cobaltstrike | 6c1bfc8b59ee100a76df5af4e5664817a80cae59bc7d1a2185514cac304e0423

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-rvpddaah28
SHA256 6c1bfc8b59ee100a76df5af4e5664817a80cae59bc7d1a2185514cac304e0423
MD5 74fa4f0e9a4a8c4c2c0fd588da519191
SHA1 183432307c11cc511f7e6016251afaf74eb0edcd
SHA512 a88e3b6b12f6e71b0a1c6c817394501203b1832d1ffa0c10265d03723e2fdf56bb280e98459226833aededf57fa5bc01419f366bc4137728b80b9bab9c1bc06b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a000000023416-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-60.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023418-56.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-66.dat	cobalt_reflective_dll
behavioral2/files/0x001600000000a3ca-77.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002338a-86.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023389-80.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002338c-92.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-96.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-123.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-120.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-129.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023416-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023418-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001600000000a3ca-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002338a-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023389-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002338c-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2660-0-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	UPX
behavioral2/files/0x000a000000023416-4.dat	UPX
behavioral2/memory/1500-8-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023421-12.dat	UPX
behavioral2/files/0x0007000000023422-10.dat	UPX
behavioral2/memory/3512-14-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	UPX
behavioral2/memory/1920-20-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-22.dat	UPX
behavioral2/files/0x0007000000023424-30.dat	UPX
behavioral2/memory/832-26-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-35.dat	UPX
behavioral2/memory/3176-32-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	UPX
behavioral2/memory/4632-38-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-42.dat	UPX
behavioral2/memory/2612-44-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	UPX
behavioral2/files/0x0007000000023428-48.dat	UPX
behavioral2/files/0x0007000000023429-60.dat	UPX
behavioral2/memory/1380-57-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	UPX
behavioral2/files/0x000a000000023418-56.dat	UPX
behavioral2/memory/2228-50-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	UPX
behavioral2/memory/2660-62-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-66.dat	UPX
behavioral2/memory/1500-70-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	UPX
behavioral2/files/0x001600000000a3ca-77.dat	UPX
behavioral2/files/0x000a00000002338a-86.dat	UPX
behavioral2/memory/5004-84-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	UPX
behavioral2/memory/1508-88-0x00007FF7E1FE0000-0x00007FF7E2334000-memory.dmp	UPX
behavioral2/files/0x000a000000023389-80.dat	UPX
behavioral2/memory/3876-74-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	UPX
behavioral2/memory/1324-73-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	UPX
behavioral2/memory/1784-65-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	UPX
behavioral2/files/0x000a00000002338c-92.dat	UPX
behavioral2/files/0x000700000002342b-96.dat	UPX
behavioral2/files/0x000700000002342c-105.dat	UPX
behavioral2/memory/2196-104-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	UPX
behavioral2/memory/2300-103-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	UPX
behavioral2/memory/4148-95-0x00007FF6328E0000-0x00007FF632C34000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-110.dat	UPX
behavioral2/memory/1116-112-0x00007FF7EB0F0000-0x00007FF7EB444000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-123.dat	UPX
behavioral2/files/0x000700000002342e-120.dat	UPX
behavioral2/memory/4488-119-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	UPX
behavioral2/memory/1380-116-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-129.dat	UPX
behavioral2/memory/2524-128-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	UPX
behavioral2/memory/744-127-0x00007FF68C340000-0x00007FF68C694000-memory.dmp	UPX
behavioral2/memory/3876-131-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	UPX
behavioral2/memory/2300-132-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	UPX
behavioral2/memory/2196-133-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	UPX
behavioral2/memory/4488-134-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	UPX
behavioral2/memory/2524-135-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	UPX
behavioral2/memory/1500-136-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	UPX
behavioral2/memory/3512-137-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	UPX
behavioral2/memory/1920-138-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	UPX
behavioral2/memory/832-139-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	UPX
behavioral2/memory/3176-140-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	UPX
behavioral2/memory/4632-141-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	UPX
behavioral2/memory/2612-142-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	UPX
behavioral2/memory/2228-143-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	UPX
behavioral2/memory/1380-144-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	UPX
behavioral2/memory/1784-145-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	UPX
behavioral2/memory/1324-146-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	UPX
behavioral2/memory/3876-147-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	UPX
behavioral2/memory/5004-148-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2660-0-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	xmrig
behavioral2/files/0x000a000000023416-4.dat	xmrig
behavioral2/memory/1500-8-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-12.dat	xmrig
behavioral2/files/0x0007000000023422-10.dat	xmrig
behavioral2/memory/3512-14-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	xmrig
behavioral2/memory/1920-20-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-22.dat	xmrig
behavioral2/files/0x0007000000023424-30.dat	xmrig
behavioral2/memory/832-26-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-35.dat	xmrig
behavioral2/memory/3176-32-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	xmrig
behavioral2/memory/4632-38-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-42.dat	xmrig
behavioral2/memory/2612-44-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-48.dat	xmrig
behavioral2/files/0x0007000000023429-60.dat	xmrig
behavioral2/memory/1380-57-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	xmrig
behavioral2/files/0x000a000000023418-56.dat	xmrig
behavioral2/memory/2228-50-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	xmrig
behavioral2/memory/2660-62-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-66.dat	xmrig
behavioral2/memory/1500-70-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	xmrig
behavioral2/files/0x001600000000a3ca-77.dat	xmrig
behavioral2/files/0x000a00000002338a-86.dat	xmrig
behavioral2/memory/5004-84-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	xmrig
behavioral2/memory/1508-88-0x00007FF7E1FE0000-0x00007FF7E2334000-memory.dmp	xmrig
behavioral2/files/0x000a000000023389-80.dat	xmrig
behavioral2/memory/3876-74-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	xmrig
behavioral2/memory/1324-73-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	xmrig
behavioral2/memory/1784-65-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	xmrig
behavioral2/files/0x000a00000002338c-92.dat	xmrig
behavioral2/files/0x000700000002342b-96.dat	xmrig
behavioral2/files/0x000700000002342c-105.dat	xmrig
behavioral2/memory/2196-104-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	xmrig
behavioral2/memory/2300-103-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	xmrig
behavioral2/memory/4148-95-0x00007FF6328E0000-0x00007FF632C34000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-110.dat	xmrig
behavioral2/memory/1116-112-0x00007FF7EB0F0000-0x00007FF7EB444000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-123.dat	xmrig
behavioral2/files/0x000700000002342e-120.dat	xmrig
behavioral2/memory/4488-119-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	xmrig
behavioral2/memory/1380-116-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-129.dat	xmrig
behavioral2/memory/2524-128-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	xmrig
behavioral2/memory/744-127-0x00007FF68C340000-0x00007FF68C694000-memory.dmp	xmrig
behavioral2/memory/3876-131-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	xmrig
behavioral2/memory/2300-132-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	xmrig
behavioral2/memory/2196-133-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	xmrig
behavioral2/memory/4488-134-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	xmrig
behavioral2/memory/2524-135-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	xmrig
behavioral2/memory/1500-136-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	xmrig
behavioral2/memory/3512-137-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	xmrig
behavioral2/memory/1920-138-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	xmrig
behavioral2/memory/832-139-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	xmrig
behavioral2/memory/3176-140-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	xmrig
behavioral2/memory/4632-141-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	xmrig
behavioral2/memory/2612-142-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	xmrig
behavioral2/memory/2228-143-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	xmrig
behavioral2/memory/1380-144-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	xmrig
behavioral2/memory/1784-145-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	xmrig
behavioral2/memory/1324-146-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	xmrig
behavioral2/memory/3876-147-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	xmrig
behavioral2/memory/5004-148-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1500	GVVSIuo.exe
3512	tHkCpPH.exe
1920	zaBqKcf.exe
832	ILDsgTM.exe
3176	aOCEnzU.exe
4632	UvqwouN.exe
2612	HRFZeFx.exe
2228	UVQRxht.exe
1380	rlPHoHl.exe
1784	pkHiTvZ.exe
1324	cOxdrxD.exe
3876	mkLnuyj.exe
5004	cMXSwDu.exe
1508	uAbMHvZ.exe
4148	zfyIYIO.exe
2300	IRqDATp.exe
2196	DJehAzL.exe
1116	ugnoXog.exe
4488	zrmHnMY.exe
744	htNlRfe.exe
2524	IoyVRaF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2660-0-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	upx
behavioral2/files/0x000a000000023416-4.dat	upx
behavioral2/memory/1500-8-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	upx
behavioral2/files/0x0007000000023421-12.dat	upx
behavioral2/files/0x0007000000023422-10.dat	upx
behavioral2/memory/3512-14-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	upx
behavioral2/memory/1920-20-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-22.dat	upx
behavioral2/files/0x0007000000023424-30.dat	upx
behavioral2/memory/832-26-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	upx
behavioral2/files/0x0007000000023425-35.dat	upx
behavioral2/memory/3176-32-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	upx
behavioral2/memory/4632-38-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	upx
behavioral2/files/0x0007000000023426-42.dat	upx
behavioral2/memory/2612-44-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	upx
behavioral2/files/0x0007000000023428-48.dat	upx
behavioral2/files/0x0007000000023429-60.dat	upx
behavioral2/memory/1380-57-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	upx
behavioral2/files/0x000a000000023418-56.dat	upx
behavioral2/memory/2228-50-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	upx
behavioral2/memory/2660-62-0x00007FF66F200000-0x00007FF66F554000-memory.dmp	upx
behavioral2/files/0x000700000002342a-66.dat	upx
behavioral2/memory/1500-70-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	upx
behavioral2/files/0x001600000000a3ca-77.dat	upx
behavioral2/files/0x000a00000002338a-86.dat	upx
behavioral2/memory/5004-84-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	upx
behavioral2/memory/1508-88-0x00007FF7E1FE0000-0x00007FF7E2334000-memory.dmp	upx
behavioral2/files/0x000a000000023389-80.dat	upx
behavioral2/memory/3876-74-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	upx
behavioral2/memory/1324-73-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	upx
behavioral2/memory/1784-65-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	upx
behavioral2/files/0x000a00000002338c-92.dat	upx
behavioral2/files/0x000700000002342b-96.dat	upx
behavioral2/files/0x000700000002342c-105.dat	upx
behavioral2/memory/2196-104-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	upx
behavioral2/memory/2300-103-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	upx
behavioral2/memory/4148-95-0x00007FF6328E0000-0x00007FF632C34000-memory.dmp	upx
behavioral2/files/0x000700000002342d-110.dat	upx
behavioral2/memory/1116-112-0x00007FF7EB0F0000-0x00007FF7EB444000-memory.dmp	upx
behavioral2/files/0x0007000000023430-123.dat	upx
behavioral2/files/0x000700000002342e-120.dat	upx
behavioral2/memory/4488-119-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	upx
behavioral2/memory/1380-116-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	upx
behavioral2/files/0x0007000000023431-129.dat	upx
behavioral2/memory/2524-128-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	upx
behavioral2/memory/744-127-0x00007FF68C340000-0x00007FF68C694000-memory.dmp	upx
behavioral2/memory/3876-131-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	upx
behavioral2/memory/2300-132-0x00007FF730950000-0x00007FF730CA4000-memory.dmp	upx
behavioral2/memory/2196-133-0x00007FF714CC0000-0x00007FF715014000-memory.dmp	upx
behavioral2/memory/4488-134-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp	upx
behavioral2/memory/2524-135-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp	upx
behavioral2/memory/1500-136-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp	upx
behavioral2/memory/3512-137-0x00007FF695560000-0x00007FF6958B4000-memory.dmp	upx
behavioral2/memory/1920-138-0x00007FF711070000-0x00007FF7113C4000-memory.dmp	upx
behavioral2/memory/832-139-0x00007FF685350000-0x00007FF6856A4000-memory.dmp	upx
behavioral2/memory/3176-140-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp	upx
behavioral2/memory/4632-141-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp	upx
behavioral2/memory/2612-142-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp	upx
behavioral2/memory/2228-143-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp	upx
behavioral2/memory/1380-144-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp	upx
behavioral2/memory/1784-145-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp	upx
behavioral2/memory/1324-146-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp	upx
behavioral2/memory/3876-147-0x00007FF77B110000-0x00007FF77B464000-memory.dmp	upx
behavioral2/memory/5004-148-0x00007FF6103B0000-0x00007FF610704000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\cOxdrxD.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zfyIYIO.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ugnoXog.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zaBqKcf.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HRFZeFx.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UVQRxht.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cMXSwDu.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\htNlRfe.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IoyVRaF.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GVVSIuo.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ILDsgTM.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UvqwouN.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rlPHoHl.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mkLnuyj.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zrmHnMY.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tHkCpPH.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pkHiTvZ.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uAbMHvZ.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IRqDATp.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DJehAzL.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aOCEnzU.exe	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 1500	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	83
PID 2660 wrote to memory of 1500	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	83
PID 2660 wrote to memory of 3512	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	84
PID 2660 wrote to memory of 3512	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	84
PID 2660 wrote to memory of 1920	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	85
PID 2660 wrote to memory of 1920	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	85
PID 2660 wrote to memory of 832	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	87
PID 2660 wrote to memory of 832	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	87
PID 2660 wrote to memory of 3176	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	88
PID 2660 wrote to memory of 3176	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	88
PID 2660 wrote to memory of 4632	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	89
PID 2660 wrote to memory of 4632	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	89
PID 2660 wrote to memory of 2612	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	90
PID 2660 wrote to memory of 2612	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	90
PID 2660 wrote to memory of 2228	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	91
PID 2660 wrote to memory of 2228	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	91
PID 2660 wrote to memory of 1380	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	93
PID 2660 wrote to memory of 1380	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	93
PID 2660 wrote to memory of 1784	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	94
PID 2660 wrote to memory of 1784	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	94
PID 2660 wrote to memory of 1324	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	95
PID 2660 wrote to memory of 1324	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	95
PID 2660 wrote to memory of 3876	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	97
PID 2660 wrote to memory of 3876	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	97
PID 2660 wrote to memory of 5004	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	98
PID 2660 wrote to memory of 5004	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	98
PID 2660 wrote to memory of 1508	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	99
PID 2660 wrote to memory of 1508	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	99
PID 2660 wrote to memory of 4148	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	100
PID 2660 wrote to memory of 4148	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	100
PID 2660 wrote to memory of 2300	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	103
PID 2660 wrote to memory of 2300	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	103
PID 2660 wrote to memory of 2196	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	104
PID 2660 wrote to memory of 2196	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	104
PID 2660 wrote to memory of 1116	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	105
PID 2660 wrote to memory of 1116	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	105
PID 2660 wrote to memory of 4488	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	106
PID 2660 wrote to memory of 4488	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	106
PID 2660 wrote to memory of 744	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	108
PID 2660 wrote to memory of 744	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	108
PID 2660 wrote to memory of 2524	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	109
PID 2660 wrote to memory of 2524	2660	2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_74fa4f0e9a4a8c4c2c0fd588da519191_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\System\GVVSIuo.exe
  C:\Windows\System\GVVSIuo.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\tHkCpPH.exe
  C:\Windows\System\tHkCpPH.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\zaBqKcf.exe
  C:\Windows\System\zaBqKcf.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ILDsgTM.exe
  C:\Windows\System\ILDsgTM.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\aOCEnzU.exe
  C:\Windows\System\aOCEnzU.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\UvqwouN.exe
  C:\Windows\System\UvqwouN.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\HRFZeFx.exe
  C:\Windows\System\HRFZeFx.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\UVQRxht.exe
  C:\Windows\System\UVQRxht.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\rlPHoHl.exe
  C:\Windows\System\rlPHoHl.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\pkHiTvZ.exe
  C:\Windows\System\pkHiTvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\cOxdrxD.exe
  C:\Windows\System\cOxdrxD.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\mkLnuyj.exe
  C:\Windows\System\mkLnuyj.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\cMXSwDu.exe
  C:\Windows\System\cMXSwDu.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\uAbMHvZ.exe
  C:\Windows\System\uAbMHvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\zfyIYIO.exe
  C:\Windows\System\zfyIYIO.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\IRqDATp.exe
  C:\Windows\System\IRqDATp.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\DJehAzL.exe
  C:\Windows\System\DJehAzL.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ugnoXog.exe
  C:\Windows\System\ugnoXog.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\zrmHnMY.exe
  C:\Windows\System\zrmHnMY.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\htNlRfe.exe
  C:\Windows\System\htNlRfe.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\IoyVRaF.exe
  C:\Windows\System\IoyVRaF.exe
  2⤵
  - Executes dropped EXE
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DJehAzL.exe

Path C:\Windows\System\DJehAzL.exe
Size 5.9MB
SHA256 280d5f9e7074bf42ff70b27bec3ce84743d86e3150bf191b4c28ea760fddf325
MD5 e9253b743757c80173a9848d61afc6be
SHA1 6d3515b5cf569b282a4274f7ea3d694fcad899fc
SHA512 33004306acb50fb888007bee6af902f09da95e8092b6c057a4b5985a313369556625702d92a7c3a57af2ad0d1e9b0396b39d6269252cd804ad710b7a5f029644
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

GVVSIuo.exe

Path C:\Windows\System\GVVSIuo.exe
Size 5.9MB
SHA256 c21d7c33c1fa48f234c6a60d60340f47765229fec85a391e63a02956e5377ec6
MD5 fffaf6190d5fac3104c4662abd7684fd
SHA1 439b5a8eb2a690a3fd789d9d31490580e402b7a5
SHA512 681245f3c4acbf65236de4d3d832d19fb60fb9061cd907c807dc146c8976805780f8cb01e1e97cb87141f096829362742a04a3c3a999e5eda04850257844f186
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

HRFZeFx.exe

Path C:\Windows\System\HRFZeFx.exe
Size 5.9MB
SHA256 59f39755d591eee63c7ab43b4a4c9fbd730b1833bddeb688cf559e9d7aeca57b
MD5 4529effa00b4c2ef0d29b1c982153613
SHA1 a019a74b8a21f4507e9de04df32ffe726f9b328b
SHA512 cead7e79219b8288a67975b4a9b839a42d9185129dcf4482d57fc5c348216ca27fe9e56f9b6a8de377bc665c0138cf9f748ff0de3bd53a9d815bd908bf0eeb4e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ILDsgTM.exe

Path C:\Windows\System\ILDsgTM.exe
Size 5.9MB
SHA256 801a07178e971b9934a387f0e3b0278e86c33e4516751c4a3c33bda1f22eb594
MD5 5067e6f9c739f8e705fc682fd0f75ea2
SHA1 132072744d93c4c8cc1c6024b3e10be8a8aaf003
SHA512 fbd357b86f88829d1320ec5d1e63de56b23cb3da945195363e4e048931fc4ef6ebf091dda8cb73c18511fd952f43508a1713467836e145d85145eed0adc7ed7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

IRqDATp.exe

Path C:\Windows\System\IRqDATp.exe
Size 5.9MB
SHA256 9eafa386056aab8c052f48452ef5841652e43c9664a8d6b8d3298225873a3e93
MD5 0e0c726264f6e2c6c374d6e6138f1a87
SHA1 66222728b74f0da4e4ec8af43fcd8736fb545c04
SHA512 4970781237d5ab69f86d1c03006342f603d8bccfe0873d4eee0ea08144cfbc7890de910893c70503e17875b0f4998985c1fcb712e24a7d30fdea464e8f8009eb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

IoyVRaF.exe

Path C:\Windows\System\IoyVRaF.exe
Size 5.9MB
SHA256 214409ffc177989ef56de7eda2e7d0177233daa98a5a2ea7441fd0fca0bd8ad9
MD5 a5fd8d3fc39ee040256b37248b17f172
SHA1 4ef073ac40ac0a7a95dc207a3c640be0c4d172a0
SHA512 9d25e1ef5c0901e8209cfa36224b3ed45c99b9026f214979f4faf3a5e2687b86f126e94aca0a0916828cf6435019035ccb772380b3536cf46e7db24aeb20b404
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

UVQRxht.exe

Path C:\Windows\System\UVQRxht.exe
Size 5.9MB
SHA256 bd8e14beb87328e109fd9891f3ded6a42cd5f873c417d469faeda4571fd75d54
MD5 47d531197ea680584b4fbac5596e2f70
SHA1 fa7382b0c75c166e80ecf9d777222ef6e2103da1
SHA512 c81154cca8521ede7c1a3d70c82c76046813554c183013612d5b8a8a105504805b81f3b132ee5de8cab408a40afeec0f74fa846a3d6b66e14827b03268fc9883
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

UvqwouN.exe

Path C:\Windows\System\UvqwouN.exe
Size 5.9MB
SHA256 21efb65c97610de4c7421d295393716898a6ef4811d2e6ead178c401ac36e153
MD5 98787d1b5ccf6f21d72c6fe63ce173dc
SHA1 c3121f6e59361e3c2e0fc711e71c33cb3e5766cf
SHA512 c42e17c6395e9a68c67555dce4d725279d202497f50c6acd3303abed5df16582a85eb31cd9d30f30c13a1e713ac115f3c6b9826c3f21a322a1df94400b961b9a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

aOCEnzU.exe

Path C:\Windows\System\aOCEnzU.exe
Size 5.9MB
SHA256 69b981809deef1fab6f3e92f0371b0cd52824a45d759c93674e94eb33e1fede9
MD5 dd6ff656a3392bda6e5650c5badaa348
SHA1 52384df01804e046fa55849b4b1d9502fb1ca4dc
SHA512 75097e9474a2df78021914800fe15104eb9cf03348b6952d5247b968b203af94befc41f461e8387b48cd7294611acab2632880e85e304a4cb428686d10530e2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

cMXSwDu.exe

Path C:\Windows\System\cMXSwDu.exe
Size 5.9MB
SHA256 eba5e0f9ee7813e328ab1747e331d2e92dfecb4515edfb3746a8fa74daa3d00e
MD5 1273123778a5cb68cd25eadcce9f7ccb
SHA1 20e47ed28c1af537d3ac4771f8eb7e450cb4c258
SHA512 3fd0c42fab55afd7648fd33a2f7bad47473d7d356fc971dd8937e5f254f6d16088c06f4ed7e127143c44e59aa3e13b62aeae51790ba4e569b3be309c0c21e3c8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

cOxdrxD.exe

Path C:\Windows\System\cOxdrxD.exe
Size 5.9MB
SHA256 10dd6255ea1abd06d169d7e508c5a18b0e924497c8f589f2737358bc5c9bc1dd
MD5 0da312594a9a9a60329892abc0ee78e4
SHA1 95f5a70fe139128921dd78cdece9e6435406f5ab
SHA512 722921d4bf3e3da67dd1bcc15732c05dc3742db19a2d98ca97574196048d497026c58e4aeec485edd1d02e43a98df0bb32174e576761ebde688ecdb420fffb66
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

htNlRfe.exe

Path C:\Windows\System\htNlRfe.exe
Size 5.9MB
SHA256 f8f7e1cb31f813e2b5230864d2f0cc822a69bb8b31ff849c9d767e6c6d038de9
MD5 ec9a235d681aa1f0b9b4a4a71131101d
SHA1 ecda75ef751d9adf29684a1f6e21823be219d01d
SHA512 39146882026e7f466ae262fbf28a747572f2749d6e3ed03e99ca2342f47c2b583fc2a78b80b9ae9b064f81505dcdb6dd03b0a2173e608cd09018edd0d6e73770
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkLnuyj.exe

Path C:\Windows\System\mkLnuyj.exe
Size 5.9MB
SHA256 27d4a4d872b2cfec0476e34dbc04035902980b8d352ac4acfecf8eb6c6c2e500
MD5 bcbc2614719560368db913965ff051e2
SHA1 c3df1b7cd46ca980eea25dfb5ec50692e85f9dfd
SHA512 8429946400694cf2219601d3ec57c1cd0dbd1457078bad170ccbb8a5b5041b01aea24de06a226a56b8f0757bc2c1000826e30b60f8710b6704380cb1bdcd0dd8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkHiTvZ.exe

Path C:\Windows\System\pkHiTvZ.exe
Size 5.9MB
SHA256 af35baf8597bdbd290b09f6652ddf3997878774f3d36ee462b2505581b53df1d
MD5 f722158d1f9afbd9712b5bd85fe9aa7a
SHA1 9c256a391efc9af508ecd7313b9a3f957ad018cc
SHA512 ed5421d1bda72922d3110d29d8f396ba77af577515e4b3041dd87b9d4ccdf51ed0bf4666925ed7423fb86fee14a3e5a0cb4bf4e20a09b42df660e6735c368242
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlPHoHl.exe

Path C:\Windows\System\rlPHoHl.exe
Size 5.9MB
SHA256 2fe3d16d7a66c1dc01e017674f74ca9f1f237e42264ad82fd69feba663de637a
MD5 7bc7d1663e7f3278eeeccbfe88bf1ec4
SHA1 745ee1c11302124a5724e1d3d6846336271579ee
SHA512 cfd1fdf59a1d681d9300a4d7dd5ccb512b75431be73c73619cf9a427e149d2dd47ea0cfe57bce5252953fb3b91fc6a75263e56258a5df347970199e64cc5614e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

tHkCpPH.exe

Path C:\Windows\System\tHkCpPH.exe
Size 5.9MB
SHA256 2e5535cc17ec1fe8080366d76ca2b10449b2c6f274f7091aed11a235ec9589b4
MD5 424b2a1d45ec438a33756ade1f6fe14b
SHA1 110003416d120bd73392ca6c8fa21c1fd6ec45b0
SHA512 152b08f349da3d5542723fd21e64d839ca27b64fd74caa0e56896e1fb7d82a49ee49859456e9f59a1a343d6b1afe9603707ff6a8f933f54c1810145aaa7621e0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

uAbMHvZ.exe

Path C:\Windows\System\uAbMHvZ.exe
Size 5.9MB
SHA256 231c0b96e424c518731699803321bb8f373a76fc10e9e2d0a41f918f36776eb2
MD5 b86477ad4980d2c066efc058197e37d7
SHA1 4ba2f35a57181efe4e24f0bf68a8975f31bcf52d
SHA512 a6aa08a7236ad2563eee1e3233250dbe494528628ffc5dc52276913b1fe1db68a713c4ec0147437eb5af8c76d861d099fcd83d7e343c928b0479229e756f3fde
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ugnoXog.exe

Path C:\Windows\System\ugnoXog.exe
Size 5.9MB
SHA256 583def3c79fc9a292d769591e7a3100d4674de8ea5f07ca28a302d8e5ef8dc0f
MD5 4a9bff9f59aae1d2dcead686687c9191
SHA1 98d6e9a03a527f9b525f3b14edc418f9cd19a847
SHA512 ead6d20560860f305e74519be53173be33ec93f68e2d01db5ad40cf108dfb56f217427798ec54728e70e4b4144a71fdad4c4e1b0ba2a895aa629a413c3467929
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaBqKcf.exe

Path C:\Windows\System\zaBqKcf.exe
Size 5.9MB
SHA256 c37baf3469b3926ad19f9061193b355baeb5de74f407013ac51c0ad037f128a6
MD5 d4fd07468d1df351ee666127c4d7c606
SHA1 317457befc7d3e3927c4aa9af54ae60be3294f15
SHA512 1b6e4194ce3971cd9709674b5fc229da651448720e046e3fe20a9049b44e4c2af93ced4025994adb8720ab124a944f89d1aa97430fd6c748399d4de0771e3191
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

zfyIYIO.exe

Path C:\Windows\System\zfyIYIO.exe
Size 5.9MB
SHA256 a00573b0606acf2d86e539e53a823535eff231ce8a08000d149d2ea55b7b14cd
MD5 c832f8f5e9cc19e8fad6ba9a4fb84588
SHA1 663c39666c7585593d68cf6bc8e204244fff8431
SHA512 b24320debab161a5b4cee0274cc33cb081905ddd5c3fa4bcd2f3a1a0fcadea0d4a9c9a44b470e040c55094598af4874177d869909eec3c0ac36fa74b345ec0d1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

zrmHnMY.exe

Path C:\Windows\System\zrmHnMY.exe
Size 5.9MB
SHA256 c314f173db5830827e85246e221b0aa3b0755439977af1c2aff8017a1970bbaa
MD5 a7361574c1c99f7aeb5ec66469fa8d9a
SHA1 29248e7134390dc59f4985b7e392a4bb707379b5
SHA512 5ea0e1ff8e571c288a9002024d88360b060d697c366a25c6ef697d47aed0107101b70f25ffe7772bd9e018c44e0c4ef335ffed2e7e5782e569bd5023ebcdbf75
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/744-155-0x00007FF68C340000-0x00007FF68C694000-memory.dmp

Download

memory/744-127-0x00007FF68C340000-0x00007FF68C694000-memory.dmp

Download

memory/832-139-0x00007FF685350000-0x00007FF6856A4000-memory.dmp

Download

memory/832-26-0x00007FF685350000-0x00007FF6856A4000-memory.dmp

Download

memory/1116-112-0x00007FF7EB0F0000-0x00007FF7EB444000-memory.dmp

Download

memory/1116-153-0x00007FF7EB0F0000-0x00007FF7EB444000-memory.dmp

Download

memory/1324-146-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp

Download

memory/1324-73-0x00007FF6E4110000-0x00007FF6E4464000-memory.dmp

Download

memory/1380-57-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp

Download

memory/1380-144-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp

Download

memory/1380-116-0x00007FF7B2BC0000-0x00007FF7B2F14000-memory.dmp

Download

memory/1500-70-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp

Download

memory/1500-136-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp

Download

memory/1500-8-0x00007FF6CE790000-0x00007FF6CEAE4000-memory.dmp

Download

memory/1508-88-0x00007FF7E1FE0000-0x00007FF7E2334000-memory.dmp

Download

memory/1508-149-0x00007FF7E1FE0000-0x00007FF7E2334000-memory.dmp

Download

memory/1784-65-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp

Download

memory/1784-145-0x00007FF64BF20000-0x00007FF64C274000-memory.dmp

Download

memory/1920-138-0x00007FF711070000-0x00007FF7113C4000-memory.dmp

Download

memory/1920-20-0x00007FF711070000-0x00007FF7113C4000-memory.dmp

Download

memory/2196-152-0x00007FF714CC0000-0x00007FF715014000-memory.dmp

Download

memory/2196-104-0x00007FF714CC0000-0x00007FF715014000-memory.dmp

Download

memory/2196-133-0x00007FF714CC0000-0x00007FF715014000-memory.dmp

Download

memory/2228-50-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp

Download

memory/2228-143-0x00007FF68B2E0000-0x00007FF68B634000-memory.dmp

Download

memory/2300-151-0x00007FF730950000-0x00007FF730CA4000-memory.dmp

Download

memory/2300-132-0x00007FF730950000-0x00007FF730CA4000-memory.dmp

Download

memory/2300-103-0x00007FF730950000-0x00007FF730CA4000-memory.dmp

Download

memory/2524-156-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp

Download

memory/2524-128-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp

Download

memory/2524-135-0x00007FF7C4D00000-0x00007FF7C5054000-memory.dmp

Download

memory/2612-142-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp

Download

memory/2612-44-0x00007FF731AE0000-0x00007FF731E34000-memory.dmp

Download

memory/2660-1-0x0000020D60D90000-0x0000020D60DA0000-memory.dmp

Download

memory/2660-0-0x00007FF66F200000-0x00007FF66F554000-memory.dmp

Download

memory/2660-62-0x00007FF66F200000-0x00007FF66F554000-memory.dmp

Download

memory/3176-140-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp

Download

memory/3176-32-0x00007FF61ECE0000-0x00007FF61F034000-memory.dmp

Download

memory/3512-14-0x00007FF695560000-0x00007FF6958B4000-memory.dmp

Download

memory/3512-137-0x00007FF695560000-0x00007FF6958B4000-memory.dmp

Download

memory/3876-147-0x00007FF77B110000-0x00007FF77B464000-memory.dmp

Download

memory/3876-74-0x00007FF77B110000-0x00007FF77B464000-memory.dmp

Download

memory/3876-131-0x00007FF77B110000-0x00007FF77B464000-memory.dmp

Download

memory/4148-95-0x00007FF6328E0000-0x00007FF632C34000-memory.dmp

Download

memory/4148-150-0x00007FF6328E0000-0x00007FF632C34000-memory.dmp

Download

memory/4488-119-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp

Download

memory/4488-134-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp

Download

memory/4488-154-0x00007FF7592A0000-0x00007FF7595F4000-memory.dmp

Download

memory/4632-38-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp

Download

memory/4632-141-0x00007FF6E4530000-0x00007FF6E4884000-memory.dmp

Download

memory/5004-84-0x00007FF6103B0000-0x00007FF610704000-memory.dmp

Download

memory/5004-148-0x00007FF6103B0000-0x00007FF610704000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads