cobaltstrike | f90addf63264ad98a5450ff184c5c066f28b2d040b6d750f9d9610b04bb5d03b

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-s6gckscd94
SHA256 f90addf63264ad98a5450ff184c5c066f28b2d040b6d750f9d9610b04bb5d03b
MD5 012bc822b0dea6e4bf93604834d04f43
SHA1 beededcb23309ef6ea22129d960fc3b2815d6227
SHA512 baa0b9314dcff9033e2ba7904b3a4e44e17a6ee1200501b510db0262ccdef64a922c21f1dabffd77505b1e4b74c9dcec5c369852c91d00c487ca828467600c9e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0006000000023284-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-17.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-29.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002341d-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-47.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002341e-54.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-89.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-87.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023386-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000002337f-126.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-120.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-135.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-62.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023284-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002341d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002341e-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023386-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000002337f-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-135.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/400-0-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	UPX
behavioral2/files/0x0006000000023284-4.dat	UPX
behavioral2/memory/4172-7-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	UPX
behavioral2/memory/3780-18-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023422-23.dat	UPX
behavioral2/files/0x0007000000023421-17.dat	UPX
behavioral2/files/0x0007000000023423-29.dat	UPX
behavioral2/memory/4872-25-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	UPX
behavioral2/memory/1604-15-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	UPX
behavioral2/files/0x000a00000002341d-11.dat	UPX
behavioral2/files/0x0007000000023424-36.dat	UPX
behavioral2/files/0x0007000000023426-42.dat	UPX
behavioral2/files/0x0007000000023427-47.dat	UPX
behavioral2/memory/4956-48-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	UPX
behavioral2/memory/3340-44-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp	UPX
behavioral2/files/0x000800000002341e-54.dat	UPX
behavioral2/memory/3972-56-0x00007FF764500000-0x00007FF764854000-memory.dmp	UPX
behavioral2/memory/4172-69-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-80.dat	UPX
behavioral2/files/0x000700000002342c-89.dat	UPX
behavioral2/files/0x000700000002342b-87.dat	UPX
behavioral2/memory/3460-86-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	UPX
behavioral2/files/0x0009000000023386-105.dat	UPX
behavioral2/files/0x000700000002342f-112.dat	UPX
behavioral2/files/0x000700000002342e-103.dat	UPX
behavioral2/memory/4932-107-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	UPX
behavioral2/files/0x000d00000002337f-126.dat	UPX
behavioral2/memory/4608-124-0x00007FF678420000-0x00007FF678774000-memory.dmp	UPX
behavioral2/memory/3972-122-0x00007FF764500000-0x00007FF764854000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-120.dat	UPX
behavioral2/memory/4360-115-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	UPX
behavioral2/memory/4956-114-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	UPX
behavioral2/memory/2220-106-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	UPX
behavioral2/memory/1992-98-0x00007FF71A710000-0x00007FF71AA64000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-94.dat	UPX
behavioral2/memory/4152-129-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-135.dat	UPX
behavioral2/memory/876-134-0x00007FF692310000-0x00007FF692664000-memory.dmp	UPX
behavioral2/memory/4224-133-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	UPX
behavioral2/memory/1768-132-0x00007FF7D9340000-0x00007FF7D9694000-memory.dmp	UPX
behavioral2/memory/3400-83-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	UPX
behavioral2/memory/3780-78-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	UPX
behavioral2/memory/4224-77-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	UPX
behavioral2/memory/1664-73-0x00007FF64AAF0000-0x00007FF64AE44000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-72.dat	UPX
behavioral2/files/0x0007000000023429-66.dat	UPX
behavioral2/files/0x0007000000023428-62.dat	UPX
behavioral2/memory/4152-61-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	UPX
behavioral2/memory/400-60-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	UPX
behavioral2/memory/3400-137-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	UPX
behavioral2/memory/3460-138-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	UPX
behavioral2/memory/2220-139-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	UPX
behavioral2/memory/4932-140-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	UPX
behavioral2/memory/4360-141-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	UPX
behavioral2/memory/876-142-0x00007FF692310000-0x00007FF692664000-memory.dmp	UPX
behavioral2/memory/4172-143-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	UPX
behavioral2/memory/1604-144-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	UPX
behavioral2/memory/3780-145-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	UPX
behavioral2/memory/4872-146-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	UPX
behavioral2/memory/2252-147-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp	UPX
behavioral2/memory/3372-148-0x00007FF7610B0000-0x00007FF761404000-memory.dmp	UPX
behavioral2/memory/3340-149-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp	UPX
behavioral2/memory/4956-150-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	UPX
behavioral2/memory/3972-151-0x00007FF764500000-0x00007FF764854000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/400-0-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	xmrig
behavioral2/files/0x0006000000023284-4.dat	xmrig
behavioral2/memory/4172-7-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	xmrig
behavioral2/memory/3780-18-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-23.dat	xmrig
behavioral2/files/0x0007000000023421-17.dat	xmrig
behavioral2/files/0x0007000000023423-29.dat	xmrig
behavioral2/memory/4872-25-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	xmrig
behavioral2/memory/1604-15-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	xmrig
behavioral2/files/0x000a00000002341d-11.dat	xmrig
behavioral2/files/0x0007000000023424-36.dat	xmrig
behavioral2/memory/2252-33-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-42.dat	xmrig
behavioral2/memory/3372-38-0x00007FF7610B0000-0x00007FF761404000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-47.dat	xmrig
behavioral2/memory/4956-48-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	xmrig
behavioral2/memory/3340-44-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp	xmrig
behavioral2/files/0x000800000002341e-54.dat	xmrig
behavioral2/memory/3972-56-0x00007FF764500000-0x00007FF764854000-memory.dmp	xmrig
behavioral2/memory/4172-69-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-80.dat	xmrig
behavioral2/memory/4872-84-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-89.dat	xmrig
behavioral2/files/0x000700000002342b-87.dat	xmrig
behavioral2/memory/3460-86-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	xmrig
behavioral2/files/0x0009000000023386-105.dat	xmrig
behavioral2/files/0x000700000002342f-112.dat	xmrig
behavioral2/files/0x000700000002342e-103.dat	xmrig
behavioral2/memory/3372-102-0x00007FF7610B0000-0x00007FF761404000-memory.dmp	xmrig
behavioral2/memory/4932-107-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	xmrig
behavioral2/files/0x000d00000002337f-126.dat	xmrig
behavioral2/memory/4608-124-0x00007FF678420000-0x00007FF678774000-memory.dmp	xmrig
behavioral2/memory/3972-122-0x00007FF764500000-0x00007FF764854000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-120.dat	xmrig
behavioral2/memory/4360-115-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	xmrig
behavioral2/memory/4956-114-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	xmrig
behavioral2/memory/2220-106-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	xmrig
behavioral2/memory/1992-98-0x00007FF71A710000-0x00007FF71AA64000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-94.dat	xmrig
behavioral2/memory/4152-129-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-135.dat	xmrig
behavioral2/memory/876-134-0x00007FF692310000-0x00007FF692664000-memory.dmp	xmrig
behavioral2/memory/4224-133-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	xmrig
behavioral2/memory/1768-132-0x00007FF7D9340000-0x00007FF7D9694000-memory.dmp	xmrig
behavioral2/memory/3400-83-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	xmrig
behavioral2/memory/3780-78-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	xmrig
behavioral2/memory/4224-77-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	xmrig
behavioral2/memory/1664-73-0x00007FF64AAF0000-0x00007FF64AE44000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-72.dat	xmrig
behavioral2/files/0x0007000000023429-66.dat	xmrig
behavioral2/files/0x0007000000023428-62.dat	xmrig
behavioral2/memory/4152-61-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	xmrig
behavioral2/memory/400-60-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	xmrig
behavioral2/memory/3400-137-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	xmrig
behavioral2/memory/3460-138-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	xmrig
behavioral2/memory/2220-139-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	xmrig
behavioral2/memory/4932-140-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	xmrig
behavioral2/memory/4360-141-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	xmrig
behavioral2/memory/876-142-0x00007FF692310000-0x00007FF692664000-memory.dmp	xmrig
behavioral2/memory/4172-143-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	xmrig
behavioral2/memory/1604-144-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	xmrig
behavioral2/memory/3780-145-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	xmrig
behavioral2/memory/4872-146-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	xmrig
behavioral2/memory/2252-147-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4172	GQbNRFD.exe
1604	JPbwQPT.exe
3780	rPwqvVq.exe
4872	ZgBxJvo.exe
2252	diegfcU.exe
3372	aXlEVgX.exe
3340	MlCsLbH.exe
4956	pwEZERM.exe
3972	deDQmAm.exe
4152	BIPeeYU.exe
1664	TYawhql.exe
4224	zGgucqt.exe
3400	AKxYaVT.exe
3460	AwJylrs.exe
1992	YFOcTsN.exe
2220	uLQOuNW.exe
4932	xsdZZIJ.exe
4360	zehwblj.exe
4608	UWIKGUk.exe
1768	pjcHQBt.exe
876	nEdefeV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-0-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	upx
behavioral2/files/0x0006000000023284-4.dat	upx
behavioral2/memory/4172-7-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	upx
behavioral2/memory/3780-18-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	upx
behavioral2/files/0x0007000000023422-23.dat	upx
behavioral2/files/0x0007000000023421-17.dat	upx
behavioral2/files/0x0007000000023423-29.dat	upx
behavioral2/memory/4872-25-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	upx
behavioral2/memory/1604-15-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	upx
behavioral2/files/0x000a00000002341d-11.dat	upx
behavioral2/files/0x0007000000023424-36.dat	upx
behavioral2/memory/2252-33-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp	upx
behavioral2/files/0x0007000000023426-42.dat	upx
behavioral2/memory/3372-38-0x00007FF7610B0000-0x00007FF761404000-memory.dmp	upx
behavioral2/files/0x0007000000023427-47.dat	upx
behavioral2/memory/4956-48-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	upx
behavioral2/memory/3340-44-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp	upx
behavioral2/files/0x000800000002341e-54.dat	upx
behavioral2/memory/3972-56-0x00007FF764500000-0x00007FF764854000-memory.dmp	upx
behavioral2/memory/4172-69-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	upx
behavioral2/files/0x000700000002342a-80.dat	upx
behavioral2/memory/4872-84-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	upx
behavioral2/files/0x000700000002342c-89.dat	upx
behavioral2/files/0x000700000002342b-87.dat	upx
behavioral2/memory/3460-86-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	upx
behavioral2/files/0x0009000000023386-105.dat	upx
behavioral2/files/0x000700000002342f-112.dat	upx
behavioral2/files/0x000700000002342e-103.dat	upx
behavioral2/memory/3372-102-0x00007FF7610B0000-0x00007FF761404000-memory.dmp	upx
behavioral2/memory/4932-107-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	upx
behavioral2/files/0x000d00000002337f-126.dat	upx
behavioral2/memory/4608-124-0x00007FF678420000-0x00007FF678774000-memory.dmp	upx
behavioral2/memory/3972-122-0x00007FF764500000-0x00007FF764854000-memory.dmp	upx
behavioral2/files/0x0007000000023430-120.dat	upx
behavioral2/memory/4360-115-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	upx
behavioral2/memory/4956-114-0x00007FF7912C0000-0x00007FF791614000-memory.dmp	upx
behavioral2/memory/2220-106-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	upx
behavioral2/memory/1992-98-0x00007FF71A710000-0x00007FF71AA64000-memory.dmp	upx
behavioral2/files/0x000700000002342d-94.dat	upx
behavioral2/memory/4152-129-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	upx
behavioral2/files/0x0007000000023431-135.dat	upx
behavioral2/memory/876-134-0x00007FF692310000-0x00007FF692664000-memory.dmp	upx
behavioral2/memory/4224-133-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	upx
behavioral2/memory/1768-132-0x00007FF7D9340000-0x00007FF7D9694000-memory.dmp	upx
behavioral2/memory/3400-83-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	upx
behavioral2/memory/3780-78-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	upx
behavioral2/memory/4224-77-0x00007FF78E310000-0x00007FF78E664000-memory.dmp	upx
behavioral2/memory/1664-73-0x00007FF64AAF0000-0x00007FF64AE44000-memory.dmp	upx
behavioral2/files/0x000700000002342a-72.dat	upx
behavioral2/files/0x0007000000023429-66.dat	upx
behavioral2/files/0x0007000000023428-62.dat	upx
behavioral2/memory/4152-61-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp	upx
behavioral2/memory/400-60-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp	upx
behavioral2/memory/3400-137-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp	upx
behavioral2/memory/3460-138-0x00007FF6064B0000-0x00007FF606804000-memory.dmp	upx
behavioral2/memory/2220-139-0x00007FF7135E0000-0x00007FF713934000-memory.dmp	upx
behavioral2/memory/4932-140-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp	upx
behavioral2/memory/4360-141-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp	upx
behavioral2/memory/876-142-0x00007FF692310000-0x00007FF692664000-memory.dmp	upx
behavioral2/memory/4172-143-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp	upx
behavioral2/memory/1604-144-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp	upx
behavioral2/memory/3780-145-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp	upx
behavioral2/memory/4872-146-0x00007FF71C120000-0x00007FF71C474000-memory.dmp	upx
behavioral2/memory/2252-147-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\xsdZZIJ.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UWIKGUk.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JPbwQPT.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aXlEVgX.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MlCsLbH.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zGgucqt.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BIPeeYU.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AwJylrs.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YFOcTsN.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nEdefeV.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AKxYaVT.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uLQOuNW.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pjcHQBt.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZgBxJvo.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\diegfcU.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pwEZERM.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TYawhql.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GQbNRFD.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rPwqvVq.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\deDQmAm.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zehwblj.exe	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4172	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	82
PID 400 wrote to memory of 4172	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	82
PID 400 wrote to memory of 1604	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	83
PID 400 wrote to memory of 1604	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	83
PID 400 wrote to memory of 3780	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	84
PID 400 wrote to memory of 3780	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	84
PID 400 wrote to memory of 4872	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	85
PID 400 wrote to memory of 4872	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	85
PID 400 wrote to memory of 2252	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	86
PID 400 wrote to memory of 2252	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	86
PID 400 wrote to memory of 3372	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	87
PID 400 wrote to memory of 3372	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	87
PID 400 wrote to memory of 3340	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	89
PID 400 wrote to memory of 3340	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	89
PID 400 wrote to memory of 4956	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	90
PID 400 wrote to memory of 4956	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	90
PID 400 wrote to memory of 3972	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	91
PID 400 wrote to memory of 3972	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	91
PID 400 wrote to memory of 4152	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	94
PID 400 wrote to memory of 4152	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	94
PID 400 wrote to memory of 1664	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	95
PID 400 wrote to memory of 1664	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	95
PID 400 wrote to memory of 4224	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	96
PID 400 wrote to memory of 4224	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	96
PID 400 wrote to memory of 3400	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	97
PID 400 wrote to memory of 3400	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	97
PID 400 wrote to memory of 3460	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	98
PID 400 wrote to memory of 3460	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	98
PID 400 wrote to memory of 1992	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	99
PID 400 wrote to memory of 1992	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	99
PID 400 wrote to memory of 2220	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	100
PID 400 wrote to memory of 2220	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	100
PID 400 wrote to memory of 4932	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	101
PID 400 wrote to memory of 4932	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	101
PID 400 wrote to memory of 4360	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	102
PID 400 wrote to memory of 4360	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	102
PID 400 wrote to memory of 4608	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	103
PID 400 wrote to memory of 4608	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	103
PID 400 wrote to memory of 1768	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	104
PID 400 wrote to memory of 1768	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	104
PID 400 wrote to memory of 876	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	105
PID 400 wrote to memory of 876	400	2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_012bc822b0dea6e4bf93604834d04f43_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\System\GQbNRFD.exe
  C:\Windows\System\GQbNRFD.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\JPbwQPT.exe
  C:\Windows\System\JPbwQPT.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\rPwqvVq.exe
  C:\Windows\System\rPwqvVq.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\ZgBxJvo.exe
  C:\Windows\System\ZgBxJvo.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\diegfcU.exe
  C:\Windows\System\diegfcU.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\aXlEVgX.exe
  C:\Windows\System\aXlEVgX.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\MlCsLbH.exe
  C:\Windows\System\MlCsLbH.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\pwEZERM.exe
  C:\Windows\System\pwEZERM.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\deDQmAm.exe
  C:\Windows\System\deDQmAm.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\BIPeeYU.exe
  C:\Windows\System\BIPeeYU.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\TYawhql.exe
  C:\Windows\System\TYawhql.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\zGgucqt.exe
  C:\Windows\System\zGgucqt.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\AKxYaVT.exe
  C:\Windows\System\AKxYaVT.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\AwJylrs.exe
  C:\Windows\System\AwJylrs.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\YFOcTsN.exe
  C:\Windows\System\YFOcTsN.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\uLQOuNW.exe
  C:\Windows\System\uLQOuNW.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\xsdZZIJ.exe
  C:\Windows\System\xsdZZIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\zehwblj.exe
  C:\Windows\System\zehwblj.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\UWIKGUk.exe
  C:\Windows\System\UWIKGUk.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\pjcHQBt.exe
  C:\Windows\System\pjcHQBt.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\nEdefeV.exe
  C:\Windows\System\nEdefeV.exe
  2⤵
  - Executes dropped EXE
  PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AKxYaVT.exe

Path C:\Windows\System\AKxYaVT.exe
Size 5.9MB
SHA256 730f8dccbc96642724036e24525dee5fe0632db65a640a375eaf561d10ea14f2
MD5 850e0bbc258922341cd9ee986a99fba2
SHA1 77e29105fdc6f1fb7f5aea2864d65ba1be363852
SHA512 a54b5f1e4b47a78013eade8d67ed2f8bd0f35e98ae18cad43fc74569fca8de67028a13e9188883d91467f609506cd67d8eba863ac8858522dd63d972d630d17b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

AwJylrs.exe

Path C:\Windows\System\AwJylrs.exe
Size 5.9MB
SHA256 f716aee7fd16d18bd1f6385be67b0a9e7e0de45980a860da0803dd45ec9e5b1b
MD5 43cd4027cd003245297cc8fc1ecfbac5
SHA1 5cae397c2c380ab0b0b9f22d769b95f71446db1d
SHA512 c3f5bb4dda66ac93b9a5a69b6069147d62e1a85e550870e6f0471f6bf1b2b48afba8ffe87848f0fe60ff3b262a72cad638c8dbcf25afdd4200d8cce54968b428
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIPeeYU.exe

Path C:\Windows\System\BIPeeYU.exe
Size 5.9MB
SHA256 3e1afd6ac1d5c9182b49303edb92dcfea90778be5b07384fc20f2bc9713e09f0
MD5 cfa483f971c2af4348133b1e88fb5bda
SHA1 ba8a28429f18d1f16cdccf60527d8c79127c4b52
SHA512 4914a05bef0ff5ac8525142f1735a127576df4ff5345ab31e0d9c02dacaf80c35d53001174324aa447910dca36fb495bccead07f43dc6c2cd150150f3df1e73c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

GQbNRFD.exe

Path C:\Windows\System\GQbNRFD.exe
Size 5.9MB
SHA256 dad20a19f4d1e7e1f6ee4145b3d62c70580b7f04ac0eca95472eb1b770f694b3
MD5 149d53c81e6d3f983e8f227a6ecfcc7a
SHA1 33a98cda5a24f0b7acca54aedd38c53e77b4be24
SHA512 c1238f0477d9320ecddfed59aff32ae6ed9851db8cfc038095efdb2bd9d964f554582255625e1c3777d6c6e9bd25437614af530a024d18f1ee8de7d9dd289d05
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPbwQPT.exe

Path C:\Windows\System\JPbwQPT.exe
Size 5.9MB
SHA256 6789b03df44d1d696eefb552b5b2cc6d2c705dbd74808fb8066b0ff410bf3bab
MD5 24083df47239c43b5ded4fe6f8093c72
SHA1 f8c2591d6cc4361d39ce1e0092867751d5a8057d
SHA512 60cd7c99ee93cfecee89e4e0bec9623d2ecf6a5688b0dcb6239aabd7fec142fc4c5b9a47bd480413cb447c284d0e18a3bb7f826b10c8c3b7922961caa6267c52
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlCsLbH.exe

Path C:\Windows\System\MlCsLbH.exe
Size 5.9MB
SHA256 78e717ebf726ca5f0c4e781daefb09c7440ca3914bd8df766b1412ac1255f6f9
MD5 ede3a382157a608d1b3c275095d1a5ab
SHA1 1040fec2331f35c1fc43791224d3e8b295a4ba9f
SHA512 c5ac6637712ee66ace9db8a6da3f29fa86bd0df29d7ff3c5fb1f4981406f00af594bf05ad3a7c1cb5c1a13657de359ca8599006d3e5b209bb942632c5929cc6f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

TYawhql.exe

Path C:\Windows\System\TYawhql.exe
Size 5.9MB
SHA256 f487a4ee31e613fa45f579d29cc7ee4cf0fcfb1dc4211d5685345b27a2078531
MD5 0590029289107268ab76afa87b4319af
SHA1 c5d9003dba7d167670a766983d037945d015af21
SHA512 caec94575e177b3a5be2b8f39f4a37b203d69d32fbf127d75a0ad47e43c5850f9b0dd47080ab3c0b9683b0ffaeb89e44d37b4e5839713c4f5d5b146e1239ba6d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

UWIKGUk.exe

Path C:\Windows\System\UWIKGUk.exe
Size 5.9MB
SHA256 4dea988639579a22fc5e23ba8321db39c424aba4a6293b5778cea70671e66988
MD5 ea6ab90410288cf2c590abe639049d5e
SHA1 b13b0fd754c8e00caa77d23805057af4bd9bd313
SHA512 10eb01a3b8cca86911ba05a8add4c3d3b06cbc000bb78c71730eb96876f7d3beae40aa0bf838e22aae6ed814a90f7a0c3d994b4cdf118177ada5db80e462f564
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

YFOcTsN.exe

Path C:\Windows\System\YFOcTsN.exe
Size 5.9MB
SHA256 523c21efa8f88ffb292f8b9e65736fb95c3653009572bbe76ec84067512be60c
MD5 eab833abec556c52fac8ee9811c3a552
SHA1 f1f7c5d8ee0f1065344f68e87ba6156f46bfe2fe
SHA512 47f846af00a65e112a8049c571456d4fc51f6e87765066670f7490205aeb263cca4278da7f95837fe19e08f7942c3dbc5e69da3c7df355bbedd778757a2971cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZgBxJvo.exe

Path C:\Windows\System\ZgBxJvo.exe
Size 5.9MB
SHA256 97ed46ff6fbf48dc560a4aa2def36abd1095ce70d34eff2e0008a1068db28ff2
MD5 f5e3a12db1fba6fbb72066cf65e85308
SHA1 d8394182fb250706f11fd57c2bc6e84beea5f1e5
SHA512 e61018afbe8187f07aeb94159243a7fac2e4ff80e62b9cfeeecccff5a68ca09331d2653ca539c7a700b609c80fe515794142582883ea769e97124ad69c2b7927
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

aXlEVgX.exe

Path C:\Windows\System\aXlEVgX.exe
Size 5.9MB
SHA256 cf1b555fab241f268841989d3e836daf905e9731db0d503884d7205c3d65aa19
MD5 bf847bb2c878e3928d3ac5f4b6860006
SHA1 f99acef0329a5a80fd6f3cf5d6ffe90d59c920a6
SHA512 81115dec8f54b59fe9bca7151efaeac6b6b1a23707bfa8e42ad559bcf21e6d2e1def5124ca4dc2850a76d6da0905f10ed99c5031d9725729bec4bd8b3b22ab3f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

deDQmAm.exe

Path C:\Windows\System\deDQmAm.exe
Size 5.9MB
SHA256 40c48e0f4449b248fc2609f8aed45f14eeb75618c96c84a97839967b73a50f8d
MD5 a186dfca25632b954eebe1fe94991b1c
SHA1 41460cd3e924a5c404ef6c7a4f5a7a81797fbaff
SHA512 5d872bfe6482924a2415d5849795b9a30a46d6ab427e51447b08a6934606b678e36ad9180b53c9b17a776536f2e9c718ecf2862fb99b0fd75adf273fb68d3f69
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

diegfcU.exe

Path C:\Windows\System\diegfcU.exe
Size 5.9MB
SHA256 6a73fb4f7ab199d4a866225215f4b8b1a289ead2fd024b7e073fac1de6798eef
MD5 b8f7c7771ea0ef7caf7a7131230c2d95
SHA1 db6eb76c124c830f979a362a2959eee8eb6e0487
SHA512 cfb670abb893a2a577922c32e15e4c8f3952ee0f90a4b67bdb01ab60ed3daf372c7980c04295e1a3815f7d1ca261033023890b4a0004b3b3c2fde4acf6e93563
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

nEdefeV.exe

Path C:\Windows\System\nEdefeV.exe
Size 5.9MB
SHA256 5d67a6cb85cff6bf4a7600a99f590a521b64ae8e74ac2e4159b03f79a8cc8b59
MD5 8146d8e61f068255b4b85ddaa4771ee5
SHA1 76720680e1bc8a3c88c6b93a97cf85db5c731aba
SHA512 2ad2ea1ac25260f7b5d60bb8587f4cd7c0450d54ed79ec4ce65c181d143c02d30c78fd5932ed5629ecf978c4bc5b494a10b904d6ccda04393effff6027b5afc1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjcHQBt.exe

Path C:\Windows\System\pjcHQBt.exe
Size 5.9MB
SHA256 0b9a301051368c4b6033d973303b89af7a7bf841df39a36c3aed81ab832180c6
MD5 bf9fdf251b5e33cfb220a67b9499547c
SHA1 3ba94b24eb3796e2eb3ed23f84c23bd530f3bccf
SHA512 6c9f59bb93c767e9815735004e30130911db457532f8edb18feb420c529b1820aa04fc9363035e897cebd15b540f6211a2529b3c27134a1402a5792227d20274
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

pwEZERM.exe

Path C:\Windows\System\pwEZERM.exe
Size 5.9MB
SHA256 23e7c827e476d4f5f4b1d829e2650fde9459dcfb2b90d86576673b75eeabb9a8
MD5 51078010c2a9f60523c1f1504c94bd98
SHA1 e21a97840f37204eae92fe5ffc0baa1f55d39fc5
SHA512 8944ace82dff0a14c18928821fe37b57143eae1fc7c4058bfc790317575768132bb5efbf476c0d5226b1783e0eee4b6ee2eb47d7f1d3dce326c3c438aae685ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

rPwqvVq.exe

Path C:\Windows\System\rPwqvVq.exe
Size 5.9MB
SHA256 82b505de2b39a37e7093c95e5bbfa8baa8df5a541d84b0884cba10e3f7777cbc
MD5 efe5b78f26f9efba16365567c2e63012
SHA1 791c69318590c1b942b43a8fdec385b2414dc751
SHA512 c250500ab1dcb14edc6e0260d2db43f86393fc98c635e20320781e01a62e82abdb77467e4ea7f2bfb157b33c4edf744c5dbb9e4e046a96113b0285b2c5208195
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLQOuNW.exe

Path C:\Windows\System\uLQOuNW.exe
Size 5.9MB
SHA256 c2da0a099956de05eaa3ffc5d1bee2fc4c3e5c6de0120524ddcfb626f1642ef7
MD5 da412bff030f1dff66ddc9210777af55
SHA1 b558394737002260ac67baa6903304689a5b0066
SHA512 72a2751590ee9693cf5a41ecfe83a5c3863c7f1d0e80366c7971a7472d090a2b80ed0d458be1fcd89cb5d75a1faa45be9f959888d886711377cddb3470f0e0c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

xsdZZIJ.exe

Path C:\Windows\System\xsdZZIJ.exe
Size 5.9MB
SHA256 08aca1cde6b6e807332bf99dc20976120c6ec103321509e7f67bea90acb83d0e
MD5 554cc2e96f1eec412dd37b8692b1b4b9
SHA1 697b337ca2e68df972ca4e1b37b4fffcad775c76
SHA512 4d12690e05f5dfc1b2cb032f0aa35ba9a65e84327a01ceeeaef9699fd5b97870a4a24626a4dc432fa80728abc5333bbf9ec28f62f63e7470177a93a42392c4e4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGgucqt.exe

Path C:\Windows\System\zGgucqt.exe
Size 5.9MB
SHA256 82d491619dd1ffba88d601d9e101a7873f2c53b527355123a0651fbda18cce6e
MD5 577bf7413a36c26846d086b1ab3a9937
SHA1 8e955985ac1b24338d01fe75208643d000af3672
SHA512 313589d854a875a1bd0fd1248f4a9a7fc0f66835861e4dd41eebe54143bebac90a45de8b1bd2c5b03df9704021d730721862d06014f22f46e8d4ef888788358b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGgucqt.exe

Path C:\Windows\System\zGgucqt.exe
Size 3.6MB
SHA256 6f83751bb7dc13a49d7ca6c6a874635ca4829b15e2d7e8a8c8ddaf2890ac09c0
MD5 0628374c349921c969043e8b725a574d
SHA1 d4d4b61d7abb11c25e423140f9a833a035819e3d
SHA512 2db578fa7a962b14aae5c857e6974664cd647108bf44f83523c1fc47be8f0f23756b21e5f42a2231cc51d1daf9889177945ad8eab23827274ef49200ad4dd7a1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA0:BemTLkNdfE0pZrt56utgpPFotBER/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

zehwblj.exe

Path C:\Windows\System\zehwblj.exe
Size 5.9MB
SHA256 4c618bce2dd6a2b50b9d7e1f1567c1d397a8271afb4e9e64fcf7413a6bb044bf
MD5 5cea6ed95a89df71016bb039be60095e
SHA1 b6873f910c418b00684331dec2ee4356c5032a1f
SHA512 eed2626a8a763bb6c21d4a082f8a276789750e4e6c14334afb5e6be22b465f11d5e1db3b3128def71044e0f7723457ca1bee5a5242c4b69b5bed532e3683fc9e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-0-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp

Download

memory/400-1-0x000002489EFC0000-0x000002489EFD0000-memory.dmp

Download

memory/400-60-0x00007FF6A7FB0000-0x00007FF6A8304000-memory.dmp

Download

memory/876-134-0x00007FF692310000-0x00007FF692664000-memory.dmp

Download

memory/876-163-0x00007FF692310000-0x00007FF692664000-memory.dmp

Download

memory/876-142-0x00007FF692310000-0x00007FF692664000-memory.dmp

Download

memory/1604-144-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp

Download

memory/1604-15-0x00007FF7A1D50000-0x00007FF7A20A4000-memory.dmp

Download

memory/1664-153-0x00007FF64AAF0000-0x00007FF64AE44000-memory.dmp

Download

memory/1664-73-0x00007FF64AAF0000-0x00007FF64AE44000-memory.dmp

Download

memory/1768-162-0x00007FF7D9340000-0x00007FF7D9694000-memory.dmp

Download

memory/1768-132-0x00007FF7D9340000-0x00007FF7D9694000-memory.dmp

Download

memory/1992-157-0x00007FF71A710000-0x00007FF71AA64000-memory.dmp

Download

memory/1992-98-0x00007FF71A710000-0x00007FF71AA64000-memory.dmp

Download

memory/2220-106-0x00007FF7135E0000-0x00007FF713934000-memory.dmp

Download

memory/2220-139-0x00007FF7135E0000-0x00007FF713934000-memory.dmp

Download

memory/2220-158-0x00007FF7135E0000-0x00007FF713934000-memory.dmp

Download

memory/2252-33-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp

Download

memory/2252-147-0x00007FF78C3D0000-0x00007FF78C724000-memory.dmp

Download

memory/3340-149-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp

Download

memory/3340-44-0x00007FF7A33E0000-0x00007FF7A3734000-memory.dmp

Download

memory/3372-148-0x00007FF7610B0000-0x00007FF761404000-memory.dmp

Download

memory/3372-102-0x00007FF7610B0000-0x00007FF761404000-memory.dmp

Download

memory/3372-38-0x00007FF7610B0000-0x00007FF761404000-memory.dmp

Download

memory/3400-155-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp

Download

memory/3400-83-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp

Download

memory/3400-137-0x00007FF6C02B0000-0x00007FF6C0604000-memory.dmp

Download

memory/3460-138-0x00007FF6064B0000-0x00007FF606804000-memory.dmp

Download

memory/3460-156-0x00007FF6064B0000-0x00007FF606804000-memory.dmp

Download

memory/3460-86-0x00007FF6064B0000-0x00007FF606804000-memory.dmp

Download

memory/3780-145-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp

Download

memory/3780-78-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp

Download

memory/3780-18-0x00007FF6628A0000-0x00007FF662BF4000-memory.dmp

Download

memory/3972-56-0x00007FF764500000-0x00007FF764854000-memory.dmp

Download

memory/3972-122-0x00007FF764500000-0x00007FF764854000-memory.dmp

Download

memory/3972-151-0x00007FF764500000-0x00007FF764854000-memory.dmp

Download

memory/4152-129-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp

Download

memory/4152-61-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp

Download

memory/4152-152-0x00007FF7F5BF0000-0x00007FF7F5F44000-memory.dmp

Download

memory/4172-7-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp

Download

memory/4172-143-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp

Download

memory/4172-69-0x00007FF7CA6C0000-0x00007FF7CAA14000-memory.dmp

Download

memory/4224-77-0x00007FF78E310000-0x00007FF78E664000-memory.dmp

Download

memory/4224-133-0x00007FF78E310000-0x00007FF78E664000-memory.dmp

Download

memory/4224-154-0x00007FF78E310000-0x00007FF78E664000-memory.dmp

Download

memory/4360-141-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp

Download

memory/4360-115-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp

Download

memory/4360-160-0x00007FF6E9600000-0x00007FF6E9954000-memory.dmp

Download

memory/4608-161-0x00007FF678420000-0x00007FF678774000-memory.dmp

Download

memory/4608-124-0x00007FF678420000-0x00007FF678774000-memory.dmp

Download

memory/4872-84-0x00007FF71C120000-0x00007FF71C474000-memory.dmp

Download

memory/4872-146-0x00007FF71C120000-0x00007FF71C474000-memory.dmp

Download

memory/4872-25-0x00007FF71C120000-0x00007FF71C474000-memory.dmp

Download

memory/4932-140-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp

Download

memory/4932-159-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp

Download

memory/4932-107-0x00007FF638BE0000-0x00007FF638F34000-memory.dmp

Download

memory/4956-114-0x00007FF7912C0000-0x00007FF791614000-memory.dmp

Download

memory/4956-150-0x00007FF7912C0000-0x00007FF791614000-memory.dmp

Download

memory/4956-48-0x00007FF7912C0000-0x00007FF791614000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads