cobaltstrike | 07245cb7f4a409309c84aa9fcf4d61b34d2fe99d44cec2733667be355b6c902d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240603-tkjq9ada53
SHA256 07245cb7f4a409309c84aa9fcf4d61b34d2fe99d44cec2733667be355b6c902d
MD5 9b0f43ae3f0eaac34f989936c2ce5881
SHA1 3e4b31261a9015b978059b8ebcae329aafccc8f1
SHA512 36a41ac7ea90bd0405fd9344eab186b512a3a3af775eae67ef54aa778a4c39898b601033efafb20d3cffc75841f3c18ce5968194d2f45b4068c7b44307e6ddf7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000233e8-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ed-9.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ec-12.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ee-23.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f0-33.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f2-49.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f1-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ef-28.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f3-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f4-63.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f5-72.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233e9-57.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-78.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-82.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-84.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-107.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-118.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-97.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-96.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-124.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233e8-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ed-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ec-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ee-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f0-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f2-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f1-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ef-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f3-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f4-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f5-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233e9-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4040-0-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	UPX
behavioral2/files/0x00080000000233e8-5.dat	UPX
behavioral2/files/0x00070000000233ed-9.dat	UPX
behavioral2/files/0x00070000000233ec-12.dat	UPX
behavioral2/files/0x00070000000233ee-23.dat	UPX
behavioral2/files/0x00070000000233f0-33.dat	UPX
behavioral2/memory/396-36-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	UPX
behavioral2/memory/3104-45-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	UPX
behavioral2/files/0x00070000000233f2-49.dat	UPX
behavioral2/files/0x00070000000233f1-47.dat	UPX
behavioral2/memory/4136-46-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	UPX
behavioral2/memory/1444-42-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	UPX
behavioral2/memory/1132-41-0x00007FF672600000-0x00007FF672954000-memory.dmp	UPX
behavioral2/memory/2592-32-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	UPX
behavioral2/files/0x00070000000233ef-28.dat	UPX
behavioral2/memory/4208-16-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	UPX
behavioral2/memory/2916-10-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f3-53.dat	UPX
behavioral2/memory/3372-58-0x00007FF783630000-0x00007FF783984000-memory.dmp	UPX
behavioral2/memory/2304-64-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f4-63.dat	UPX
behavioral2/files/0x00070000000233f5-72.dat	UPX
behavioral2/memory/4732-66-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	UPX
behavioral2/files/0x00080000000233e9-57.dat	UPX
behavioral2/memory/4864-74-0x00007FF750C10000-0x00007FF750F64000-memory.dmp	UPX
behavioral2/files/0x00070000000233f6-78.dat	UPX
behavioral2/files/0x00070000000233f8-82.dat	UPX
behavioral2/memory/4040-86-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-84.dat	UPX
behavioral2/memory/4024-91-0x00007FF74FF70000-0x00007FF7502C4000-memory.dmp	UPX
behavioral2/memory/2212-101-0x00007FF65F3F0000-0x00007FF65F744000-memory.dmp	UPX
behavioral2/memory/4552-100-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fc-107.dat	UPX
behavioral2/files/0x00070000000233fd-111.dat	UPX
behavioral2/memory/1132-113-0x00007FF672600000-0x00007FF672954000-memory.dmp	UPX
behavioral2/memory/3740-115-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fe-118.dat	UPX
behavioral2/memory/2000-112-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	UPX
behavioral2/memory/3264-109-0x00007FF7872B0000-0x00007FF787604000-memory.dmp	UPX
behavioral2/memory/1568-106-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp	UPX
behavioral2/files/0x00070000000233fa-97.dat	UPX
behavioral2/files/0x00070000000233fb-96.dat	UPX
behavioral2/memory/4652-120-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	UPX
behavioral2/files/0x00070000000233ff-124.dat	UPX
behavioral2/memory/3104-129-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	UPX
behavioral2/memory/4124-130-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	UPX
behavioral2/memory/4136-131-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	UPX
behavioral2/memory/3372-132-0x00007FF783630000-0x00007FF783984000-memory.dmp	UPX
behavioral2/memory/4732-133-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	UPX
behavioral2/memory/4552-134-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	UPX
behavioral2/memory/2000-135-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	UPX
behavioral2/memory/3740-136-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	UPX
behavioral2/memory/4652-137-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	UPX
behavioral2/memory/2916-138-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	UPX
behavioral2/memory/4208-139-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	UPX
behavioral2/memory/2592-140-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	UPX
behavioral2/memory/1444-141-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	UPX
behavioral2/memory/396-142-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	UPX
behavioral2/memory/1132-143-0x00007FF672600000-0x00007FF672954000-memory.dmp	UPX
behavioral2/memory/4136-144-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	UPX
behavioral2/memory/3104-145-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	UPX
behavioral2/memory/2304-146-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	UPX
behavioral2/memory/3372-147-0x00007FF783630000-0x00007FF783984000-memory.dmp	UPX
behavioral2/memory/4732-149-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4040-0-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233e8-5.dat	xmrig
behavioral2/files/0x00070000000233ed-9.dat	xmrig
behavioral2/files/0x00070000000233ec-12.dat	xmrig
behavioral2/files/0x00070000000233ee-23.dat	xmrig
behavioral2/files/0x00070000000233f0-33.dat	xmrig
behavioral2/memory/396-36-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	xmrig
behavioral2/memory/3104-45-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f2-49.dat	xmrig
behavioral2/files/0x00070000000233f1-47.dat	xmrig
behavioral2/memory/4136-46-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	xmrig
behavioral2/memory/1444-42-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	xmrig
behavioral2/memory/1132-41-0x00007FF672600000-0x00007FF672954000-memory.dmp	xmrig
behavioral2/memory/2592-32-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ef-28.dat	xmrig
behavioral2/memory/4208-16-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	xmrig
behavioral2/memory/2916-10-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-53.dat	xmrig
behavioral2/memory/3372-58-0x00007FF783630000-0x00007FF783984000-memory.dmp	xmrig
behavioral2/memory/2304-64-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-63.dat	xmrig
behavioral2/files/0x00070000000233f5-72.dat	xmrig
behavioral2/memory/4732-66-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	xmrig
behavioral2/files/0x00080000000233e9-57.dat	xmrig
behavioral2/memory/4864-74-0x00007FF750C10000-0x00007FF750F64000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f6-78.dat	xmrig
behavioral2/files/0x00070000000233f8-82.dat	xmrig
behavioral2/memory/4040-86-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-84.dat	xmrig
behavioral2/memory/4024-91-0x00007FF74FF70000-0x00007FF7502C4000-memory.dmp	xmrig
behavioral2/memory/2212-101-0x00007FF65F3F0000-0x00007FF65F744000-memory.dmp	xmrig
behavioral2/memory/4552-100-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-107.dat	xmrig
behavioral2/files/0x00070000000233fd-111.dat	xmrig
behavioral2/memory/1132-113-0x00007FF672600000-0x00007FF672954000-memory.dmp	xmrig
behavioral2/memory/3740-115-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-118.dat	xmrig
behavioral2/memory/2000-112-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	xmrig
behavioral2/memory/3264-109-0x00007FF7872B0000-0x00007FF787604000-memory.dmp	xmrig
behavioral2/memory/1568-106-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-97.dat	xmrig
behavioral2/files/0x00070000000233fb-96.dat	xmrig
behavioral2/memory/4652-120-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ff-124.dat	xmrig
behavioral2/memory/3104-129-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	xmrig
behavioral2/memory/4124-130-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	xmrig
behavioral2/memory/4136-131-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	xmrig
behavioral2/memory/3372-132-0x00007FF783630000-0x00007FF783984000-memory.dmp	xmrig
behavioral2/memory/4732-133-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	xmrig
behavioral2/memory/4552-134-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	xmrig
behavioral2/memory/2000-135-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	xmrig
behavioral2/memory/3740-136-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	xmrig
behavioral2/memory/4652-137-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	xmrig
behavioral2/memory/2916-138-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	xmrig
behavioral2/memory/4208-139-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	xmrig
behavioral2/memory/2592-140-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	xmrig
behavioral2/memory/1444-141-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	xmrig
behavioral2/memory/396-142-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	xmrig
behavioral2/memory/1132-143-0x00007FF672600000-0x00007FF672954000-memory.dmp	xmrig
behavioral2/memory/4136-144-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	xmrig
behavioral2/memory/3104-145-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	xmrig
behavioral2/memory/2304-146-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	xmrig
behavioral2/memory/3372-147-0x00007FF783630000-0x00007FF783984000-memory.dmp	xmrig
behavioral2/memory/4732-149-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2916	INqNMEJ.exe
4208	RBVKEpb.exe
2592	ELzRVHs.exe
1444	HZDvmec.exe
396	hMWzPGh.exe
1132	ZxesZSy.exe
4136	AjkoFic.exe
3104	kZLPnqw.exe
3372	CRelLqR.exe
2304	dBnPnkz.exe
4732	QqDlpWA.exe
4864	tYjPDll.exe
4024	PFhkWqL.exe
4552	kxPbVym.exe
2212	BJyLllh.exe
3264	HIspmSP.exe
1568	nQrqblO.exe
2000	ePUHmpF.exe
3740	ULlHXRr.exe
4652	LjENhTU.exe
4124	eOMAiaI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4040-0-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	upx
behavioral2/files/0x00080000000233e8-5.dat	upx
behavioral2/files/0x00070000000233ed-9.dat	upx
behavioral2/files/0x00070000000233ec-12.dat	upx
behavioral2/files/0x00070000000233ee-23.dat	upx
behavioral2/files/0x00070000000233f0-33.dat	upx
behavioral2/memory/396-36-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	upx
behavioral2/memory/3104-45-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-49.dat	upx
behavioral2/files/0x00070000000233f1-47.dat	upx
behavioral2/memory/4136-46-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	upx
behavioral2/memory/1444-42-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	upx
behavioral2/memory/1132-41-0x00007FF672600000-0x00007FF672954000-memory.dmp	upx
behavioral2/memory/2592-32-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	upx
behavioral2/files/0x00070000000233ef-28.dat	upx
behavioral2/memory/4208-16-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	upx
behavioral2/memory/2916-10-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-53.dat	upx
behavioral2/memory/3372-58-0x00007FF783630000-0x00007FF783984000-memory.dmp	upx
behavioral2/memory/2304-64-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-63.dat	upx
behavioral2/files/0x00070000000233f5-72.dat	upx
behavioral2/memory/4732-66-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	upx
behavioral2/files/0x00080000000233e9-57.dat	upx
behavioral2/memory/4864-74-0x00007FF750C10000-0x00007FF750F64000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-78.dat	upx
behavioral2/files/0x00070000000233f8-82.dat	upx
behavioral2/memory/4040-86-0x00007FF792550000-0x00007FF7928A4000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-84.dat	upx
behavioral2/memory/4024-91-0x00007FF74FF70000-0x00007FF7502C4000-memory.dmp	upx
behavioral2/memory/2212-101-0x00007FF65F3F0000-0x00007FF65F744000-memory.dmp	upx
behavioral2/memory/4552-100-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-107.dat	upx
behavioral2/files/0x00070000000233fd-111.dat	upx
behavioral2/memory/1132-113-0x00007FF672600000-0x00007FF672954000-memory.dmp	upx
behavioral2/memory/3740-115-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-118.dat	upx
behavioral2/memory/2000-112-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	upx
behavioral2/memory/3264-109-0x00007FF7872B0000-0x00007FF787604000-memory.dmp	upx
behavioral2/memory/1568-106-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-97.dat	upx
behavioral2/files/0x00070000000233fb-96.dat	upx
behavioral2/memory/4652-120-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-124.dat	upx
behavioral2/memory/3104-129-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	upx
behavioral2/memory/4124-130-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp	upx
behavioral2/memory/4136-131-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	upx
behavioral2/memory/3372-132-0x00007FF783630000-0x00007FF783984000-memory.dmp	upx
behavioral2/memory/4732-133-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	upx
behavioral2/memory/4552-134-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp	upx
behavioral2/memory/2000-135-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp	upx
behavioral2/memory/3740-136-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp	upx
behavioral2/memory/4652-137-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp	upx
behavioral2/memory/2916-138-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp	upx
behavioral2/memory/4208-139-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	upx
behavioral2/memory/2592-140-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp	upx
behavioral2/memory/1444-141-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp	upx
behavioral2/memory/396-142-0x00007FF6954C0000-0x00007FF695814000-memory.dmp	upx
behavioral2/memory/1132-143-0x00007FF672600000-0x00007FF672954000-memory.dmp	upx
behavioral2/memory/4136-144-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp	upx
behavioral2/memory/3104-145-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp	upx
behavioral2/memory/2304-146-0x00007FF701860000-0x00007FF701BB4000-memory.dmp	upx
behavioral2/memory/3372-147-0x00007FF783630000-0x00007FF783984000-memory.dmp	upx
behavioral2/memory/4732-149-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\AjkoFic.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kZLPnqw.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CRelLqR.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dBnPnkz.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\INqNMEJ.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ELzRVHs.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HZDvmec.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hMWzPGh.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PFhkWqL.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nQrqblO.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ePUHmpF.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RBVKEpb.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kxPbVym.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BJyLllh.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eOMAiaI.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZxesZSy.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tYjPDll.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HIspmSP.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ULlHXRr.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QqDlpWA.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LjENhTU.exe	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2916	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	84
PID 4040 wrote to memory of 2916	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	84
PID 4040 wrote to memory of 4208	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	85
PID 4040 wrote to memory of 4208	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	85
PID 4040 wrote to memory of 2592	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	86
PID 4040 wrote to memory of 2592	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	86
PID 4040 wrote to memory of 1444	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	87
PID 4040 wrote to memory of 1444	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	87
PID 4040 wrote to memory of 396	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	88
PID 4040 wrote to memory of 396	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	88
PID 4040 wrote to memory of 1132	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	89
PID 4040 wrote to memory of 1132	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	89
PID 4040 wrote to memory of 4136	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	90
PID 4040 wrote to memory of 4136	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	90
PID 4040 wrote to memory of 3104	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	91
PID 4040 wrote to memory of 3104	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	91
PID 4040 wrote to memory of 3372	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	92
PID 4040 wrote to memory of 3372	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	92
PID 4040 wrote to memory of 2304	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	93
PID 4040 wrote to memory of 2304	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	93
PID 4040 wrote to memory of 4732	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	94
PID 4040 wrote to memory of 4732	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	94
PID 4040 wrote to memory of 4864	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	95
PID 4040 wrote to memory of 4864	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	95
PID 4040 wrote to memory of 4024	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	96
PID 4040 wrote to memory of 4024	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	96
PID 4040 wrote to memory of 4552	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	97
PID 4040 wrote to memory of 4552	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	97
PID 4040 wrote to memory of 2212	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	98
PID 4040 wrote to memory of 2212	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	98
PID 4040 wrote to memory of 3264	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	99
PID 4040 wrote to memory of 3264	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	99
PID 4040 wrote to memory of 1568	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	100
PID 4040 wrote to memory of 1568	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	100
PID 4040 wrote to memory of 2000	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	101
PID 4040 wrote to memory of 2000	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	101
PID 4040 wrote to memory of 3740	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	102
PID 4040 wrote to memory of 3740	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	102
PID 4040 wrote to memory of 4652	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	104
PID 4040 wrote to memory of 4652	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	104
PID 4040 wrote to memory of 4124	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	105
PID 4040 wrote to memory of 4124	4040	2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_9b0f43ae3f0eaac34f989936c2ce5881_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\System\INqNMEJ.exe
  C:\Windows\System\INqNMEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RBVKEpb.exe
  C:\Windows\System\RBVKEpb.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\ELzRVHs.exe
  C:\Windows\System\ELzRVHs.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\HZDvmec.exe
  C:\Windows\System\HZDvmec.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hMWzPGh.exe
  C:\Windows\System\hMWzPGh.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\ZxesZSy.exe
  C:\Windows\System\ZxesZSy.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\AjkoFic.exe
  C:\Windows\System\AjkoFic.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\kZLPnqw.exe
  C:\Windows\System\kZLPnqw.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\CRelLqR.exe
  C:\Windows\System\CRelLqR.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\dBnPnkz.exe
  C:\Windows\System\dBnPnkz.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\QqDlpWA.exe
  C:\Windows\System\QqDlpWA.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\tYjPDll.exe
  C:\Windows\System\tYjPDll.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\PFhkWqL.exe
  C:\Windows\System\PFhkWqL.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\kxPbVym.exe
  C:\Windows\System\kxPbVym.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\BJyLllh.exe
  C:\Windows\System\BJyLllh.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\HIspmSP.exe
  C:\Windows\System\HIspmSP.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\nQrqblO.exe
  C:\Windows\System\nQrqblO.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ePUHmpF.exe
  C:\Windows\System\ePUHmpF.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ULlHXRr.exe
  C:\Windows\System\ULlHXRr.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\LjENhTU.exe
  C:\Windows\System\LjENhTU.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\eOMAiaI.exe
  C:\Windows\System\eOMAiaI.exe
  2⤵
  - Executes dropped EXE
  PID:4124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AjkoFic.exe

Path C:\Windows\System\AjkoFic.exe
Size 5.9MB
SHA256 4dad67c2e21b8ce74d98f1b2b88177de7124e13b870bf74d86601b4f1a3fc9f2
MD5 7751bea8918c91a97bcd12ae5b7229cf
SHA1 28a349232bdac583fee4825ccefd7aec9daad683
SHA512 8b24f1d08fb743d4cb1fb866041402f2a254b5ec5bc91c8bc1966f70b2c0ebdd66f1543452b4d22081e83fed2ca2b8402ec99e7c8df59882d22c95a50326ecb2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BJyLllh.exe

Path C:\Windows\System\BJyLllh.exe
Size 5.9MB
SHA256 127cf72ee23a8502afcdbdee3fcca9e1257a07900130e787df9a4c8826b0aeaa
MD5 94ffd685ab3ccdc4130247c767b3ddb7
SHA1 68c34034ead981ac043af1751909ee8021153dd8
SHA512 f8322ed0fc5f602cbc14a345173ea6a2ce51c8b83f72858387a14dab0f617abaed2cb0e19d552be4ddf4c70ebb0f24e246e84f6a8e13c1b4e8ea421c62f9f41f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

CRelLqR.exe

Path C:\Windows\System\CRelLqR.exe
Size 5.9MB
SHA256 436d69cd991fbb4f26b11b9f1e59970052bbf430aff929254ae0de76b76422e6
MD5 428fd70072e463877da75c500e1142e8
SHA1 527f120a93d0d8270f742b04f863e7af8bb4114e
SHA512 47bbba99b5fb64e80979f9020b371872249625bffa433848a092e4a2ea1b6a60d5e70fd7f1f55a44ff69adfbd3ec42d902226b6a141adf8684097953acb6aef6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ELzRVHs.exe

Path C:\Windows\System\ELzRVHs.exe
Size 5.9MB
SHA256 e3749a7a9796e51ec7b466ad1d6daa79d8196aa02770200f28229d546108ab53
MD5 d5725f7eaee8aa657d41107aa41ca4f9
SHA1 589442db95f7371dce9fa25b769bb8b1652fda7c
SHA512 83c8a5aafb5c7ed22caba71354915f239c99169046aa7e40cccece1afb780e266657cbbede6ee27625ea8b0213f101d1fe122bc9690040d4c79c1065161cf0e0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

HIspmSP.exe

Path C:\Windows\System\HIspmSP.exe
Size 5.9MB
SHA256 5f19b92c12f8d3c8d3a1c64a6e6337847ea1f3d6af529594c0f66c6a571416f3
MD5 cb656a1e78f583ab0a52eae255d8995e
SHA1 a48b439c8f2cf703ef3d752ec57e126d0a1da67c
SHA512 d5b985c05b8a035422aff5d7163f3c9bd10e2d7a59887d61c777f2349f916b1cc77743ecf0ba4926714a19515f5537d6eeac5bf8192d912c4680ed5964dee584
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

HZDvmec.exe

Path C:\Windows\System\HZDvmec.exe
Size 5.9MB
SHA256 54c274908f69e1569c504ece610c235c088df97c580f06d43371970934c70ab4
MD5 4db7308598e661f0f6c7871e408ae181
SHA1 de07760b03807a3fa28528e73b754dd31f430409
SHA512 2ca6958d9efe75a99a58f7c5e160f7a8164d940e1a984c67f960231b680ab8c2eb5357f6078c07d099f6a090b6af0a104a1e0ce0ca020e884faf487502804009
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

INqNMEJ.exe

Path C:\Windows\System\INqNMEJ.exe
Size 5.9MB
SHA256 4db0771a043aba681d4aec434a69382d2c555ee5f9a4b435cd16d0a521723468
MD5 f8336a1845418275da8a5115d31a3efb
SHA1 4541e980160fa75650458d0c83fe4aa5a492a237
SHA512 c18b44b0ce83fb78738bc6fa6870bcf318baf95f8bd847d57c417c06daa173997b074c70b4d04f696d36bbd46fd68388ccecd5907a128e1df54dc34e0e3d9329
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjENhTU.exe

Path C:\Windows\System\LjENhTU.exe
Size 5.9MB
SHA256 f51efbb89167ec1de1c85995a72eef41f6168327a381f2c5fd8b8a4c7aad686b
MD5 1474f464db5becba67f2285e88bcb43f
SHA1 ebb3b9bfab4eb616778d0f6b0f4a93e0fa771512
SHA512 e7af7552b784ce74af2b5c5d6f3676556b7e930b9a03f7e160c779982f632801753d179376125d967287acede93006f94e9a601f680e67a30c9a69fd3103bd54
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

PFhkWqL.exe

Path C:\Windows\System\PFhkWqL.exe
Size 5.9MB
SHA256 acdc6a2adc4628b33d2cfa07385ee81699a66809bce5ce5dfd44303e405d3d97
MD5 dce7809fd61395b456dcfa3a71555a6b
SHA1 11ad0e19234254992ab209ea82dd5c33e1b8d023
SHA512 80f32d67c8ab3db429c7acbc353b4c5d07378dd6a61ee4e40a622cc647a5ad7f6fe069a0473a0d879d8c0726370783349293902cf1a634736b5b40c131101012
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqDlpWA.exe

Path C:\Windows\System\QqDlpWA.exe
Size 5.9MB
SHA256 8fef7336fa04d03d2754e077b0666fce0bd58a4332ab9be0bf02240fc96b58ea
MD5 f361de0f4ddfca8838551f6d376454da
SHA1 4ac262c3eb333a723f9036c7254aaa8bc739df8f
SHA512 677fbbac7a8af99a34cd51c0bd76337feb1108f441797028bec26ffec04e0b2c849b5915528218017427c192edd5d5405849277ba99d221d3df475a81ffba764
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

RBVKEpb.exe

Path C:\Windows\System\RBVKEpb.exe
Size 5.9MB
SHA256 4c63d9209be65a380fef2c63082cd086d1b11f4c041fa986857bdb4589d9d3d8
MD5 72ee24f292363d372afaae183a5a85c7
SHA1 0c235c839b15577cc5ce469ee4ca945b9f02f430
SHA512 0b145820adca9d5f0889836b7356b8592350f6644b911c45c584dfffb0113ae43edb3405d10b1e14d869a42b8a8cc382a5b85426ebcd18e90e9537aa6caca1f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULlHXRr.exe

Path C:\Windows\System\ULlHXRr.exe
Size 5.9MB
SHA256 3bc58255bf918e3c0b1cdc2dd6a9ef0026d3faf6e181567b4e854d84d2659e98
MD5 e828523f1ed94f8e9b25cc19da9d9d69
SHA1 a61d1d4eb7a83454845d476e586765eabda7679a
SHA512 76bec363458a2eca5775e0f9b29b27f714b928435a0e8492462b0ab8d82e73c506a3e7643d60dd47528ba19f8839ebec9fd9e484fdba2b61db63eace4d6ef372
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxesZSy.exe

Path C:\Windows\System\ZxesZSy.exe
Size 5.9MB
SHA256 c117b5ee1a15ee77ec11c1f8543dd5e3cde87360324f4b7c3472d35f6e432fc9
MD5 47608eeb16933997817c659884e19f59
SHA1 ffbfa8654adc24e133aa87a699332a0e18f24f7e
SHA512 0253e702703ee027f89c2e210eacbd816e60c97caa1426d10fb2c2d528d8dc171ecd9288197a7c956a2290ec7ac9fefc1d311c0d117efea61b443709e4040a17
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

dBnPnkz.exe

Path C:\Windows\System\dBnPnkz.exe
Size 5.9MB
SHA256 fc401703adac2d7a55ebf63dd80c3604efa0a1566c932171ff33c62c08a52a48
MD5 5ef97f3ad5d3b6ad019542b3741920d5
SHA1 524af1d2121f1f66717ef68a179a84ea56fb808f
SHA512 34a67df9404e8ab823ce0d15099c783596b94423113b38041370a9437e06abcd2b52bc4d26ed1676d447e6742d8fad82fedc7b56dfe289aa8d2357cda170b09e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

eOMAiaI.exe

Path C:\Windows\System\eOMAiaI.exe
Size 5.9MB
SHA256 fa4abbfe9f8cc2fe4421cea6174f9c741352d933925f9b9d65f969e1b83d28fc
MD5 f3e32a369ce0994d31313e271944a776
SHA1 998bd558290a3ca57434832c1bf10675a33e72b4
SHA512 3029812190d28def2df503d2cc8ecf144cbc8393725846cfa5be4972d17dd1e390200b3317fbe9532ea2e1c37c43727b69052dd0101561138e1c0b055cbe9f47
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ePUHmpF.exe

Path C:\Windows\System\ePUHmpF.exe
Size 5.9MB
SHA256 e599eea239c12260ba7040ec0dc0b80a2f7cbe251a683a039dd8c338e820f730
MD5 cf125ce69d62fd0874df03807935df9c
SHA1 816adc63c6acedcc47e0379734a3c3a6afa5ecb8
SHA512 643f388ea00eefdc3d735cf942b8264d95ecf24deb010c51ee077a6a9e0d0aee3aed5a7e0ee6951a57d47a5d2b8100d60083ac9324e5965d477f8a269f8ddae7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

hMWzPGh.exe

Path C:\Windows\System\hMWzPGh.exe
Size 5.9MB
SHA256 dfcf7e1c826fd7b8c07b8a16f39be97e2c01bbbeb0401f13f970e3e32a93a36b
MD5 0997b1f29a3d0c2f860ece669d3af93e
SHA1 18b7ae93410c7ce7f14c71ad16d16930c3dc2e98
SHA512 98d830bc6660cff158363d9733cb667d1d51de7b459511209ce15f5fdf240b767346a0e41b50277be4efe8a537c97db491902e0ef0e9c72214f36471935689c8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

kZLPnqw.exe

Path C:\Windows\System\kZLPnqw.exe
Size 5.9MB
SHA256 a7f14f20bc035a40e4f5fe1de912e7d7c8a888b7be224fca2f32be8d31b0a737
MD5 d37ac0c067af2e42f2601ad5a10e8dac
SHA1 6e734b23d6eb1615456a42097caf949ebfcb4158
SHA512 f8090bb52e44f9bb3978e4bf2f5eb0ae5a377a3455bda0e990649b1b9ecebc36a281d333ead33930808e5b6ad80e36b2b2c71f36b200fa6600737a496c328a70
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

kxPbVym.exe

Path C:\Windows\System\kxPbVym.exe
Size 5.9MB
SHA256 58a7810f502400d89dd554d38fdaba8da50707fd57d5a6c823cdb88ee2075d19
MD5 d456f373ce912da17d4618ecb6473190
SHA1 bbf1e27b56ba5cba8a07e4ef1dc8ed1cb9f73414
SHA512 65b2f31b8fb8f83491814393271eb06fff27a3c9aaf240445a37136b1d7de1c8fdcf46e0ef6fce655323c8f23d7bc2db4b38da94f1258c457c86449fb73cb459
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

nQrqblO.exe

Path C:\Windows\System\nQrqblO.exe
Size 5.9MB
SHA256 282d4e5f8b09c62d2e1ff87447d974638dafb9a939883bdfc9302780ca49ebf0
MD5 0b6eef95e9f6afceb2c9ff9fe04489bf
SHA1 5011abb481a835b1749fb9446adc8266c039d1d3
SHA512 d28a6aaea2503514efe0d66e47717d2bc5b5206c6fbbc0c6285b199596743bc4eabd234f5f2dfb96bbcd40fbf93ef77c1d8ccf5f99889ad73d18f1f80ca96523
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

tYjPDll.exe

Path C:\Windows\System\tYjPDll.exe
Size 5.9MB
SHA256 e1cc2b23ec190ad733429f0bf5f6bbd786641d6fa418a5c184442d32ca713e81
MD5 6558e87b7d0c931eec7e193dbefa3fb1
SHA1 8b85320b378c694aa8332a91775ed41873d1e94e
SHA512 6c20c55755a7d6068efa684c989afb91ee0327ae04c6a07784402df514aa8ce7b3ef54850d348952b84c372ed9cd3e5de3e017376f928f838f95d026ca2b79cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-142-0x00007FF6954C0000-0x00007FF695814000-memory.dmp

Download

memory/396-36-0x00007FF6954C0000-0x00007FF695814000-memory.dmp

Download

memory/1132-113-0x00007FF672600000-0x00007FF672954000-memory.dmp

Download

memory/1132-143-0x00007FF672600000-0x00007FF672954000-memory.dmp

Download

memory/1132-41-0x00007FF672600000-0x00007FF672954000-memory.dmp

Download

memory/1444-42-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp

Download

memory/1444-141-0x00007FF78A2B0000-0x00007FF78A604000-memory.dmp

Download

memory/1568-106-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp

Download

memory/1568-154-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp

Download

memory/2000-135-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp

Download

memory/2000-155-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp

Download

memory/2000-112-0x00007FF7F25C0000-0x00007FF7F2914000-memory.dmp

Download

memory/2212-151-0x00007FF65F3F0000-0x00007FF65F744000-memory.dmp

Download

memory/2212-101-0x00007FF65F3F0000-0x00007FF65F744000-memory.dmp

Download

memory/2304-146-0x00007FF701860000-0x00007FF701BB4000-memory.dmp

Download

memory/2304-64-0x00007FF701860000-0x00007FF701BB4000-memory.dmp

Download

memory/2592-140-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp

Download

memory/2592-32-0x00007FF723F80000-0x00007FF7242D4000-memory.dmp

Download

memory/2916-10-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp

Download

memory/2916-138-0x00007FF7C8DA0000-0x00007FF7C90F4000-memory.dmp

Download

memory/3104-145-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp

Download

memory/3104-45-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp

Download

memory/3104-129-0x00007FF6B9CF0000-0x00007FF6BA044000-memory.dmp

Download

memory/3264-109-0x00007FF7872B0000-0x00007FF787604000-memory.dmp

Download

memory/3264-152-0x00007FF7872B0000-0x00007FF787604000-memory.dmp

Download

memory/3372-132-0x00007FF783630000-0x00007FF783984000-memory.dmp

Download

memory/3372-58-0x00007FF783630000-0x00007FF783984000-memory.dmp

Download

memory/3372-147-0x00007FF783630000-0x00007FF783984000-memory.dmp

Download

memory/3740-156-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp

Download

memory/3740-136-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp

Download

memory/3740-115-0x00007FF7EF460000-0x00007FF7EF7B4000-memory.dmp

Download

memory/4024-150-0x00007FF74FF70000-0x00007FF7502C4000-memory.dmp

Download

memory/4024-91-0x00007FF74FF70000-0x00007FF7502C4000-memory.dmp

Download

memory/4040-1-0x0000022D19690000-0x0000022D196A0000-memory.dmp

Download

memory/4040-86-0x00007FF792550000-0x00007FF7928A4000-memory.dmp

Download

memory/4040-0-0x00007FF792550000-0x00007FF7928A4000-memory.dmp

Download

memory/4124-158-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp

Download

memory/4124-130-0x00007FF7B1E60000-0x00007FF7B21B4000-memory.dmp

Download

memory/4136-144-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp

Download

memory/4136-131-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp

Download

memory/4136-46-0x00007FF6448D0000-0x00007FF644C24000-memory.dmp

Download

memory/4208-139-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp

Download

memory/4208-16-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp

Download

memory/4552-100-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp

Download

memory/4552-134-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp

Download

memory/4552-153-0x00007FF66AB50000-0x00007FF66AEA4000-memory.dmp

Download

memory/4652-157-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp

Download

memory/4652-137-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp

Download

memory/4652-120-0x00007FF6FAFE0000-0x00007FF6FB334000-memory.dmp

Download

memory/4732-149-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp

Download

memory/4732-66-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp

Download

memory/4732-133-0x00007FF7957E0000-0x00007FF795B34000-memory.dmp

Download

memory/4864-148-0x00007FF750C10000-0x00007FF750F64000-memory.dmp

Download

memory/4864-74-0x00007FF750C10000-0x00007FF750F64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads