cobaltstrike | 97f6888d6bc1f0d21972095b167a0273f93faeafdc8ceb968703ca9880598e13

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
Size 5.9MB
Sample240628-adnxvaseml
SHA256 97f6888d6bc1f0d21972095b167a0273f93faeafdc8ceb968703ca9880598e13
MD5 680fe87d946e9d9aa74890621953a5f3
SHA1 1ebfa052483056cb1a09031e98515caea57fe158
SHA512 12a94ee98c3c14b8890cb43c422357dd6f9b13151ee840e62cff31140e2a3d3c694d68b7c07331fdf875009934acd3de83cdfb60d814436f5155b3311590a6ae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0009000000023419-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-37.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-58.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-70.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-127.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-131.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-108.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023419-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4512-0-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	UPX
behavioral2/files/0x0009000000023419-4.dat	UPX
behavioral2/memory/3200-8-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	UPX
behavioral2/files/0x0007000000023434-11.dat	UPX
behavioral2/files/0x0007000000023435-10.dat	UPX
behavioral2/memory/4112-24-0x00007FF771620000-0x00007FF771974000-memory.dmp	UPX
behavioral2/files/0x0007000000023436-32.dat	UPX
behavioral2/memory/4884-34-0x00007FF746130000-0x00007FF746484000-memory.dmp	UPX
behavioral2/files/0x0007000000023438-37.dat	UPX
behavioral2/files/0x0007000000023437-35.dat	UPX
behavioral2/memory/4508-31-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	UPX
behavioral2/memory/3088-30-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	UPX
behavioral2/memory/4316-12-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	UPX
behavioral2/files/0x0007000000023439-40.dat	UPX
behavioral2/memory/1684-44-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-47.dat	UPX
behavioral2/files/0x000700000002343b-52.dat	UPX
behavioral2/memory/3996-50-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	UPX
behavioral2/memory/3488-56-0x00007FF677010000-0x00007FF677364000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-58.dat	UPX
behavioral2/memory/4964-62-0x00007FF790700000-0x00007FF790A54000-memory.dmp	UPX
behavioral2/files/0x000700000002343d-65.dat	UPX
behavioral2/memory/4668-67-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	UPX
behavioral2/memory/4512-66-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	UPX
behavioral2/files/0x000700000002343e-70.dat	UPX
behavioral2/memory/3200-72-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	UPX
behavioral2/memory/1712-76-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-80.dat	UPX
behavioral2/files/0x0007000000023440-84.dat	UPX
behavioral2/files/0x0007000000023441-88.dat	UPX
behavioral2/files/0x0007000000023442-101.dat	UPX
behavioral2/files/0x0007000000023445-115.dat	UPX
behavioral2/memory/2852-116-0x00007FF6124C0000-0x00007FF612814000-memory.dmp	UPX
behavioral2/memory/4884-118-0x00007FF746130000-0x00007FF746484000-memory.dmp	UPX
behavioral2/memory/3012-125-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	UPX
behavioral2/files/0x0007000000023446-127.dat	UPX
behavioral2/files/0x0007000000023447-131.dat	UPX
behavioral2/memory/4780-126-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	UPX
behavioral2/memory/628-121-0x00007FF66DDE0000-0x00007FF66E134000-memory.dmp	UPX
behavioral2/memory/4156-117-0x00007FF684300000-0x00007FF684654000-memory.dmp	UPX
behavioral2/memory/5088-112-0x00007FF6F0F80000-0x00007FF6F12D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023443-109.dat	UPX
behavioral2/files/0x0007000000023444-108.dat	UPX
behavioral2/memory/4508-96-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	UPX
behavioral2/memory/3028-94-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	UPX
behavioral2/memory/3088-87-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	UPX
behavioral2/memory/2448-86-0x00007FF705400000-0x00007FF705754000-memory.dmp	UPX
behavioral2/memory/4316-82-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	UPX
behavioral2/memory/3032-133-0x00007FF76FB30000-0x00007FF76FE84000-memory.dmp	UPX
behavioral2/memory/4668-134-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	UPX
behavioral2/memory/1712-135-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	UPX
behavioral2/memory/2448-136-0x00007FF705400000-0x00007FF705754000-memory.dmp	UPX
behavioral2/memory/3028-137-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	UPX
behavioral2/memory/3012-138-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	UPX
behavioral2/memory/4780-139-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	UPX
behavioral2/memory/3200-140-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	UPX
behavioral2/memory/4316-141-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	UPX
behavioral2/memory/4112-142-0x00007FF771620000-0x00007FF771974000-memory.dmp	UPX
behavioral2/memory/3088-143-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	UPX
behavioral2/memory/4884-144-0x00007FF746130000-0x00007FF746484000-memory.dmp	UPX
behavioral2/memory/4508-145-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	UPX
behavioral2/memory/1684-146-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	UPX
behavioral2/memory/3996-147-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	UPX
behavioral2/memory/3488-148-0x00007FF677010000-0x00007FF677364000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4512-0-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	xmrig
behavioral2/files/0x0009000000023419-4.dat	xmrig
behavioral2/memory/3200-8-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-11.dat	xmrig
behavioral2/files/0x0007000000023435-10.dat	xmrig
behavioral2/memory/4112-24-0x00007FF771620000-0x00007FF771974000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-32.dat	xmrig
behavioral2/memory/4884-34-0x00007FF746130000-0x00007FF746484000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-37.dat	xmrig
behavioral2/files/0x0007000000023437-35.dat	xmrig
behavioral2/memory/4508-31-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	xmrig
behavioral2/memory/3088-30-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	xmrig
behavioral2/memory/4316-12-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-40.dat	xmrig
behavioral2/memory/1684-44-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-47.dat	xmrig
behavioral2/files/0x000700000002343b-52.dat	xmrig
behavioral2/memory/3996-50-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	xmrig
behavioral2/memory/3488-56-0x00007FF677010000-0x00007FF677364000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-58.dat	xmrig
behavioral2/memory/4964-62-0x00007FF790700000-0x00007FF790A54000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-65.dat	xmrig
behavioral2/memory/4668-67-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	xmrig
behavioral2/memory/4512-66-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-70.dat	xmrig
behavioral2/memory/3200-72-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	xmrig
behavioral2/memory/1712-76-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-80.dat	xmrig
behavioral2/files/0x0007000000023440-84.dat	xmrig
behavioral2/files/0x0007000000023441-88.dat	xmrig
behavioral2/files/0x0007000000023442-101.dat	xmrig
behavioral2/files/0x0007000000023445-115.dat	xmrig
behavioral2/memory/2852-116-0x00007FF6124C0000-0x00007FF612814000-memory.dmp	xmrig
behavioral2/memory/4884-118-0x00007FF746130000-0x00007FF746484000-memory.dmp	xmrig
behavioral2/memory/3012-125-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-127.dat	xmrig
behavioral2/files/0x0007000000023447-131.dat	xmrig
behavioral2/memory/4780-126-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	xmrig
behavioral2/memory/628-121-0x00007FF66DDE0000-0x00007FF66E134000-memory.dmp	xmrig
behavioral2/memory/4156-117-0x00007FF684300000-0x00007FF684654000-memory.dmp	xmrig
behavioral2/memory/5088-112-0x00007FF6F0F80000-0x00007FF6F12D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-109.dat	xmrig
behavioral2/files/0x0007000000023444-108.dat	xmrig
behavioral2/memory/4508-96-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	xmrig
behavioral2/memory/3028-94-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	xmrig
behavioral2/memory/3088-87-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	xmrig
behavioral2/memory/2448-86-0x00007FF705400000-0x00007FF705754000-memory.dmp	xmrig
behavioral2/memory/4316-82-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	xmrig
behavioral2/memory/3032-133-0x00007FF76FB30000-0x00007FF76FE84000-memory.dmp	xmrig
behavioral2/memory/4668-134-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	xmrig
behavioral2/memory/1712-135-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	xmrig
behavioral2/memory/2448-136-0x00007FF705400000-0x00007FF705754000-memory.dmp	xmrig
behavioral2/memory/3028-137-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	xmrig
behavioral2/memory/3012-138-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	xmrig
behavioral2/memory/4780-139-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	xmrig
behavioral2/memory/3200-140-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	xmrig
behavioral2/memory/4316-141-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	xmrig
behavioral2/memory/4112-142-0x00007FF771620000-0x00007FF771974000-memory.dmp	xmrig
behavioral2/memory/3088-143-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	xmrig
behavioral2/memory/4884-144-0x00007FF746130000-0x00007FF746484000-memory.dmp	xmrig
behavioral2/memory/4508-145-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	xmrig
behavioral2/memory/1684-146-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	xmrig
behavioral2/memory/3996-147-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	xmrig
behavioral2/memory/3488-148-0x00007FF677010000-0x00007FF677364000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3200	EecfSlS.exe
4316	vCjNNuL.exe
4112	DfNoRZL.exe
3088	uNwPkey.exe
4884	oQzpwtb.exe
4508	gVjvmYt.exe
1684	jWSLRrb.exe
3996	TJqydkw.exe
3488	GmBfKCr.exe
4964	HNoMCFd.exe
4668	OGUlnAB.exe
1712	nKGFFcL.exe
2448	AZBGFxl.exe
3028	rPBQIYQ.exe
5088	XLHzPpO.exe
628	tYmLeDR.exe
2852	UrftqAG.exe
4156	qXNSzqu.exe
3012	gMrBPoD.exe
4780	mcQPbZh.exe
3032	XaBiSjB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4512-0-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	upx
behavioral2/files/0x0009000000023419-4.dat	upx
behavioral2/memory/3200-8-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	upx
behavioral2/files/0x0007000000023434-11.dat	upx
behavioral2/files/0x0007000000023435-10.dat	upx
behavioral2/memory/4112-24-0x00007FF771620000-0x00007FF771974000-memory.dmp	upx
behavioral2/files/0x0007000000023436-32.dat	upx
behavioral2/memory/4884-34-0x00007FF746130000-0x00007FF746484000-memory.dmp	upx
behavioral2/files/0x0007000000023438-37.dat	upx
behavioral2/files/0x0007000000023437-35.dat	upx
behavioral2/memory/4508-31-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	upx
behavioral2/memory/3088-30-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	upx
behavioral2/memory/4316-12-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	upx
behavioral2/files/0x0007000000023439-40.dat	upx
behavioral2/memory/1684-44-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	upx
behavioral2/files/0x000700000002343a-47.dat	upx
behavioral2/files/0x000700000002343b-52.dat	upx
behavioral2/memory/3996-50-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	upx
behavioral2/memory/3488-56-0x00007FF677010000-0x00007FF677364000-memory.dmp	upx
behavioral2/files/0x000700000002343c-58.dat	upx
behavioral2/memory/4964-62-0x00007FF790700000-0x00007FF790A54000-memory.dmp	upx
behavioral2/files/0x000700000002343d-65.dat	upx
behavioral2/memory/4668-67-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	upx
behavioral2/memory/4512-66-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp	upx
behavioral2/files/0x000700000002343e-70.dat	upx
behavioral2/memory/3200-72-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	upx
behavioral2/memory/1712-76-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-80.dat	upx
behavioral2/files/0x0007000000023440-84.dat	upx
behavioral2/files/0x0007000000023441-88.dat	upx
behavioral2/files/0x0007000000023442-101.dat	upx
behavioral2/files/0x0007000000023445-115.dat	upx
behavioral2/memory/2852-116-0x00007FF6124C0000-0x00007FF612814000-memory.dmp	upx
behavioral2/memory/4884-118-0x00007FF746130000-0x00007FF746484000-memory.dmp	upx
behavioral2/memory/3012-125-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	upx
behavioral2/files/0x0007000000023446-127.dat	upx
behavioral2/files/0x0007000000023447-131.dat	upx
behavioral2/memory/4780-126-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	upx
behavioral2/memory/628-121-0x00007FF66DDE0000-0x00007FF66E134000-memory.dmp	upx
behavioral2/memory/4156-117-0x00007FF684300000-0x00007FF684654000-memory.dmp	upx
behavioral2/memory/5088-112-0x00007FF6F0F80000-0x00007FF6F12D4000-memory.dmp	upx
behavioral2/files/0x0007000000023443-109.dat	upx
behavioral2/files/0x0007000000023444-108.dat	upx
behavioral2/memory/4508-96-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	upx
behavioral2/memory/3028-94-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	upx
behavioral2/memory/3088-87-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	upx
behavioral2/memory/2448-86-0x00007FF705400000-0x00007FF705754000-memory.dmp	upx
behavioral2/memory/4316-82-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	upx
behavioral2/memory/3032-133-0x00007FF76FB30000-0x00007FF76FE84000-memory.dmp	upx
behavioral2/memory/4668-134-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp	upx
behavioral2/memory/1712-135-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp	upx
behavioral2/memory/2448-136-0x00007FF705400000-0x00007FF705754000-memory.dmp	upx
behavioral2/memory/3028-137-0x00007FF643460000-0x00007FF6437B4000-memory.dmp	upx
behavioral2/memory/3012-138-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp	upx
behavioral2/memory/4780-139-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp	upx
behavioral2/memory/3200-140-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp	upx
behavioral2/memory/4316-141-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp	upx
behavioral2/memory/4112-142-0x00007FF771620000-0x00007FF771974000-memory.dmp	upx
behavioral2/memory/3088-143-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp	upx
behavioral2/memory/4884-144-0x00007FF746130000-0x00007FF746484000-memory.dmp	upx
behavioral2/memory/4508-145-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp	upx
behavioral2/memory/1684-146-0x00007FF682B40000-0x00007FF682E94000-memory.dmp	upx
behavioral2/memory/3996-147-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp	upx
behavioral2/memory/3488-148-0x00007FF677010000-0x00007FF677364000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\vCjNNuL.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uNwPkey.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gVjvmYt.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OGUlnAB.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AZBGFxl.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oQzpwtb.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nKGFFcL.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qXNSzqu.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mcQPbZh.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XaBiSjB.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\EecfSlS.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jWSLRrb.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rPBQIYQ.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tYmLeDR.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UrftqAG.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gMrBPoD.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DfNoRZL.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TJqydkw.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GmBfKCr.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HNoMCFd.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XLHzPpO.exe	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3200	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	81
PID 4512 wrote to memory of 3200	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	81
PID 4512 wrote to memory of 4316	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	82
PID 4512 wrote to memory of 4316	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	82
PID 4512 wrote to memory of 4112	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4512 wrote to memory of 4112	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4512 wrote to memory of 3088	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4512 wrote to memory of 3088	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4512 wrote to memory of 4884	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4512 wrote to memory of 4884	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4512 wrote to memory of 4508	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4512 wrote to memory of 4508	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4512 wrote to memory of 1684	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4512 wrote to memory of 1684	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4512 wrote to memory of 3996	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4512 wrote to memory of 3996	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4512 wrote to memory of 3488	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4512 wrote to memory of 3488	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4512 wrote to memory of 4964	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4512 wrote to memory of 4964	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4512 wrote to memory of 4668	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4512 wrote to memory of 4668	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4512 wrote to memory of 1712	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4512 wrote to memory of 1712	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4512 wrote to memory of 2448	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4512 wrote to memory of 2448	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4512 wrote to memory of 3028	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4512 wrote to memory of 3028	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4512 wrote to memory of 5088	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4512 wrote to memory of 5088	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4512 wrote to memory of 628	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4512 wrote to memory of 628	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4512 wrote to memory of 2852	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4512 wrote to memory of 2852	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4512 wrote to memory of 4156	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4512 wrote to memory of 4156	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4512 wrote to memory of 3012	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4512 wrote to memory of 3012	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4512 wrote to memory of 4780	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4512 wrote to memory of 4780	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4512 wrote to memory of 3032	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 4512 wrote to memory of 3032	4512	2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-27_680fe87d946e9d9aa74890621953a5f3_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System\EecfSlS.exe
  C:\Windows\System\EecfSlS.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\vCjNNuL.exe
  C:\Windows\System\vCjNNuL.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\DfNoRZL.exe
  C:\Windows\System\DfNoRZL.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\uNwPkey.exe
  C:\Windows\System\uNwPkey.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\oQzpwtb.exe
  C:\Windows\System\oQzpwtb.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\gVjvmYt.exe
  C:\Windows\System\gVjvmYt.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\jWSLRrb.exe
  C:\Windows\System\jWSLRrb.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\TJqydkw.exe
  C:\Windows\System\TJqydkw.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\GmBfKCr.exe
  C:\Windows\System\GmBfKCr.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\HNoMCFd.exe
  C:\Windows\System\HNoMCFd.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\OGUlnAB.exe
  C:\Windows\System\OGUlnAB.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\nKGFFcL.exe
  C:\Windows\System\nKGFFcL.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\AZBGFxl.exe
  C:\Windows\System\AZBGFxl.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\rPBQIYQ.exe
  C:\Windows\System\rPBQIYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\XLHzPpO.exe
  C:\Windows\System\XLHzPpO.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\tYmLeDR.exe
  C:\Windows\System\tYmLeDR.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\UrftqAG.exe
  C:\Windows\System\UrftqAG.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qXNSzqu.exe
  C:\Windows\System\qXNSzqu.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\gMrBPoD.exe
  C:\Windows\System\gMrBPoD.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\mcQPbZh.exe
  C:\Windows\System\mcQPbZh.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\XaBiSjB.exe
  C:\Windows\System\XaBiSjB.exe
  2⤵
  - Executes dropped EXE
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AZBGFxl.exe

Path C:\Windows\System\AZBGFxl.exe
Size 5.9MB
SHA256 14eeae7f9f365c7030de1bddc34ae26af7930edc1cecf2ec7223f2e4be5160ec
MD5 56e16b6e5a40a7e86802c691b9eb8c7e
SHA1 8cc4c1d23583355c67089ea3a17054170fdbf121
SHA512 7fa226ba0a61247eceec215b0eeb191096e063948a5f0af9ff97d029968c15c9eb0fe15f872c05e82c04545a0292aebd7c904254137ab2bb89bc092323169729
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

DfNoRZL.exe

Path C:\Windows\System\DfNoRZL.exe
Size 5.9MB
SHA256 3ed660f6c777713616ab2568b285bcc04804b5c4be6e1771286ad02ea3a38e75
MD5 0c3513e9c9665100ec2d7b0d76c968dc
SHA1 ea25efe2f66fcc9d1056868a8f1130e8198d1c80
SHA512 4dbe6de9c0e203d83734c6d1a517d40ffbeab203a89dfb89ebd37461d0fb85cf6c3f6781e7fa464e585c35714d9a218a2ab7d7ef76f006b4c4a1bb99805ed785
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

EecfSlS.exe

Path C:\Windows\System\EecfSlS.exe
Size 5.9MB
SHA256 4f1a3d4ad380ef31f3a27e3466b31a6a4218a2c2816302a4b193449231f4fbf5
MD5 1c4e2b56b3bce1717705f6abe7866484
SHA1 105fa0a97f19bb57cc46ef92adb84e887bbb0904
SHA512 3c281137cd072c6003c6116ebfb0e2d067efe25e1d8cb3e1213a5a2a1035fc77c7ca5c54e098ce9b5aa85fd1ba8b675459b119db77fc8f2f8ecdff37dcfeb608
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

GmBfKCr.exe

Path C:\Windows\System\GmBfKCr.exe
Size 5.9MB
SHA256 26bf9447f117a2d49ec1d5faa83f7db24994dcefd20e5e3cda19af17e71e8ded
MD5 ee128ed87c3cb2c57cc93c2c17841167
SHA1 ab4622f9ad5e8d525893d9454b908bab97f8d347
SHA512 a3abc56a6adbbccb5d14efc295c27d2d953330c5b8d486e0abe2325bb52c5d42171116fa4500af0149256d3f0309cafe2daffad79b844cf33d492a462e5db360
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

HNoMCFd.exe

Path C:\Windows\System\HNoMCFd.exe
Size 5.9MB
SHA256 a8f200325717338b0373cb2d6162c63a3c864df6329bbe15d067f4872a850287
MD5 a5e1b1142c2fc14af30fd70733d203df
SHA1 5c7fedcea9ba3e47a17389d0821c739bfe00feea
SHA512 20a944cd9a5b92f89e67dcb3e19fbeae69ae4fd398fdeb44945078ee31b7cb8005d29ccdf3dd3bd52d872e4b7f2870aca49a31f49adb9004788c191bb70be353
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

OGUlnAB.exe

Path C:\Windows\System\OGUlnAB.exe
Size 5.9MB
SHA256 9711b96e35d1bfe7ef617b8d39795a042e4bc5ff8dd33cebaf67c129299176ac
MD5 37cabc0a2afd4c40d0fcedb1766f9934
SHA1 60881471bc68d0fc69a5fdcd159ca45276ae87e7
SHA512 f6682e69c66a60a5f78ad6b7d725375f79e7b046bd20a609247389428e33fa9963b019a3ce2001d32f4da5e23c6703735bd5db990c15299cd04bbedfc184330e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TJqydkw.exe

Path C:\Windows\System\TJqydkw.exe
Size 5.9MB
SHA256 5df6f010b4395f54dc6fabcb33a34f3547627c8662d05d83beb704fe71fe46a6
MD5 46198abc5b762ed54c0d0fc7735f5659
SHA1 e9f2e800be8483191ec428196c29e5c931d08686
SHA512 2d7c9eac9f03e657f4c21ecd265f28b275e72c655d5d30dc30f9b02dde0fdac472ff237d26b1138b2101683baa67075b9a6be9961b490e2d206e6522ffc1f907
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

UrftqAG.exe

Path C:\Windows\System\UrftqAG.exe
Size 5.9MB
SHA256 1a33e0f92efc71843f5f857f2369d7482c6d16f8e971aada62ba023e7af36a0e
MD5 d7f80d7bbb019f0b8a0c1cc041c65ae5
SHA1 9af5497550600a4b0c0dcdf697ffcb2643a4c2e4
SHA512 ad0ad4701659221865f2bdff8046daf5ba81b36592a0b6ea060a9a3420ccc1b2a31170516a50c67d4f0fd4350ee8e6b99e49e52f6e423503e03b7cf3816f964b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

XLHzPpO.exe

Path C:\Windows\System\XLHzPpO.exe
Size 5.9MB
SHA256 304c061370b021118c9510ad8e7d120d528d666200b69ed0722ec3c9dbbd7fe5
MD5 56ee4a6fc61c0a368be0cda001f4c6aa
SHA1 27a2ad28236172525f108863e12421118fd46212
SHA512 79c9c7b289e6fc5076a9309433b82ad2650e0254054f73bfe78ac49036d780f39134c797f041ff35e8d322a6567fa77ee377e63b36806a4b1bd154e7b163af46
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

XaBiSjB.exe

Path C:\Windows\System\XaBiSjB.exe
Size 5.9MB
SHA256 604c4188afc560773286c3d7373f8bcece5fd5e8214a099a222ebd01f9cccbbf
MD5 cb7cdc3abb3819f3b21c04761d42498b
SHA1 f1fd2cfc8f784d23ee12958897b5a49e74fcba70
SHA512 bfd48c41c4d32d433b0004746495c2721c8ca9066aca723a377d8be9f3e989ac2f72af147c74723bb12ba5d5cafd69182e1f578f0ab74076c156fd156a942ee7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMrBPoD.exe

Path C:\Windows\System\gMrBPoD.exe
Size 5.9MB
SHA256 5e2f4e9e4b45edff49d4cb74c829200af469e625889840915d2aaa25b291ea6e
MD5 10300226eac31f4058fbd75167145b17
SHA1 a99a7fa74e559f3789b8f760dad65c001a6417c9
SHA512 32faa05c531a5d1c37acad192cff8b96854e20735fb3a03d0f9f93bcaefb0cd9bfb74f52e35c1379a383d9fc2377270e6f9ebd767d2629df82216d0c5703a20f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

gVjvmYt.exe

Path C:\Windows\System\gVjvmYt.exe
Size 5.9MB
SHA256 36f7ae6eede0e416e9f3141645452f46feab3710aa288f0d093fb948c5e0e8c3
MD5 3a0df42bd41cd65941e091086e32d7e6
SHA1 f32c30de06e93e94c6f30fcdbc80e7cee1186637
SHA512 3ea597440a66ba1c137b42425d93aff3bbd07391237b52ca6ff37094a4fa8384f3c5d772da68affd13ec61e6f269e97ca35bd21d14ba50213b15ffc949400da5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWSLRrb.exe

Path C:\Windows\System\jWSLRrb.exe
Size 5.9MB
SHA256 1a5660fd251d445ff29c22f3484f3353166380c2664c7b74775d2a76c9728c6b
MD5 30e09c2a6041483257501ec85a97177e
SHA1 53d59b82c41bdf5d37a41a3f25d43938e7e34e73
SHA512 8922a0017a822c71f13ff98db96d972e219118878d8469919439ecafa92c8b3fefdd05ac0f1ec12c36266c894d1c659f3c5ae9c1c00e1493e8b57f4777b1d3f2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mcQPbZh.exe

Path C:\Windows\System\mcQPbZh.exe
Size 5.9MB
SHA256 ce254581ab5cd7c451b4bc43359ea1b9d24332bb524434a1468322210d5ca2f2
MD5 22d462d8c2167d0c2d7308202f6f6fe0
SHA1 db18399d2ffcac256c0b5323f4877be2d50fbe90
SHA512 48c91c6ece9a906c7c77ab0dcf1099282cdda59be778089d0c246017ffd77576761b679324f060c82a8648feb73956bb5cd7ba4938d0ea3b8bcc4444e1691661
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

nKGFFcL.exe

Path C:\Windows\System\nKGFFcL.exe
Size 5.9MB
SHA256 947c3e3394afc529a44ea7df266bcbc61a9b553f165f2f01f455c2e3cf38d24b
MD5 17f6bf04fcd994f76c22818bc5a828f7
SHA1 4c09b054679ded33ff9c2059af5fced5da4f4e20
SHA512 157a61edac2c82b5bbd1005b381125647329ef9b33430ba2b5f1ca3fc1c6d0d6b36dde019897733121dd73d8dda16fbc3bc9e0e5591131ca62b81f88ea4eab50
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

oQzpwtb.exe

Path C:\Windows\System\oQzpwtb.exe
Size 5.9MB
SHA256 0de306b21519393ecec71ddeafe09e3e3507b17840a178d372ee5d30e9029831
MD5 d0c67e711e547e1e5e5bc211c63f3d2b
SHA1 2c15d5194ff90f365ca521a8ca1666d7ac91195e
SHA512 24b04c0d7c442f0018166e092abb45e5ae700ef1cf0f17f33422a8b7d62a362ab799cea7a2480381d724348845be0531eeb53dcb8fd02d4c98a5ee61b433cc6f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

qXNSzqu.exe

Path C:\Windows\System\qXNSzqu.exe
Size 5.9MB
SHA256 9ae4d7c509ad18d19757f39edc5e095e7544449e4ff75d12b5e65dd1f7ceaea4
MD5 805ab69b806439a677c410e109d29f91
SHA1 639925eaad8a871f17d6666f29ab10cf5f63fa78
SHA512 9f92c1af49aba0a9880af9f6be54f9cf204d2996e1b7d5f1f799c4eb4d03ed8cd94e53e4b9ae908a4b6cd809881fd3965d25675bd468528f579258c839755889
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

rPBQIYQ.exe

Path C:\Windows\System\rPBQIYQ.exe
Size 5.9MB
SHA256 5c86c990be159623a9e12836232fcc166d19607672293321c279f2a1fa0703b1
MD5 002ff5bb11fd5e86726f90b1a9dbeb08
SHA1 d3356dd0a7adbcbcbd4b1a762940278a08e82aca
SHA512 cd67e5057456d746409507fe7e7ea0ff2d03ca9b4cdf2ac6922916e7f348301523b96f188fbc2099860aa0b5645d3f4efe352d3acd731319aec1ab31e858a433
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

tYmLeDR.exe

Path C:\Windows\System\tYmLeDR.exe
Size 5.9MB
SHA256 3b730c514ec6c90aafa1ace22a7a300952dbb0a21d2c184348ac827118b252b9
MD5 d7858420dc7af7acf1ce00a6f3e229c8
SHA1 dccab8cb42756cdbc6980e0f699eacef2a8315f6
SHA512 6a643b70f685e829fcc1e3e59f63996b0bd5104d5bd768db2d8453a3772471fe8c151408235db7d0167079978490b3d909721e250a81d83f1ba33a2c3b8148fc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

uNwPkey.exe

Path C:\Windows\System\uNwPkey.exe
Size 5.9MB
SHA256 a3ed1ddeb2d27156796ad2f83ff451d8ea12574618846fcd5d431829c6ebd531
MD5 b1e56e2b2b26e6bfa116272a22bb2a27
SHA1 bc6d3b002b18db855fcdf3eea2cfa2803cd76c38
SHA512 40919626ebbbde5597f2ea9756b2d2bd1fe4a88b1462099aabf2e0bab9c5a01888c6bf85066bfb6cab796884639e757c2e13b42e2017188f7067b22f4d23ae4e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

vCjNNuL.exe

Path C:\Windows\System\vCjNNuL.exe
Size 5.9MB
SHA256 44f786f997cdb3f430c9c8f20515f8a722d19087f3a09a59326113d9f3f48e21
MD5 5cb78e57692f8e3c47195d66e3b50684
SHA1 a4462f256778641e60f834695bc8164a861a445d
SHA512 ad931df67ce9e01e2b9fd31b6898e1ff503e253c64795839b66a6da0f9bdf257837ea2142b09a924ba4bb51c88b2c6da9355ecd1d4c17344e2487d370ab4aa92
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-155-0x00007FF66DDE0000-0x00007FF66E134000-memory.dmp

Download

memory/628-121-0x00007FF66DDE0000-0x00007FF66E134000-memory.dmp

Download

memory/1684-146-0x00007FF682B40000-0x00007FF682E94000-memory.dmp

Download

memory/1684-44-0x00007FF682B40000-0x00007FF682E94000-memory.dmp

Download

memory/1712-151-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp

Download

memory/1712-135-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp

Download

memory/1712-76-0x00007FF6A1C90000-0x00007FF6A1FE4000-memory.dmp

Download

memory/2448-154-0x00007FF705400000-0x00007FF705754000-memory.dmp

Download

memory/2448-86-0x00007FF705400000-0x00007FF705754000-memory.dmp

Download

memory/2448-136-0x00007FF705400000-0x00007FF705754000-memory.dmp

Download

memory/2852-116-0x00007FF6124C0000-0x00007FF612814000-memory.dmp

Download

memory/2852-157-0x00007FF6124C0000-0x00007FF612814000-memory.dmp

Download

memory/3012-159-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp

Download

memory/3012-138-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp

Download

memory/3012-125-0x00007FF60A970000-0x00007FF60ACC4000-memory.dmp

Download

memory/3028-137-0x00007FF643460000-0x00007FF6437B4000-memory.dmp

Download

memory/3028-153-0x00007FF643460000-0x00007FF6437B4000-memory.dmp

Download

memory/3028-94-0x00007FF643460000-0x00007FF6437B4000-memory.dmp

Download

memory/3032-158-0x00007FF76FB30000-0x00007FF76FE84000-memory.dmp

Download

memory/3032-133-0x00007FF76FB30000-0x00007FF76FE84000-memory.dmp

Download

memory/3088-143-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp

Download

memory/3088-30-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp

Download

memory/3088-87-0x00007FF6EDDD0000-0x00007FF6EE124000-memory.dmp

Download

memory/3200-140-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp

Download

memory/3200-8-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp

Download

memory/3200-72-0x00007FF62DEF0000-0x00007FF62E244000-memory.dmp

Download

memory/3488-56-0x00007FF677010000-0x00007FF677364000-memory.dmp

Download

memory/3488-148-0x00007FF677010000-0x00007FF677364000-memory.dmp

Download

memory/3996-50-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp

Download

memory/3996-147-0x00007FF71D5C0000-0x00007FF71D914000-memory.dmp

Download

memory/4112-142-0x00007FF771620000-0x00007FF771974000-memory.dmp

Download

memory/4112-24-0x00007FF771620000-0x00007FF771974000-memory.dmp

Download

memory/4156-117-0x00007FF684300000-0x00007FF684654000-memory.dmp

Download

memory/4156-156-0x00007FF684300000-0x00007FF684654000-memory.dmp

Download

memory/4316-82-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp

Download

memory/4316-12-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp

Download

memory/4316-141-0x00007FF7F63F0000-0x00007FF7F6744000-memory.dmp

Download

memory/4508-31-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp

Download

memory/4508-145-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp

Download

memory/4508-96-0x00007FF6EFA20000-0x00007FF6EFD74000-memory.dmp

Download

memory/4512-0-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp

Download

memory/4512-66-0x00007FF6C1640000-0x00007FF6C1994000-memory.dmp

Download

memory/4512-1-0x000001F63C4B0000-0x000001F63C4C0000-memory.dmp

Download

memory/4668-67-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp

Download

memory/4668-134-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp

Download

memory/4668-150-0x00007FF7D9CA0000-0x00007FF7D9FF4000-memory.dmp

Download

memory/4780-139-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp

Download

memory/4780-126-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp

Download

memory/4780-160-0x00007FF7FFB80000-0x00007FF7FFED4000-memory.dmp

Download

memory/4884-144-0x00007FF746130000-0x00007FF746484000-memory.dmp

Download

memory/4884-34-0x00007FF746130000-0x00007FF746484000-memory.dmp

Download

memory/4884-118-0x00007FF746130000-0x00007FF746484000-memory.dmp

Download

memory/4964-149-0x00007FF790700000-0x00007FF790A54000-memory.dmp

Download

memory/4964-62-0x00007FF790700000-0x00007FF790A54000-memory.dmp

Download

memory/5088-152-0x00007FF6F0F80000-0x00007FF6F12D4000-memory.dmp

Download

memory/5088-112-0x00007FF6F0F80000-0x00007FF6F12D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads