cobaltstrike | a88f1f917232c54297a1e7b19dd2de077ef5491c9d74b78df3d9e5f3f04f52b5

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240612-19rayswgkn
SHA256 a88f1f917232c54297a1e7b19dd2de077ef5491c9d74b78df3d9e5f3f04f52b5
MD5 0d925866a5d0a684930f73ad3f2df763
SHA1 d5cd68a0173637d99997c991cedd6ac5d56de14f
SHA512 678f3bd818572521cb89f14a9b8a4f546e8566307f65131dfc1455f9fbdbca2abb3a9582615d92e22057411f615466794b912357700c2e48451de41c6904cb1e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:T+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023402-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-47.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023403-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-54.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-62.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-67.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-131.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-97.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023402-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023403-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	UPX
behavioral2/files/0x0008000000023402-5.dat	UPX
behavioral2/memory/3044-8-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	UPX
behavioral2/files/0x0007000000023406-12.dat	UPX
behavioral2/memory/4640-14-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-11.dat	UPX
behavioral2/memory/3408-20-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-24.dat	UPX
behavioral2/memory/6088-26-0x00007FF786820000-0x00007FF786B74000-memory.dmp	UPX
behavioral2/files/0x0007000000023409-28.dat	UPX
behavioral2/memory/4380-30-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-36.dat	UPX
behavioral2/memory/3916-44-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	UPX
behavioral2/memory/4776-50-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	UPX
behavioral2/files/0x000700000002340b-47.dat	UPX
behavioral2/files/0x0008000000023403-42.dat	UPX
behavioral2/memory/4208-38-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-54.dat	UPX
behavioral2/memory/3152-59-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-62.dat	UPX
behavioral2/memory/4336-61-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	UPX
behavioral2/memory/3096-57-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	UPX
behavioral2/memory/2416-69-0x00007FF646E30000-0x00007FF647184000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-67.dat	UPX
behavioral2/files/0x000700000002340f-72.dat	UPX
behavioral2/memory/3088-75-0x00007FF7E69E0000-0x00007FF7E6D34000-memory.dmp	UPX
behavioral2/memory/4988-81-0x00007FF608C30000-0x00007FF608F84000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-77.dat	UPX
behavioral2/files/0x0007000000023412-90.dat	UPX
behavioral2/files/0x0007000000023411-85.dat	UPX
behavioral2/memory/4088-92-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	UPX
behavioral2/memory/4604-94-0x00007FF7D6560000-0x00007FF7D68B4000-memory.dmp	UPX
behavioral2/memory/4380-93-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	UPX
behavioral2/memory/4208-100-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-118.dat	UPX
behavioral2/files/0x0007000000023417-124.dat	UPX
behavioral2/memory/4688-121-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	UPX
behavioral2/memory/5212-116-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	UPX
behavioral2/memory/3096-115-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-114.dat	UPX
behavioral2/memory/4776-113-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	UPX
behavioral2/memory/1416-104-0x00007FF68F810000-0x00007FF68FB64000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-108.dat	UPX
behavioral2/memory/5376-107-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	UPX
behavioral2/memory/3632-129-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp	UPX
behavioral2/memory/4336-127-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-131.dat	UPX
behavioral2/memory/1484-134-0x00007FF796820000-0x00007FF796B74000-memory.dmp	UPX
behavioral2/memory/2416-133-0x00007FF646E30000-0x00007FF647184000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-97.dat	UPX
behavioral2/memory/5376-135-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	UPX
behavioral2/memory/5212-136-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	UPX
behavioral2/memory/4688-137-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	UPX
behavioral2/memory/3044-138-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	UPX
behavioral2/memory/4640-139-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	UPX
behavioral2/memory/3408-140-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	UPX
behavioral2/memory/6088-141-0x00007FF786820000-0x00007FF786B74000-memory.dmp	UPX
behavioral2/memory/4380-142-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	UPX
behavioral2/memory/4208-143-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	UPX
behavioral2/memory/3916-144-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	UPX
behavioral2/memory/4776-145-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	UPX
behavioral2/memory/3096-146-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	UPX
behavioral2/memory/4336-147-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	UPX
behavioral2/memory/2416-148-0x00007FF646E30000-0x00007FF647184000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023402-5.dat	xmrig
behavioral2/memory/3044-8-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-12.dat	xmrig
behavioral2/memory/4640-14-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-11.dat	xmrig
behavioral2/memory/3408-20-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-24.dat	xmrig
behavioral2/memory/6088-26-0x00007FF786820000-0x00007FF786B74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-28.dat	xmrig
behavioral2/memory/4380-30-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-36.dat	xmrig
behavioral2/memory/3916-44-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	xmrig
behavioral2/memory/4776-50-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-47.dat	xmrig
behavioral2/files/0x0008000000023403-42.dat	xmrig
behavioral2/memory/4208-38-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-54.dat	xmrig
behavioral2/memory/3152-59-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-62.dat	xmrig
behavioral2/memory/4336-61-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	xmrig
behavioral2/memory/3096-57-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	xmrig
behavioral2/memory/2416-69-0x00007FF646E30000-0x00007FF647184000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-67.dat	xmrig
behavioral2/files/0x000700000002340f-72.dat	xmrig
behavioral2/memory/3088-75-0x00007FF7E69E0000-0x00007FF7E6D34000-memory.dmp	xmrig
behavioral2/memory/4988-81-0x00007FF608C30000-0x00007FF608F84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-77.dat	xmrig
behavioral2/files/0x0007000000023412-90.dat	xmrig
behavioral2/files/0x0007000000023411-85.dat	xmrig
behavioral2/memory/4088-92-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	xmrig
behavioral2/memory/4604-94-0x00007FF7D6560000-0x00007FF7D68B4000-memory.dmp	xmrig
behavioral2/memory/4380-93-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	xmrig
behavioral2/memory/4208-100-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-118.dat	xmrig
behavioral2/files/0x0007000000023417-124.dat	xmrig
behavioral2/memory/4688-121-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	xmrig
behavioral2/memory/5212-116-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	xmrig
behavioral2/memory/3096-115-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-114.dat	xmrig
behavioral2/memory/4776-113-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	xmrig
behavioral2/memory/1416-104-0x00007FF68F810000-0x00007FF68FB64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-108.dat	xmrig
behavioral2/memory/5376-107-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	xmrig
behavioral2/memory/3632-129-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp	xmrig
behavioral2/memory/4336-127-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-131.dat	xmrig
behavioral2/memory/1484-134-0x00007FF796820000-0x00007FF796B74000-memory.dmp	xmrig
behavioral2/memory/2416-133-0x00007FF646E30000-0x00007FF647184000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-97.dat	xmrig
behavioral2/memory/5376-135-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	xmrig
behavioral2/memory/5212-136-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	xmrig
behavioral2/memory/4688-137-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	xmrig
behavioral2/memory/3044-138-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	xmrig
behavioral2/memory/4640-139-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	xmrig
behavioral2/memory/3408-140-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	xmrig
behavioral2/memory/6088-141-0x00007FF786820000-0x00007FF786B74000-memory.dmp	xmrig
behavioral2/memory/4380-142-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	xmrig
behavioral2/memory/4208-143-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	xmrig
behavioral2/memory/3916-144-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	xmrig
behavioral2/memory/4776-145-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	xmrig
behavioral2/memory/3096-146-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	xmrig
behavioral2/memory/4336-147-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	xmrig
behavioral2/memory/2416-148-0x00007FF646E30000-0x00007FF647184000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3044	PTTdZnk.exe
4640	ItKkBAh.exe
3408	oKPEEOT.exe
6088	RnPoPno.exe
4380	YZQFmug.exe
4208	cHELftt.exe
3916	URxDRSG.exe
4776	uxpKPyh.exe
3096	tPSMBdj.exe
4336	krmOJpk.exe
2416	qyXcYUZ.exe
3088	RESnrlQ.exe
4988	NVltqkQ.exe
4088	DuHSNuE.exe
4604	HaszvoO.exe
1416	fiBenEl.exe
5376	jPpEElJ.exe
5212	plfuSrf.exe
4688	KAwcJId.exe
3632	ggLwjPZ.exe
1484	yBoaLfX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	upx
behavioral2/files/0x0008000000023402-5.dat	upx
behavioral2/memory/3044-8-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	upx
behavioral2/files/0x0007000000023406-12.dat	upx
behavioral2/memory/4640-14-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	upx
behavioral2/files/0x0007000000023407-11.dat	upx
behavioral2/memory/3408-20-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	upx
behavioral2/files/0x0007000000023408-24.dat	upx
behavioral2/memory/6088-26-0x00007FF786820000-0x00007FF786B74000-memory.dmp	upx
behavioral2/files/0x0007000000023409-28.dat	upx
behavioral2/memory/4380-30-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	upx
behavioral2/files/0x000700000002340a-36.dat	upx
behavioral2/memory/3916-44-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	upx
behavioral2/memory/4776-50-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	upx
behavioral2/files/0x000700000002340b-47.dat	upx
behavioral2/files/0x0008000000023403-42.dat	upx
behavioral2/memory/4208-38-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	upx
behavioral2/files/0x000700000002340c-54.dat	upx
behavioral2/memory/3152-59-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp	upx
behavioral2/files/0x000700000002340d-62.dat	upx
behavioral2/memory/4336-61-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	upx
behavioral2/memory/3096-57-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	upx
behavioral2/memory/2416-69-0x00007FF646E30000-0x00007FF647184000-memory.dmp	upx
behavioral2/files/0x000700000002340e-67.dat	upx
behavioral2/files/0x000700000002340f-72.dat	upx
behavioral2/memory/3088-75-0x00007FF7E69E0000-0x00007FF7E6D34000-memory.dmp	upx
behavioral2/memory/4988-81-0x00007FF608C30000-0x00007FF608F84000-memory.dmp	upx
behavioral2/files/0x0007000000023410-77.dat	upx
behavioral2/files/0x0007000000023412-90.dat	upx
behavioral2/files/0x0007000000023411-85.dat	upx
behavioral2/memory/4088-92-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	upx
behavioral2/memory/4604-94-0x00007FF7D6560000-0x00007FF7D68B4000-memory.dmp	upx
behavioral2/memory/4380-93-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	upx
behavioral2/memory/4208-100-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	upx
behavioral2/files/0x0007000000023416-118.dat	upx
behavioral2/files/0x0007000000023417-124.dat	upx
behavioral2/memory/4688-121-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	upx
behavioral2/memory/5212-116-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	upx
behavioral2/memory/3096-115-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	upx
behavioral2/files/0x0007000000023415-114.dat	upx
behavioral2/memory/4776-113-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	upx
behavioral2/memory/1416-104-0x00007FF68F810000-0x00007FF68FB64000-memory.dmp	upx
behavioral2/files/0x0007000000023414-108.dat	upx
behavioral2/memory/5376-107-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	upx
behavioral2/memory/3632-129-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp	upx
behavioral2/memory/4336-127-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	upx
behavioral2/files/0x0007000000023418-131.dat	upx
behavioral2/memory/1484-134-0x00007FF796820000-0x00007FF796B74000-memory.dmp	upx
behavioral2/memory/2416-133-0x00007FF646E30000-0x00007FF647184000-memory.dmp	upx
behavioral2/files/0x0007000000023413-97.dat	upx
behavioral2/memory/5376-135-0x00007FF7381E0000-0x00007FF738534000-memory.dmp	upx
behavioral2/memory/5212-136-0x00007FF687550000-0x00007FF6878A4000-memory.dmp	upx
behavioral2/memory/4688-137-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp	upx
behavioral2/memory/3044-138-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp	upx
behavioral2/memory/4640-139-0x00007FF663390000-0x00007FF6636E4000-memory.dmp	upx
behavioral2/memory/3408-140-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp	upx
behavioral2/memory/6088-141-0x00007FF786820000-0x00007FF786B74000-memory.dmp	upx
behavioral2/memory/4380-142-0x00007FF70C400000-0x00007FF70C754000-memory.dmp	upx
behavioral2/memory/4208-143-0x00007FF735870000-0x00007FF735BC4000-memory.dmp	upx
behavioral2/memory/3916-144-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp	upx
behavioral2/memory/4776-145-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp	upx
behavioral2/memory/3096-146-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp	upx
behavioral2/memory/4336-147-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp	upx
behavioral2/memory/2416-148-0x00007FF646E30000-0x00007FF647184000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\URxDRSG.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DuHSNuE.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fiBenEl.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KAwcJId.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yBoaLfX.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oKPEEOT.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YZQFmug.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cHELftt.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tPSMBdj.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qyXcYUZ.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HaszvoO.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PTTdZnk.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ItKkBAh.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\krmOJpk.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\plfuSrf.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RnPoPno.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uxpKPyh.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RESnrlQ.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NVltqkQ.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jPpEElJ.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ggLwjPZ.exe	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3044	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	82
PID 3152 wrote to memory of 3044	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	82
PID 3152 wrote to memory of 4640	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	83
PID 3152 wrote to memory of 4640	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	83
PID 3152 wrote to memory of 3408	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	84
PID 3152 wrote to memory of 3408	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	84
PID 3152 wrote to memory of 6088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	85
PID 3152 wrote to memory of 6088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	85
PID 3152 wrote to memory of 4380	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	86
PID 3152 wrote to memory of 4380	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	86
PID 3152 wrote to memory of 4208	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	87
PID 3152 wrote to memory of 4208	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	87
PID 3152 wrote to memory of 3916	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	88
PID 3152 wrote to memory of 3916	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	88
PID 3152 wrote to memory of 4776	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	89
PID 3152 wrote to memory of 4776	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	89
PID 3152 wrote to memory of 3096	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	90
PID 3152 wrote to memory of 3096	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	90
PID 3152 wrote to memory of 4336	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	91
PID 3152 wrote to memory of 4336	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	91
PID 3152 wrote to memory of 2416	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	92
PID 3152 wrote to memory of 2416	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	92
PID 3152 wrote to memory of 3088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	93
PID 3152 wrote to memory of 3088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	93
PID 3152 wrote to memory of 4988	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	94
PID 3152 wrote to memory of 4988	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	94
PID 3152 wrote to memory of 4088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	95
PID 3152 wrote to memory of 4088	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	95
PID 3152 wrote to memory of 4604	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	96
PID 3152 wrote to memory of 4604	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	96
PID 3152 wrote to memory of 1416	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	97
PID 3152 wrote to memory of 1416	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	97
PID 3152 wrote to memory of 5376	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	98
PID 3152 wrote to memory of 5376	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	98
PID 3152 wrote to memory of 5212	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	99
PID 3152 wrote to memory of 5212	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	99
PID 3152 wrote to memory of 4688	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	100
PID 3152 wrote to memory of 4688	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	100
PID 3152 wrote to memory of 3632	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	101
PID 3152 wrote to memory of 3632	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	101
PID 3152 wrote to memory of 1484	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	102
PID 3152 wrote to memory of 1484	3152	2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-12_0d925866a5d0a684930f73ad3f2df763_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\System\PTTdZnk.exe
  C:\Windows\System\PTTdZnk.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ItKkBAh.exe
  C:\Windows\System\ItKkBAh.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\oKPEEOT.exe
  C:\Windows\System\oKPEEOT.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\RnPoPno.exe
  C:\Windows\System\RnPoPno.exe
  2⤵
  - Executes dropped EXE
  PID:6088
- C:\Windows\System\YZQFmug.exe
  C:\Windows\System\YZQFmug.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\cHELftt.exe
  C:\Windows\System\cHELftt.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\URxDRSG.exe
  C:\Windows\System\URxDRSG.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\uxpKPyh.exe
  C:\Windows\System\uxpKPyh.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\tPSMBdj.exe
  C:\Windows\System\tPSMBdj.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\krmOJpk.exe
  C:\Windows\System\krmOJpk.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\qyXcYUZ.exe
  C:\Windows\System\qyXcYUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\RESnrlQ.exe
  C:\Windows\System\RESnrlQ.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\NVltqkQ.exe
  C:\Windows\System\NVltqkQ.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\DuHSNuE.exe
  C:\Windows\System\DuHSNuE.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\HaszvoO.exe
  C:\Windows\System\HaszvoO.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\fiBenEl.exe
  C:\Windows\System\fiBenEl.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\jPpEElJ.exe
  C:\Windows\System\jPpEElJ.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\plfuSrf.exe
  C:\Windows\System\plfuSrf.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\KAwcJId.exe
  C:\Windows\System\KAwcJId.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\ggLwjPZ.exe
  C:\Windows\System\ggLwjPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\yBoaLfX.exe
  C:\Windows\System\yBoaLfX.exe
  2⤵
  - Executes dropped EXE
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DuHSNuE.exe

Path C:\Windows\System\DuHSNuE.exe
Size 5.9MB
SHA256 779939f012210e69eac04b18b5eaa9dc0d22fede470b1a4be534ecd53e5a1e97
MD5 af0e8a60bf968061c1531fdd9698a398
SHA1 93aef16ff63b120fbbce97ce196c2177e9717802
SHA512 6fe1af3f741c5f7331899680a64725925ce226a6db2c76b5736b2d5bf62427bf92bb4524938d6b8773bb42968521d00f7760b9a9e347ddc17a4424a0d89a78cf
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

HaszvoO.exe

Path C:\Windows\System\HaszvoO.exe
Size 5.9MB
SHA256 ed3b18aaebe03391d5504acd2b2a84f8e896312e928c261cdd5966580713718f
MD5 9c2f71d09aa815a87dec22fb73149054
SHA1 67dbfd1ff32a1901db0758fbc24865e93aa60e03
SHA512 7ebb861f9821365ea71f1b170b86ed35907d0d2cb7ad48c1157af5f3ca786b607f3770c5e22ecdcf34710e301412040d5563f2244ed72c87b3f959c178de5c4a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

ItKkBAh.exe

Path C:\Windows\System\ItKkBAh.exe
Size 5.9MB
SHA256 5ce16b5fdf86630180720c40c60714c0bf7d987db5cd61cc85914a07cb74c78b
MD5 2d5fb74f61feff0d4808d2ccd4ed65ff
SHA1 f07689fced60c2283b543511cda1b7df005461a8
SHA512 31caa6afcf8622d6a8a4e2f790e4d7fd1d3fd2ef5352c852cc1e1922e1120a76765a84d5333f222c174868f18e6945cf7dba1dd12edf5e662fa1343a04d67c57
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

KAwcJId.exe

Path C:\Windows\System\KAwcJId.exe
Size 5.9MB
SHA256 e9f3ca5d285ba0651b60fa167fea0a60b5bfd5296a64c30ddccec22a22e9c658
MD5 270444ec81d682d429b42e2942e9cb01
SHA1 14e1a2d4121d71da662518691f4ac7ac5f04636e
SHA512 c77528f448cdc9dfa4b5d93489ba1c0e8b2b8be5d3c4baa6df4f6ccb7a11f5ad5c3962323da3ac2242bccd191b8ac44a0c2412af710dce6198c3010daf9501b8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:T+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVltqkQ.exe

Path C:\Windows\System\NVltqkQ.exe
Size 5.9MB
SHA256 393c4605545180c0d87e94182cd75d730e31cca1edf05ad1b948b8890f0e1996
MD5 e862921190f16dcc4f82b6826ddd7b40
SHA1 c80e7ade788b69e354e26a66f77e15ac7d448673
SHA512 44e8e4a1dc159b74ad3fd38d76a069e0f613aa8808234ce3cad336db5830913bd638324ca0fcd84ea6e774eba8852d99f0838d03bdcb78106433b554fac5b709
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:T+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

PTTdZnk.exe

Path C:\Windows\System\PTTdZnk.exe
Size 5.9MB
SHA256 2799d95a6d75d783e73dbb8fc41d3068dfa2cf3694b2a6c6d5528c2784d8a664
MD5 1c22b221d56547a987bd8a7362896755
SHA1 85f9e34381e1bb57b77b197a0d10033e796ccbb5
SHA512 05adfe15f5628e9f1c6129286c26965d5e1a07cb60d774561d2323935fff1dd0a0015e7c5e02490ccab212da7b2d12e95219553e49fd07bdf4324c1a9ec58777
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESnrlQ.exe

Path C:\Windows\System\RESnrlQ.exe
Size 5.9MB
SHA256 d6db1cac410e02421d65441a076241e82b62f42f9f28ba91d38673d81a06a233
MD5 1d633b8fbbeffba6dd707af973f98fe9
SHA1 ef4971ede89d4fc913a1b76c0e4ae3e26c0b8ed2
SHA512 f46cac1e16960b48d52fd05349ea89552e58e918a7cce35ef7803a453f462c14bf20f43c213d431e362d2e371415ffa2fd1ca14eb5a30917c863b282914c3470
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

RnPoPno.exe

Path C:\Windows\System\RnPoPno.exe
Size 5.9MB
SHA256 2fb4fe6bf57d2cf2c693a7198ce6ed32a514e4a50fc610805efd0260ca3b1917
MD5 0b874633852c07343ee3a5dff4860c51
SHA1 b6347422808d78467f85b3e0c0dbd47d80269cc6
SHA512 37a7808c399f281679c2b8d81f94ddda5b5f4dbb2aa1a779d6ec052cd5e05041fe30f110215298cf298490f34ed1d8712545006b8b25f21b3e85a04d5ba57ae7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

URxDRSG.exe

Path C:\Windows\System\URxDRSG.exe
Size 5.9MB
SHA256 4039b2ed7c87849673247396e1010aacbc2cee525a8af01093968bfc9ba08a25
MD5 e9c73caa9cf8cd5354b5c30bbb0e676b
SHA1 314ee09d347b588593c0c114cada365797a95622
SHA512 d77a3d9cde86e7c46092e358c0f60f313a7a287728ea7141c90c3102bde5ee65eefe3ae639849afcd37a94c878586b29c0f5c862669eccc2c07e5a3e71895629
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:T+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

YZQFmug.exe

Path C:\Windows\System\YZQFmug.exe
Size 5.9MB
SHA256 ef21bcbd9c1c8a8154ec76e13855b97e3e092c47744a19cc8627492841636bb2
MD5 11a2834b5e6c4a7a9fae5648f8821eb1
SHA1 4b70f4b69e47a84d2688c72a2a0014c4d1b4e853
SHA512 df97851c1807944feb71300c652f245619da1b1eed484190c5ae86cc1ec3c02ad517e881ced21028da29d6766994f4485e1b004a7137b9c22a5c0d6fa508d6b7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

cHELftt.exe

Path C:\Windows\System\cHELftt.exe
Size 5.9MB
SHA256 ab06d9ef2c9fa6e9d00c0e107677cbcf0843eec716499b55e5f69fca82452c66
MD5 19161e08600f553c20c438b5fc3175c5
SHA1 7016769c828c42e89e58defe8a4ab5580a0682a8
SHA512 e54f0e1e8de7e3c626784106ed71b1ac491fc50b84de9ab72820eb38a9db81968161b77428398631f71099b4f7b96344bfe2c156f0ad58f14f5e286338452365
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

fiBenEl.exe

Path C:\Windows\System\fiBenEl.exe
Size 5.9MB
SHA256 43a49060d7e8120740563bdf2c9a938b2849e35ee81a91b06e7e560ac72c1d53
MD5 e636c3ffb858218f9d36ef845ed50a76
SHA1 c8c3b4db66fbe59342a2c7bd8725da67e5752940
SHA512 7f23be15d4f72bf1b41d82b56467db6afad9e031d0879dd47fced074269d93137dcd06454d1f4b02ec43664d0908e44c92968c3891719910f27433556ba725aa
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:T+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ggLwjPZ.exe

Path C:\Windows\System\ggLwjPZ.exe
Size 5.9MB
SHA256 983ae7476f7d82d35935a8043f13351db281516cdae7dac0aea23e9e0bb142a6
MD5 eaa3459b279108cd02863d68bf5c6909
SHA1 9a96022e55d2f7ce5ed14cbd49bdf39e2bc6fad4
SHA512 e2ee3d7d265c01e5cc8b3ef328b7a0b646d75e28562be7b3d523734f2dec0b7014ff7868223af1b351067a8dcfa2d8a9d5b31dce773a0844b4d2f95845760a05
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

jPpEElJ.exe

Path C:\Windows\System\jPpEElJ.exe
Size 5.9MB
SHA256 fc2aef7383a1fa64c029b85028ba58062f00d60041b97122c57782358b7c00f7
MD5 231b2d6256fa7f7cf27d4abb61c67cb7
SHA1 f7e3067715d2ebdf2f4e3e2ca8e278a365a780f5
SHA512 0e5c6884d1dbf339edc551f4f11d4fa9b2afa6e162483cfa61ca6c6ac0841dd808dcb760b5f85abf0f1a78a11dcbce372fe57f751f3b54ce5e3590a45f74790d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

krmOJpk.exe

Path C:\Windows\System\krmOJpk.exe
Size 5.9MB
SHA256 2df5eb14a9fb08f5b04318d9c4350a6205d9f6f6f0b777048cdd0f976d565386
MD5 7039a437133482bdb1375e491bc48ef8
SHA1 b2477ab6579bc4447bb2d9cb96de8cafa254e4b5
SHA512 d87ec3da24cb3a5dad31df0a0f0eacb8ce497c1bb50be027199edd28748496e00c61b787e0363124c61202befdcf7b5657fe46129dac4c60b1760fddb413baca
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKPEEOT.exe

Path C:\Windows\System\oKPEEOT.exe
Size 5.9MB
SHA256 c375a7fba3f685fc1149f1ee1c96d0ae38a5991452d7234dd398c67ef09b8f7d
MD5 2b4ed552a1839633c6dffc9f2c5619d9
SHA1 961d67ced97addc763fe865161ba1fd5d619210f
SHA512 f81c7fabbb10289f435f5fb7e5dbb50d5493ef0f6190afec2c64ed7fb8ecf2a0b8b9b0a69c9a7ed51ee941206c8d90d7d15b008c77c490d46c27e0a2b98a605e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:T+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

plfuSrf.exe

Path C:\Windows\System\plfuSrf.exe
Size 5.9MB
SHA256 6141b401f5fd0ef1d5f6c58aa42988c9ea99c75dc610fbdbceb0fcd0e95cd749
MD5 70f9256b5df0ee05c020b36bdbc09777
SHA1 c67eaea2b1c4817aac1461a74afad9a88c56025b
SHA512 dc829e05fe94b58b598ddc061e07c7f009f654c295035628e18e4fc84d1c950bd4f595de62c5569a426d602b17aa3bd46a1c231ab773dc13914006a5d8e5124d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

qyXcYUZ.exe

Path C:\Windows\System\qyXcYUZ.exe
Size 5.9MB
SHA256 3055c05dbb32732de220dc49b9079866dda0da27f49f906c48ce9dc28b6f023c
MD5 2398c323c74c5dcc65cf51439bf7ca29
SHA1 cb133ee084dcb7f59900a234d746ef9bbde0eb9b
SHA512 b5adf9f358f887ebc31b78daa0e41d330eed3e4c05a6673ea8e001f9c2b572ed119e0be65c791c16bd60b4ea729b18a16e20f0b021b65908543ce6943a2aef21
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPSMBdj.exe

Path C:\Windows\System\tPSMBdj.exe
Size 5.9MB
SHA256 5baaf078af9b17457e85dad1450a84ff0426dee31a0ae592a58d917ef5b29f9a
MD5 2391b18e0414db0ba210f07f4ebdbee1
SHA1 aa9738fedcf7ea6d9074dd8d19dc93a343205baf
SHA512 9ff78f046ea4c1677ce20e5ee12ec4856e7f4563a6f4f4c53d07b29fa0e439b51221e53842ea6c9f2b2e789de2bac9a76bdfd5b61e8be7308097908bef57eed2
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

uxpKPyh.exe

Path C:\Windows\System\uxpKPyh.exe
Size 5.9MB
SHA256 81178396fc5b40b3a61a5219ae06b2dd4ab622add5229434fd7854c9f883ae62
MD5 bfb67d19a44b93b92fda2f62b55d29c4
SHA1 abcc58b6f92cd6a661866223656be6f591ae8865
SHA512 997c0ef1fdf6242b88f71ffda5e21e89d1ec092ac67eabb43c8b7e20bd75b3d522f100e2cfa6586622dc106fff6f5f4e52d9bc48a49b9ceb2dc7b348a3c522f9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

yBoaLfX.exe

Path C:\Windows\System\yBoaLfX.exe
Size 5.9MB
SHA256 f744caafe48b962412b78eda01ee68d94df598a0c39e46ab412eae1c16d620d8
MD5 85a43139aefa8866a6cd203ae0a5dc7b
SHA1 6c49fa374205d94529d92d7ece0387144b99ffd8
SHA512 587d36b762a1947d902c5aad7876df011d8075063402efaaec9ebd309fa1842675c364d854b196872b018581e998989d992981af126ed6ae4da8d5a1e3e87d5e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-153-0x00007FF68F810000-0x00007FF68FB64000-memory.dmp

Download

memory/1416-104-0x00007FF68F810000-0x00007FF68FB64000-memory.dmp

Download

memory/1484-158-0x00007FF796820000-0x00007FF796B74000-memory.dmp

Download

memory/1484-134-0x00007FF796820000-0x00007FF796B74000-memory.dmp

Download

memory/2416-69-0x00007FF646E30000-0x00007FF647184000-memory.dmp

Download

memory/2416-133-0x00007FF646E30000-0x00007FF647184000-memory.dmp

Download

memory/2416-148-0x00007FF646E30000-0x00007FF647184000-memory.dmp

Download

memory/3044-8-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp

Download

memory/3044-138-0x00007FF6B8CB0000-0x00007FF6B9004000-memory.dmp

Download

memory/3088-75-0x00007FF7E69E0000-0x00007FF7E6D34000-memory.dmp

Download

memory/3088-149-0x00007FF7E69E0000-0x00007FF7E6D34000-memory.dmp

Download

memory/3096-57-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp

Download

memory/3096-115-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp

Download

memory/3096-146-0x00007FF61A7E0000-0x00007FF61AB34000-memory.dmp

Download

memory/3152-59-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp

Download

memory/3152-1-0x000001D3F95F0000-0x000001D3F9600000-memory.dmp

Download

memory/3152-0-0x00007FF6DB480000-0x00007FF6DB7D4000-memory.dmp

Download

memory/3408-20-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp

Download

memory/3408-140-0x00007FF6F7030000-0x00007FF6F7384000-memory.dmp

Download

memory/3632-129-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp

Download

memory/3632-156-0x00007FF6DA100000-0x00007FF6DA454000-memory.dmp

Download

memory/3916-44-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp

Download

memory/3916-144-0x00007FF68F5F0000-0x00007FF68F944000-memory.dmp

Download

memory/4088-151-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp

Download

memory/4088-92-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp

Download

memory/4208-143-0x00007FF735870000-0x00007FF735BC4000-memory.dmp

Download

memory/4208-100-0x00007FF735870000-0x00007FF735BC4000-memory.dmp

Download

memory/4208-38-0x00007FF735870000-0x00007FF735BC4000-memory.dmp

Download

memory/4336-147-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp

Download

memory/4336-127-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp

Download

memory/4336-61-0x00007FF7E2530000-0x00007FF7E2884000-memory.dmp

Download

memory/4380-93-0x00007FF70C400000-0x00007FF70C754000-memory.dmp

Download

memory/4380-142-0x00007FF70C400000-0x00007FF70C754000-memory.dmp

Download

memory/4380-30-0x00007FF70C400000-0x00007FF70C754000-memory.dmp

Download

memory/4604-152-0x00007FF7D6560000-0x00007FF7D68B4000-memory.dmp

Download

memory/4604-94-0x00007FF7D6560000-0x00007FF7D68B4000-memory.dmp

Download

memory/4640-139-0x00007FF663390000-0x00007FF6636E4000-memory.dmp

Download

memory/4640-14-0x00007FF663390000-0x00007FF6636E4000-memory.dmp

Download

memory/4688-157-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp

Download

memory/4688-121-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp

Download

memory/4688-137-0x00007FF7CEF90000-0x00007FF7CF2E4000-memory.dmp

Download

memory/4776-145-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp

Download

memory/4776-113-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp

Download

memory/4776-50-0x00007FF6C83F0000-0x00007FF6C8744000-memory.dmp

Download

memory/4988-150-0x00007FF608C30000-0x00007FF608F84000-memory.dmp

Download

memory/4988-81-0x00007FF608C30000-0x00007FF608F84000-memory.dmp

Download

memory/5212-155-0x00007FF687550000-0x00007FF6878A4000-memory.dmp

Download

memory/5212-116-0x00007FF687550000-0x00007FF6878A4000-memory.dmp

Download

memory/5212-136-0x00007FF687550000-0x00007FF6878A4000-memory.dmp

Download

memory/5376-135-0x00007FF7381E0000-0x00007FF738534000-memory.dmp

Download

memory/5376-154-0x00007FF7381E0000-0x00007FF738534000-memory.dmp

Download

memory/5376-107-0x00007FF7381E0000-0x00007FF738534000-memory.dmp

Download

memory/6088-26-0x00007FF786820000-0x00007FF786B74000-memory.dmp

Download

memory/6088-141-0x00007FF786820000-0x00007FF786B74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads