fdaec256fc284addce7e8525
MD5 2f3a31c0d942c13be85e198abcd86f81
SHA1 b4e92f60d93d16578ccbbd2575751832fb264186
SHA512 1cbcfff83dc41d44cef681be6042fc384a8eece380f8e873826268dc0907ebdc49b7376ed29fdbe47f790f58a7513eeba72d4ac8a5507a13080a52d8e9730586
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUG:Q+u56utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvvfQHB.exe

Path C:\Windows\System\kvvfQHB.exe
Size 5.9MB
SHA256 6ac71a9d3c7158cbed013525399f93cb59a0b5432a2cb05282109a11bbb120f4
MD5 cdbf1f9ad8c0b6c875e52807713900de
SHA1 92def7374f2f3e8b68dc562cddffc26456793a97
SHA512 9b00534172fdd14072edf5cd64ea7e6d09a8aa376bc43054ae8c70278f4a3a3f6d205f4b411ac9fcfd7203614ee9749788769bfffb7ebc28edf0858bffb55c75
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUB:Q+u56utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

pPuOLDV.exe

Path C:\Windows\System\pPuOLDV.exe
Size 5.9MB
SHA256 6f8f8dbc6f03abee32f3af095b0f2cf409b882835e683907481d7d0a81497a4a
MD5 dc580c492b8f2988cce96d578ded5b10
SHA1 bb713d5b5ffb9a008d51318087bd950fb588d675
SHA512 b03c8c6023696716743871cac2a3627c23338d5f22906df2d048916b42466751cde87725e39484916f26ab804f21bca742eff30c97d1d04b7ada5fc6ad7434f2
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUG:Q+u56utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

rIxeDRj.exe

Path C:\Windows\System\rIxeDRj.exe
Size 5.9MB
SHA256 16c75209347bf718454f786d462c0e4eff2ed7e25602e06acb61d70c82db9fe8
MD5 c35ff690f8929f71a2022da7c15270dd
SHA1 c1ba0f1a85ed691e0cf1eb8f13dfd4a458b1668b
SHA512 a3639feadcc3f410928e85f3c717e7ee78d0e3911c6d14de4937d647a2f4b31a5f372a76717ebadb636aa182a61ae96dc4c05b0b7d119d2d3d1549174f604353
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUn:Q+u56utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGcKVDm.exe

Path C:\Windows\System\tGcKVDm.exe
Size 5.9MB
SHA256 ad658ca90c586a3d686f62e16974e174640771bd3533f9acaa24049cb2860d87
MD5 742a2194292cefbcc82a58c5831578cb
SHA1 3189c9e9acbbe78120c6d60a27848fc5cd004578
SHA512 6404b6ab49362b90b5122e0515da5bd1e98a2e4b25d5934c92211b09891b0434750d06a8580dd4c257ef235130634dd2644d953420d91623dd25ccf6f8648282
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUh:Q+u56utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

wNdKeyF.exe

Path C:\Windows\System\wNdKeyF.exe
Size 5.9MB
SHA256 9fe5a382e31c868eb5717caaade6c7fbbf1b27325f2a2e6ecc3c34051b4ae5a1
MD5 54d8b49e3bbf20b12066ea10b2243ccf
SHA1 48973fff7690ee36f3088e094f7bbaf5519ad62c
SHA512 77a83efbb996dea6664a474b2dd43cbbe41caf12356e2de544b64f5b17c09b6c5c7db151754bae92b0ce704469df03bf3fa029921cae680ba443370f48013909
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUc:Q+u56utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

xXQlypE.exe

Path C:\Windows\System\xXQlypE.exe
Size 5.9MB
SHA256 8b900a78d15b9902529058c77b5510b653fc034921964471b65b68b2ad42e7e5
MD5 66a3872f6f77687da56b9d4f9773f2ef
SHA1 98075a883ace871dc4db172f45c1996762953207
SHA512 7e0c367089e8d578df9e0fd58cff2f91eec1d48b6bf9794fa3151e6c5959092cf90a9a5588e63ff3906f81c7c17a1248372e3c20e87e4907d45446d760357f40
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUb:Q+u56utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylJvDpe.exe

Path C:\Windows\System\ylJvDpe.exe
Size 5.9MB
SHA256 381486550cc548956be13980b8fc198a8164eac3764480b05cbed002d066dcff
MD5 f0aec55507488677c4b4dc54778f1e7e
SHA1 dd7b4a56ca5cf20788585495e955a7cb9ef73248
SHA512 35e6666a3c1d704333b2551d364bc5be3c2f185d8343704b5459c4aff887d0f0b17cf959dc6e152e60ab563b2ad3bae8ed0324174ecbd3562829873a2f9cb705
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUX:Q+u56utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmOwPtL.exe

Path C:\Windows\System\zmOwPtL.exe
Size 5.9MB
SHA256 1591317a8220db5a2a03f0cd9c370c027539c8137cceee27fc21f40a60d40aa2
MD5 b2c9b4bc2bffb8ceca4df69391f18107
SHA1 cf337b1f135e33a8776b56845e09a248bfd75300
SHA512 71cb97f06f8983c9c9e8276f2bce98664b1f25bc6307bb043f7c2c2d0e008491d45c0cc849c7b2c87692a6709de37230b32434a390f01d73e9d602d336523df8
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUl:Q+u56utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-131-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp

Download

memory/404-156-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp

Download

memory/404-135-0x00007FF722E60000-0x00007FF7231B4000-memory.dmp

Download

memory/1248-104-0x00007FF62C240000-0x00007FF62C594000-memory.dmp

Download

memory/1248-151-0x00007FF62C240000-0x00007FF62C594000-memory.dmp

Download

memory/1476-139-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/1476-31-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/1476-102-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/1728-132-0x00007FF611F70000-0x00007FF6122C4000-memory.dmp

Download

memory/1728-155-0x00007FF611F70000-0x00007FF6122C4000-memory.dmp

Download

memory/1732-147-0x00007FF732040000-0x00007FF732394000-memory.dmp

Download

memory/1732-74-0x00007FF732040000-0x00007FF732394000-memory.dmp

Download

memory/1748-134-0x00007FF7122E0000-0x00007FF712634000-memory.dmp

Download

memory/1748-105-0x00007FF7122E0000-0x00007FF712634000-memory.dmp

Download

memory/1748-152-0x00007FF7122E0000-0x00007FF712634000-memory.dmp

Download

memory/1760-141-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp

Download

memory/1760-41-0x00007FF67D870000-0x00007FF67DBC4000-memory.dmp

Download

memory/2056-56-0x00007FF7602B0000-0x00007FF760604000-memory.dmp

Download

memory/2056-122-0x00007FF7602B0000-0x00007FF760604000-memory.dmp

Download

memory/2056-143-0x00007FF7602B0000-0x00007FF760604000-memory.dmp

Download

memory/2196-94-0x00007FF7A9930000-0x00007FF7A9C84000-memory.dmp

Download

memory/2196-150-0x00007FF7A9930000-0x00007FF7A9C84000-memory.dmp

Download

memory/2252-142-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp

Download

memory/2252-53-0x00007FF7E8A80000-0x00007FF7E8DD4000-memory.dmp

Download

memory/2404-124-0x00007FF668930000-0x00007FF668C84000-memory.dmp

Download

memory/2404-154-0x00007FF668930000-0x00007FF668C84000-memory.dmp

Download

memory/2468-0-0x00007FF742620000-0x00007FF742974000-memory.dmp

Download

memory/2468-1-0x00000225BC7F0000-0x00000225BC800000-memory.dmp

Download

memory/2468-82-0x00007FF742620000-0x00007FF742974000-memory.dmp

Download

memory/2588-85-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp

Download

memory/2588-148-0x00007FF71F5D0000-0x00007FF71F924000-memory.dmp

Download

memory/3784-133-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp

Download

memory/3784-149-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp

Download

memory/3784-88-0x00007FF6947C0000-0x00007FF694B14000-memory.dmp

Download

memory/4032-7-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp

Download

memory/4032-136-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp

Download

memory/4032-93-0x00007FF7D52F0000-0x00007FF7D5644000-memory.dmp

Download

memory/4072-153-0x00007FF7FF100000-0x00007FF7FF454000-memory.dmp

Download

memory/4072-115-0x00007FF7FF100000-0x00007FF7FF454000-memory.dmp

Download

memory/4168-14-0x00007FF734E10000-0x00007FF735164000-memory.dmp

Download

memory/4168-137-0x00007FF734E10000-0x00007FF735164000-memory.dmp

Download

memory/4404-68-0x00007FF608F00000-0x00007FF609254000-memory.dmp

Download

memory/4404-146-0x00007FF608F00000-0x00007FF609254000-memory.dmp

Download

memory/4968-62-0x00007FF6024F0000-0x00007FF602844000-memory.dmp

Download

memory/4968-145-0x00007FF6024F0000-0x00007FF602844000-memory.dmp

Download

memory/5004-138-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp

Download

memory/5004-20-0x00007FF6D2580000-0x00007FF6D28D4000-memory.dmp

Download

memory/5008-59-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp

Download

memory/5008-144-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp

Download

memory/5008-127-0x00007FF77F910000-0x00007FF77FC64000-memory.dmp

Download

memory/5100-140-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp

Download

memory/5100-39-0x00007FF6729C0000-0x00007FF672D14000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads