cobaltstrike | 4105b92740cadfe5fd32b5ec6a3e60657866dbdeb37e435b4e1131fe39e0ef77

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240608-nxnyvabc91
SHA256 4105b92740cadfe5fd32b5ec6a3e60657866dbdeb37e435b4e1131fe39e0ef77
MD5 36ba5fe81c4fe4653201f9b80c9ff6a3
SHA1 12d6d5def54881798a3e15f06e6cd731fc889de7
SHA512 d9028059796c638b2b484c79bed53e29761793f947d94e0fb4e47038616df434003d6df3d62130e0308a5255073352e869877a35343752b819e98302eed0793a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002327c-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023413-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-80.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023370-98.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023371-105.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229cb-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-120.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-132.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023372-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-87.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002327c-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023413-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023370-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023371-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229cb-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-132.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023372-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3388-0-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	UPX
behavioral2/files/0x000600000002327c-4.dat	UPX
behavioral2/files/0x0008000000023413-10.dat	UPX
behavioral2/files/0x0007000000023417-11.dat	UPX
behavioral2/memory/4932-13-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	UPX
behavioral2/memory/4892-20-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	UPX
behavioral2/memory/1496-7-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-24.dat	UPX
behavioral2/memory/4028-26-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-29.dat	UPX
behavioral2/memory/3704-32-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-34.dat	UPX
behavioral2/files/0x000700000002341c-42.dat	UPX
behavioral2/files/0x000700000002341d-46.dat	UPX
behavioral2/memory/3448-48-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	UPX
behavioral2/memory/2612-44-0x00007FF640020000-0x00007FF640374000-memory.dmp	UPX
behavioral2/memory/4124-38-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-52.dat	UPX
behavioral2/memory/4876-56-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-59.dat	UPX
behavioral2/files/0x0007000000023421-71.dat	UPX
behavioral2/files/0x0007000000023420-73.dat	UPX
behavioral2/memory/3992-68-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	UPX
behavioral2/memory/1496-67-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	UPX
behavioral2/memory/3388-62-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	UPX
behavioral2/memory/5040-77-0x00007FF64F4B0000-0x00007FF64F804000-memory.dmp	UPX
behavioral2/files/0x0007000000023422-80.dat	UPX
behavioral2/memory/4932-76-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	UPX
behavioral2/memory/2864-63-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	UPX
behavioral2/memory/4388-82-0x00007FF6F4B50000-0x00007FF6F4EA4000-memory.dmp	UPX
behavioral2/files/0x000b000000023370-98.dat	UPX
behavioral2/files/0x000b000000023371-105.dat	UPX
behavioral2/memory/3828-104-0x00007FF712F20000-0x00007FF713274000-memory.dmp	UPX
behavioral2/memory/4136-100-0x00007FF6730E0000-0x00007FF673434000-memory.dmp	UPX
behavioral2/files/0x00030000000229cb-93.dat	UPX
behavioral2/files/0x0007000000023424-115.dat	UPX
behavioral2/files/0x0007000000023425-120.dat	UPX
behavioral2/memory/4060-121-0x00007FF679840000-0x00007FF679B94000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-132.dat	UPX
behavioral2/memory/3448-131-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	UPX
behavioral2/memory/2128-128-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	UPX
behavioral2/memory/1404-127-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	UPX
behavioral2/memory/2612-126-0x00007FF640020000-0x00007FF640374000-memory.dmp	UPX
behavioral2/memory/4052-124-0x00007FF620AF0000-0x00007FF620E44000-memory.dmp	UPX
behavioral2/memory/3804-123-0x00007FF71B5D0000-0x00007FF71B924000-memory.dmp	UPX
behavioral2/memory/4124-119-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	UPX
behavioral2/files/0x000a000000023372-110.dat	UPX
behavioral2/memory/2212-88-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-87.dat	UPX
behavioral2/memory/4876-134-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	UPX
behavioral2/memory/3992-135-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	UPX
behavioral2/memory/2212-136-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	UPX
behavioral2/memory/1404-137-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	UPX
behavioral2/memory/2128-138-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	UPX
behavioral2/memory/1496-139-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	UPX
behavioral2/memory/4932-140-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	UPX
behavioral2/memory/4892-141-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	UPX
behavioral2/memory/4028-142-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	UPX
behavioral2/memory/3704-143-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	UPX
behavioral2/memory/4124-144-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	UPX
behavioral2/memory/2612-145-0x00007FF640020000-0x00007FF640374000-memory.dmp	UPX
behavioral2/memory/3448-146-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	UPX
behavioral2/memory/4876-147-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	UPX
behavioral2/memory/2864-148-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3388-0-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	xmrig
behavioral2/files/0x000600000002327c-4.dat	xmrig
behavioral2/files/0x0008000000023413-10.dat	xmrig
behavioral2/files/0x0007000000023417-11.dat	xmrig
behavioral2/memory/4932-13-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	xmrig
behavioral2/memory/4892-20-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	xmrig
behavioral2/memory/1496-7-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-24.dat	xmrig
behavioral2/memory/4028-26-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-29.dat	xmrig
behavioral2/memory/3704-32-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-34.dat	xmrig
behavioral2/files/0x000700000002341c-42.dat	xmrig
behavioral2/files/0x000700000002341d-46.dat	xmrig
behavioral2/memory/3448-48-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	xmrig
behavioral2/memory/2612-44-0x00007FF640020000-0x00007FF640374000-memory.dmp	xmrig
behavioral2/memory/4124-38-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-52.dat	xmrig
behavioral2/memory/4876-56-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-59.dat	xmrig
behavioral2/files/0x0007000000023421-71.dat	xmrig
behavioral2/files/0x0007000000023420-73.dat	xmrig
behavioral2/memory/3992-68-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	xmrig
behavioral2/memory/1496-67-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	xmrig
behavioral2/memory/3388-62-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	xmrig
behavioral2/memory/5040-77-0x00007FF64F4B0000-0x00007FF64F804000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-80.dat	xmrig
behavioral2/memory/4932-76-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	xmrig
behavioral2/memory/2864-63-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	xmrig
behavioral2/memory/4388-82-0x00007FF6F4B50000-0x00007FF6F4EA4000-memory.dmp	xmrig
behavioral2/files/0x000b000000023370-98.dat	xmrig
behavioral2/files/0x000b000000023371-105.dat	xmrig
behavioral2/memory/3828-104-0x00007FF712F20000-0x00007FF713274000-memory.dmp	xmrig
behavioral2/memory/4136-100-0x00007FF6730E0000-0x00007FF673434000-memory.dmp	xmrig
behavioral2/files/0x00030000000229cb-93.dat	xmrig
behavioral2/files/0x0007000000023424-115.dat	xmrig
behavioral2/files/0x0007000000023425-120.dat	xmrig
behavioral2/memory/4060-121-0x00007FF679840000-0x00007FF679B94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-132.dat	xmrig
behavioral2/memory/3448-131-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	xmrig
behavioral2/memory/2128-128-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	xmrig
behavioral2/memory/1404-127-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	xmrig
behavioral2/memory/2612-126-0x00007FF640020000-0x00007FF640374000-memory.dmp	xmrig
behavioral2/memory/4052-124-0x00007FF620AF0000-0x00007FF620E44000-memory.dmp	xmrig
behavioral2/memory/3804-123-0x00007FF71B5D0000-0x00007FF71B924000-memory.dmp	xmrig
behavioral2/memory/4124-119-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	xmrig
behavioral2/files/0x000a000000023372-110.dat	xmrig
behavioral2/memory/2212-88-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-87.dat	xmrig
behavioral2/memory/4876-134-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	xmrig
behavioral2/memory/3992-135-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	xmrig
behavioral2/memory/2212-136-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	xmrig
behavioral2/memory/1404-137-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	xmrig
behavioral2/memory/2128-138-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	xmrig
behavioral2/memory/1496-139-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	xmrig
behavioral2/memory/4932-140-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	xmrig
behavioral2/memory/4892-141-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	xmrig
behavioral2/memory/4028-142-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	xmrig
behavioral2/memory/3704-143-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	xmrig
behavioral2/memory/4124-144-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	xmrig
behavioral2/memory/2612-145-0x00007FF640020000-0x00007FF640374000-memory.dmp	xmrig
behavioral2/memory/3448-146-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	xmrig
behavioral2/memory/4876-147-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	xmrig
behavioral2/memory/2864-148-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1496	uZizoXj.exe
4932	NSyPjId.exe
4892	ZmzjUQN.exe
4028	MNaTPAC.exe
3704	diJlrja.exe
4124	kfSJuDL.exe
2612	AhYCWmN.exe
3448	WRyIoOf.exe
4876	gHYwkcs.exe
2864	vrNcwdD.exe
3992	iMHEwjl.exe
5040	YvGlNNl.exe
4388	YUJxzWn.exe
2212	EwEfmJC.exe
4136	sXRaHPD.exe
3828	qNBJbIq.exe
3804	BIzbhrF.exe
4052	GQmUNEY.exe
4060	hkrPyqm.exe
1404	BCrvnEU.exe
2128	UYFdvcb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3388-0-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	upx
behavioral2/files/0x000600000002327c-4.dat	upx
behavioral2/files/0x0008000000023413-10.dat	upx
behavioral2/files/0x0007000000023417-11.dat	upx
behavioral2/memory/4932-13-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	upx
behavioral2/memory/4892-20-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	upx
behavioral2/memory/1496-7-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	upx
behavioral2/files/0x0007000000023418-24.dat	upx
behavioral2/memory/4028-26-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	upx
behavioral2/files/0x000700000002341a-29.dat	upx
behavioral2/memory/3704-32-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	upx
behavioral2/files/0x000700000002341b-34.dat	upx
behavioral2/files/0x000700000002341c-42.dat	upx
behavioral2/files/0x000700000002341d-46.dat	upx
behavioral2/memory/3448-48-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	upx
behavioral2/memory/2612-44-0x00007FF640020000-0x00007FF640374000-memory.dmp	upx
behavioral2/memory/4124-38-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	upx
behavioral2/files/0x000700000002341e-52.dat	upx
behavioral2/memory/4876-56-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	upx
behavioral2/files/0x000700000002341f-59.dat	upx
behavioral2/files/0x0007000000023421-71.dat	upx
behavioral2/files/0x0007000000023420-73.dat	upx
behavioral2/memory/3992-68-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	upx
behavioral2/memory/1496-67-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	upx
behavioral2/memory/3388-62-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp	upx
behavioral2/memory/5040-77-0x00007FF64F4B0000-0x00007FF64F804000-memory.dmp	upx
behavioral2/files/0x0007000000023422-80.dat	upx
behavioral2/memory/4932-76-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	upx
behavioral2/memory/2864-63-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	upx
behavioral2/memory/4388-82-0x00007FF6F4B50000-0x00007FF6F4EA4000-memory.dmp	upx
behavioral2/files/0x000b000000023370-98.dat	upx
behavioral2/files/0x000b000000023371-105.dat	upx
behavioral2/memory/3828-104-0x00007FF712F20000-0x00007FF713274000-memory.dmp	upx
behavioral2/memory/4136-100-0x00007FF6730E0000-0x00007FF673434000-memory.dmp	upx
behavioral2/files/0x00030000000229cb-93.dat	upx
behavioral2/files/0x0007000000023424-115.dat	upx
behavioral2/files/0x0007000000023425-120.dat	upx
behavioral2/memory/4060-121-0x00007FF679840000-0x00007FF679B94000-memory.dmp	upx
behavioral2/files/0x0007000000023426-132.dat	upx
behavioral2/memory/3448-131-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	upx
behavioral2/memory/2128-128-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	upx
behavioral2/memory/1404-127-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	upx
behavioral2/memory/2612-126-0x00007FF640020000-0x00007FF640374000-memory.dmp	upx
behavioral2/memory/4052-124-0x00007FF620AF0000-0x00007FF620E44000-memory.dmp	upx
behavioral2/memory/3804-123-0x00007FF71B5D0000-0x00007FF71B924000-memory.dmp	upx
behavioral2/memory/4124-119-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	upx
behavioral2/files/0x000a000000023372-110.dat	upx
behavioral2/memory/2212-88-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	upx
behavioral2/files/0x0007000000023423-87.dat	upx
behavioral2/memory/4876-134-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	upx
behavioral2/memory/3992-135-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp	upx
behavioral2/memory/2212-136-0x00007FF613A00000-0x00007FF613D54000-memory.dmp	upx
behavioral2/memory/1404-137-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp	upx
behavioral2/memory/2128-138-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp	upx
behavioral2/memory/1496-139-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp	upx
behavioral2/memory/4932-140-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp	upx
behavioral2/memory/4892-141-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp	upx
behavioral2/memory/4028-142-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp	upx
behavioral2/memory/3704-143-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp	upx
behavioral2/memory/4124-144-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp	upx
behavioral2/memory/2612-145-0x00007FF640020000-0x00007FF640374000-memory.dmp	upx
behavioral2/memory/3448-146-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp	upx
behavioral2/memory/4876-147-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp	upx
behavioral2/memory/2864-148-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\BCrvnEU.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AhYCWmN.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EwEfmJC.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qNBJbIq.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GQmUNEY.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hkrPyqm.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UYFdvcb.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WRyIoOf.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gHYwkcs.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YUJxzWn.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BIzbhrF.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uZizoXj.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\diJlrja.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vrNcwdD.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kfSJuDL.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iMHEwjl.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YvGlNNl.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sXRaHPD.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NSyPjId.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZmzjUQN.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MNaTPAC.exe	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1496	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	83
PID 3388 wrote to memory of 1496	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	83
PID 3388 wrote to memory of 4932	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	84
PID 3388 wrote to memory of 4932	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	84
PID 3388 wrote to memory of 4892	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	85
PID 3388 wrote to memory of 4892	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	85
PID 3388 wrote to memory of 4028	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	86
PID 3388 wrote to memory of 4028	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	86
PID 3388 wrote to memory of 3704	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	87
PID 3388 wrote to memory of 3704	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	87
PID 3388 wrote to memory of 4124	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	89
PID 3388 wrote to memory of 4124	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	89
PID 3388 wrote to memory of 2612	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	90
PID 3388 wrote to memory of 2612	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	90
PID 3388 wrote to memory of 3448	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	91
PID 3388 wrote to memory of 3448	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	91
PID 3388 wrote to memory of 4876	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	92
PID 3388 wrote to memory of 4876	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	92
PID 3388 wrote to memory of 2864	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	94
PID 3388 wrote to memory of 2864	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	94
PID 3388 wrote to memory of 3992	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	95
PID 3388 wrote to memory of 3992	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	95
PID 3388 wrote to memory of 5040	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	96
PID 3388 wrote to memory of 5040	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	96
PID 3388 wrote to memory of 4388	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	98
PID 3388 wrote to memory of 4388	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	98
PID 3388 wrote to memory of 2212	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	99
PID 3388 wrote to memory of 2212	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	99
PID 3388 wrote to memory of 4136	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	100
PID 3388 wrote to memory of 4136	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	100
PID 3388 wrote to memory of 3828	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	101
PID 3388 wrote to memory of 3828	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	101
PID 3388 wrote to memory of 3804	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	102
PID 3388 wrote to memory of 3804	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	102
PID 3388 wrote to memory of 4052	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	103
PID 3388 wrote to memory of 4052	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	103
PID 3388 wrote to memory of 4060	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	104
PID 3388 wrote to memory of 4060	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	104
PID 3388 wrote to memory of 1404	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	105
PID 3388 wrote to memory of 1404	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	105
PID 3388 wrote to memory of 2128	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	106
PID 3388 wrote to memory of 2128	3388	2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_36ba5fe81c4fe4653201f9b80c9ff6a3_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\System\uZizoXj.exe
  C:\Windows\System\uZizoXj.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\NSyPjId.exe
  C:\Windows\System\NSyPjId.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\ZmzjUQN.exe
  C:\Windows\System\ZmzjUQN.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\MNaTPAC.exe
  C:\Windows\System\MNaTPAC.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\diJlrja.exe
  C:\Windows\System\diJlrja.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\kfSJuDL.exe
  C:\Windows\System\kfSJuDL.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\AhYCWmN.exe
  C:\Windows\System\AhYCWmN.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\WRyIoOf.exe
  C:\Windows\System\WRyIoOf.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\gHYwkcs.exe
  C:\Windows\System\gHYwkcs.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\vrNcwdD.exe
  C:\Windows\System\vrNcwdD.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\iMHEwjl.exe
  C:\Windows\System\iMHEwjl.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\YvGlNNl.exe
  C:\Windows\System\YvGlNNl.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\YUJxzWn.exe
  C:\Windows\System\YUJxzWn.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\EwEfmJC.exe
  C:\Windows\System\EwEfmJC.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\sXRaHPD.exe
  C:\Windows\System\sXRaHPD.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\qNBJbIq.exe
  C:\Windows\System\qNBJbIq.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\BIzbhrF.exe
  C:\Windows\System\BIzbhrF.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\GQmUNEY.exe
  C:\Windows\System\GQmUNEY.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\hkrPyqm.exe
  C:\Windows\System\hkrPyqm.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\BCrvnEU.exe
  C:\Windows\System\BCrvnEU.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\UYFdvcb.exe
  C:\Windows\System\UYFdvcb.exe
  2⤵
  - Executes dropped EXE
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhYCWmN.exe

Path C:\Windows\System\AhYCWmN.exe
Size 5.9MB
SHA256 b90ac0b33cb787199292aa4a9d32dee3e58ce7fb533811ed2531311abc4939c7
MD5 862e900c1b25636012ad2f78bdd3f4b2
SHA1 15e1b8fd3eeec0cdb4fca8b845302c7b75c2ea0b
SHA512 844c640e8118f33c64aa16a0acecedb53861542aa35fbcc1ae2eaab0656b947e4e187d55442913d0867875ccdeafc4ee092223d61f6936e31358d84e9c742210
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCrvnEU.exe

Path C:\Windows\System\BCrvnEU.exe
Size 5.9MB
SHA256 0f7bcb05651d652e21144d28225396b7cda8146ccac7f43910bc5b363f10c2e6
MD5 253023b8ee22aee07c6a1da63033f034
SHA1 6471d6d1cba8f498fb76e9f4f5ebd926c77c68c0
SHA512 2e67b6687a26458f25494cb0e2318040cdb7932b65c22fe7ba4683360b226b4bb235caa7fc5d177893bb0ad95aa2dc7e065ccdd57f793dffec818561fe9b0267
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

BIzbhrF.exe

Path C:\Windows\System\BIzbhrF.exe
Size 5.9MB
SHA256 f61a3bd365a723c05605ffd422a82efdf9a35a7715b4b43d1cb60e908cf22db8
MD5 d79bd3df55034f117054e5a1579e6bba
SHA1 7069e44868fe664f10fb971e0f7f3aa6046d66ec
SHA512 99c113cdec8d63503853b29d438ceedc361ff5c7b781aa86985d89ef19bdab59443e5400c2d5779f47cd76ce8a776572e9f68f68d0e6caf3046adda2504b110e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

EwEfmJC.exe

Path C:\Windows\System\EwEfmJC.exe
Size 5.9MB
SHA256 17e9fe3b03e045d46045d8bc451d91915628eda24326ec2e68165544eaaf17e2
MD5 1e60a0fab43313e8121fb8925585a6c7
SHA1 5880c4da16333a1508a4fc7d8a7958869ace5b27
SHA512 97c443c409a381339624a978d29854d5ad96cc1fdd5364365929aee0f376fddbf74446df62061322870e4b407ecf39efcdd75b861485e5456ff908616aaf402b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

GQmUNEY.exe

Path C:\Windows\System\GQmUNEY.exe
Size 5.9MB
SHA256 c32d37f4eee64afa4c9cb33f8272d838024fb799485cc01aed47b1804f93b860
MD5 1910449748cc316d3ab047730477b85c
SHA1 99fedeee40a0c0cf7b4caaa5c25c7999dedefa0c
SHA512 09be8a0597633a9d30ac35899ed01072c8e42695ecf614cea8c9e410b086f621d537cc2eb8c9593871ca5af21a2fc046d8c9368a8eeea73e30e0931cfcb03c3e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

MNaTPAC.exe

Path C:\Windows\System\MNaTPAC.exe
Size 5.9MB
SHA256 388863ed3dcc6e44691f1fa4d42d8986f3b44ea80e36cc2a1ef9d6a053acc489
MD5 af0f8cb1db8f64a1476a5667117f3853
SHA1 73009e133dc891d38ebbd6ed843d3b8097c302f7
SHA512 14c415a48b693fef47ff5067f7e3e9353517ffe08d73fe4eaab3277345eaa6ae131051a7e6667d976c57a1587702eb6dbaeb568a71a2a6773c09bbebc645f04c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSyPjId.exe

Path C:\Windows\System\NSyPjId.exe
Size 5.9MB
SHA256 c5e301901fef459a3e38e9d11926aa3820ff0373c6a2eeb6b1db58891f4913da
MD5 a37c2967a7d2ce3bd1ac8e08f56bbe0b
SHA1 8e9737443f55fa4ca778b748058c15d4ceb2f903
SHA512 1da0d21b95e89e19f2f951a1d9fa0101f7e40753441feab20c544966301425e8257ec10ecf1ac5ceed59c5bdb6fa6c2383197d9cdb8d2c5dcc6ed400331dc7c8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

UYFdvcb.exe

Path C:\Windows\System\UYFdvcb.exe
Size 5.9MB
SHA256 6f8df4e28cffd02b38f83100dec72d26cce27765b297f9f83e04cc8ce266ddee
MD5 b602318434e96a3ab281cb4492d18afd
SHA1 a025ebef5696e7c4e7cbd5f9d58b22ed08cb3ad8
SHA512 4ac7390c12bea8c9050165917cddebd7376dcfc8836d9ea1a56dd7e25fab5b60a7a0c1f708bfb011767317a40c229a76ea3ccd3ad71a90955aad0b4761b7f05a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

WRyIoOf.exe

Path C:\Windows\System\WRyIoOf.exe
Size 5.9MB
SHA256 deb173df6f9b3d9349f960d8aa12b382753fd83e7366e1a638fb796947cdf2b9
MD5 afca3b8f3ac6b70a3848bae1d30fe686
SHA1 3ef1156a5b4e4538c921e5d49cbfa1375831dc8d
SHA512 483bb08378548f42d3951567a49ef3170b1706713db60b660276eefdeae7de5c95c906f58c99ade10f62b1e9b98d92ce0608bd3edee65216743b59ea9b4d42a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

YUJxzWn.exe

Path C:\Windows\System\YUJxzWn.exe
Size 5.9MB
SHA256 6418f46b400c850322f62fb8224a07a175944ee4e301a022a79e8dbf3040b363
MD5 332e01084ef898d0ccb067f8ac432b03
SHA1 542e0f649f215fbc8765411fd095f0d8d0ed6988
SHA512 981d7e55192fc4e59d803a86d7571c092bdc1c7aba1a1b06aaffaf2d9f0755f6a46d71622dcf040d1c8032c3effe07c7fdad247f176ecddd0ae1c68ed1f1e5ec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

YvGlNNl.exe

Path C:\Windows\System\YvGlNNl.exe
Size 5.9MB
SHA256 52cef66977bf2a272350698c94837999a27788731f802a3b1f298812110eecff
MD5 0d11dcc71760da48c47bca361144d845
SHA1 b15a9bb5d1bba9cc578c2fe7e2aba06af3b17423
SHA512 9a7d59adbf4cd8364e7d5759b840c2fb01de0fa9d769c4ebc1068dd02a76fa5d7283e0459812d2ff6d05432a3be4bb2ee7da8dc9b7013bce23f89363c79f259a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZmzjUQN.exe

Path C:\Windows\System\ZmzjUQN.exe
Size 5.9MB
SHA256 1babbde42790bee296b5cca26223e33777ccaf33f5a4ce8adba903e79180807a
MD5 0fbabe34efec1dee9567e5add3ca394b
SHA1 e128b339bf3dc1307130234f88f04d4923505b41
SHA512 1c65ccd047e9c334f88615e2c3ebe3d8e2f5c3212f4789d357b6b9197e9fac61a4d5def27b3abf0939587a003359da55ecfc0104b52371f8d3947635704e2892
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

diJlrja.exe

Path C:\Windows\System\diJlrja.exe
Size 5.9MB
SHA256 513c27e93d5e500710789935f3c491373730467df22e27385eeeca0fb2e3a03e
MD5 93509993b22e50b4caab0729a043be35
SHA1 cd017009ebd86e30711e9eed452c3463f5efde13
SHA512 0fffd5e128ab78adc62c8eed224e0f5a27308dcaec132c9f1b5098fb476a30170d9f8d336933932c9fec40325f3b6f7d389adb8d82daff3cc2bf782f8e3dbd15
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

gHYwkcs.exe

Path C:\Windows\System\gHYwkcs.exe
Size 5.9MB
SHA256 37ab1e475277750d1eff958c0fa745cb674a605e12d9fd2c7c19c514a42080e8
MD5 3240607bf7051aa5a8fcd8496f9c0edc
SHA1 7ddae819ee5952518dac95819ccbb5fedb94da1b
SHA512 36ce0af50fca08012fb6210ea9e6fb6f3072dd75a9d0d81d1b082192d8f636fbddca88daaab084e12b01aa8eb9cf273e7c0ae8e23c6699826e75d6da1666d5ed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

hkrPyqm.exe

Path C:\Windows\System\hkrPyqm.exe
Size 5.9MB
SHA256 28649351f0a114b1d999ccb7b7d5924e0a0c7780349f7b09682c5a8c34c0dcb4
MD5 520b0cfc122abf5f624572205764b011
SHA1 f60fd9ce2084c23801d962ffc70732b1870367ae
SHA512 f293e44361e23f77b256e90ecdfe2f53459f5efe1e51e86c4dc990a76ab3c0a9c57dae23038e8bfcdd821738253f00bb1713d688019936bebf5790920acae96a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

iMHEwjl.exe

Path C:\Windows\System\iMHEwjl.exe
Size 5.9MB
SHA256 78160966092484ba9f79b29989b5fa34a0a8e447f569293a08ec499da802bd28
MD5 cfec44d5ee31cf5c97cefbe85689ae6a
SHA1 ee71c812ec515d8fda43215d1188fc89c94ac891
SHA512 bc56437be1639ee9c4eb1d4cd941f5dce08a8392a84f3d002391d0eedf5bc00bcf3ccb073d3c529cb25bec6e6b72cea9e6f1a461c7dea209cc2369644fc87cc6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

kfSJuDL.exe

Path C:\Windows\System\kfSJuDL.exe
Size 5.9MB
SHA256 29822257afbd85dddec4c90aaad056350b71fea490d15c342b0cbb4528cffd31
MD5 460039d22a6d9c490abd1f309743385a
SHA1 57d6ecaee8eeed4f2bc026bcd167053130c882cb
SHA512 d28609c1510db8d20f430d2e8f9d914ad46b454d43350a12a3c105678d1c9ce5351c4c55145799b7241448ba968d49cdc34ef771ee7d14f9fc4612a7188d7ccb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

qNBJbIq.exe

Path C:\Windows\System\qNBJbIq.exe
Size 5.9MB
SHA256 c77b791f653352022be8a578ca31ea37bfe54f4d483d8cd1df8b92ddd9b345f9
MD5 b170053a4e16cfef96cc526361357739
SHA1 2e7cc3ffb9c0634a4e6532cc00cfaf8a29b5f07a
SHA512 79ed8431eb5955ebf2bb593c8c8527a4f03972f3eb00d91de7b15abbe77f38ce742dd295406a072a30549a3488a9bf1eab6f9cced04d905832aa42237aeb1c5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXRaHPD.exe

Path C:\Windows\System\sXRaHPD.exe
Size 5.9MB
SHA256 1206d382af42db2b287ac5ffd040c538dd4ee01abcc39e84c3953447da852594
MD5 b529c52c19e12f4e35cc12a4d5d456b9
SHA1 b4e1242dfa6833ce68ba9c5950476db329db85bf
SHA512 befd024869a3cde24e6b99759686614e3b3469a8432cf1e81300493438f2408b41d4fbe28c2982528211d56d340ddd350e53d9a874e4a5577ea70517f5d4bf3f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

uZizoXj.exe

Path C:\Windows\System\uZizoXj.exe
Size 5.9MB
SHA256 c23a7277be36c6dd2f09109fee4af1c2532065471b9b2afbf33c9d1d82a638a3
MD5 9d1b1cc261b7601f29ef59a92cfef3af
SHA1 d81b4b29a8ad7ba137e76af52098da25bf997e42
SHA512 d72d53c27ef503491055322ee3301537aae95835f21c3b9d4fe829281a7ebe37e3c46593d1b0dd95021483c0bb127cb9f6ad1fd3321978ff5bc21f1f31d6f468
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

vrNcwdD.exe

Path C:\Windows\System\vrNcwdD.exe
Size 5.9MB
SHA256 44bccf162fa5ec2f4eac833d5a46d6bc2dd6821f85e15762f92e5235952e6579
MD5 f84823b82906de4ca097edf2bd56411a
SHA1 4d4784d62973c34de96b0c1ff998821006efea3f
SHA512 9a9505d1ce5fac35eb357be36ade91d64d92ec16d00c9f6c4c4e7b7a1d979872054d382c29fbe767957ae66706b86c630f589f2b8740d13130526cd77842f397
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1404-158-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp

Download

memory/1404-137-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp

Download

memory/1404-127-0x00007FF66F590000-0x00007FF66F8E4000-memory.dmp

Download

memory/1496-7-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp

Download

memory/1496-67-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp

Download

memory/1496-139-0x00007FF6F5240000-0x00007FF6F5594000-memory.dmp

Download

memory/2128-159-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp

Download

memory/2128-128-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp

Download

memory/2128-138-0x00007FF7B82A0000-0x00007FF7B85F4000-memory.dmp

Download

memory/2212-152-0x00007FF613A00000-0x00007FF613D54000-memory.dmp

Download

memory/2212-136-0x00007FF613A00000-0x00007FF613D54000-memory.dmp

Download

memory/2212-88-0x00007FF613A00000-0x00007FF613D54000-memory.dmp

Download

memory/2612-44-0x00007FF640020000-0x00007FF640374000-memory.dmp

Download

memory/2612-126-0x00007FF640020000-0x00007FF640374000-memory.dmp

Download

memory/2612-145-0x00007FF640020000-0x00007FF640374000-memory.dmp

Download

memory/2864-148-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp

Download

memory/2864-63-0x00007FF632AB0000-0x00007FF632E04000-memory.dmp

Download

memory/3388-0-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp

Download

memory/3388-62-0x00007FF7819C0000-0x00007FF781D14000-memory.dmp

Download

memory/3388-1-0x000002756FC30000-0x000002756FC40000-memory.dmp

Download

memory/3448-146-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp

Download

memory/3448-131-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp

Download

memory/3448-48-0x00007FF7415A0000-0x00007FF7418F4000-memory.dmp

Download

memory/3704-143-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp

Download

memory/3704-32-0x00007FF6B7180000-0x00007FF6B74D4000-memory.dmp

Download

memory/3804-155-0x00007FF71B5D0000-0x00007FF71B924000-memory.dmp

Download

memory/3804-123-0x00007FF71B5D0000-0x00007FF71B924000-memory.dmp

Download

memory/3828-104-0x00007FF712F20000-0x00007FF713274000-memory.dmp

Download

memory/3828-154-0x00007FF712F20000-0x00007FF713274000-memory.dmp

Download

memory/3992-68-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp

Download

memory/3992-135-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp

Download

memory/3992-150-0x00007FF6697A0000-0x00007FF669AF4000-memory.dmp

Download

memory/4028-26-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp

Download

memory/4028-142-0x00007FF70A260000-0x00007FF70A5B4000-memory.dmp

Download

memory/4052-124-0x00007FF620AF0000-0x00007FF620E44000-memory.dmp

Download

memory/4052-156-0x00007FF620AF0000-0x00007FF620E44000-memory.dmp

Download

memory/4060-121-0x00007FF679840000-0x00007FF679B94000-memory.dmp

Download

memory/4060-157-0x00007FF679840000-0x00007FF679B94000-memory.dmp

Download

memory/4124-119-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp

Download

memory/4124-144-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp

Download

memory/4124-38-0x00007FF7A6AF0000-0x00007FF7A6E44000-memory.dmp

Download

memory/4136-100-0x00007FF6730E0000-0x00007FF673434000-memory.dmp

Download

memory/4136-153-0x00007FF6730E0000-0x00007FF673434000-memory.dmp

Download

memory/4388-82-0x00007FF6F4B50000-0x00007FF6F4EA4000-memory.dmp

Download

memory/4388-151-0x00007FF6F4B50000-0x00007FF6F4EA4000-memory.dmp

Download

memory/4876-147-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp

Download

memory/4876-134-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp

Download

memory/4876-56-0x00007FF7D47C0000-0x00007FF7D4B14000-memory.dmp

Download

memory/4892-141-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp

Download

memory/4892-20-0x00007FF6A4900000-0x00007FF6A4C54000-memory.dmp

Download

memory/4932-13-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp

Download

memory/4932-76-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp

Download

memory/4932-140-0x00007FF6EEAB0000-0x00007FF6EEE04000-memory.dmp

Download

memory/5040-149-0x00007FF64F4B0000-0x00007FF64F804000-memory.dmp

Download

memory/5040-77-0x00007FF64F4B0000-0x00007FF64F804000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads