cobaltstrike | b887dfb4d00ea232b7cfdd3c43bbfa584cdaca2994b7973085d3542c9d2926bb

Analysis

max time kernel
140s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
Size 5.2MB
Sample240825-nxsl2avalj
SHA256 b887dfb4d00ea232b7cfdd3c43bbfa584cdaca2994b7973085d3542c9d2926bb
MD5 180975eb63700fdae191d714bf3970b8
SHA1 f11cc087acda9e7683df8f9399995748afbc1cb3
SHA512 b8c2bec536d7e727ac7c3516e56a2a8eda51f78683c161ae54c219e8c08a9aec6ee253d27c33a89a9d925e4ab3c50b485034931db8bc643fbd2da94722ef40c3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00080000000120fe-3.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001727e-14.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016e09-8.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000017530-16.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000175ae-23.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000186ca-26.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000186cc-31.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000186d9-35.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019604-43.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019605-47.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001961c-67.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001961e-70.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000196a1-78.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019926-82.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019c34-86.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019667-74.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001960c-62.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001960a-58.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019608-55.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019606-50.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000018710-38.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-130-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/1808-133-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2452-132-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/2656-128-0x000000013FDB0000-0x0000000140101000-memory.dmp	xmrig
behavioral1/memory/2728-126-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2308-124-0x000000013F240000-0x000000013F591000-memory.dmp	xmrig
behavioral1/memory/3032-123-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/2596-121-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/3000-119-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/848-118-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/444-117-0x000000013FB00000-0x000000013FE51000-memory.dmp	xmrig
behavioral1/memory/2948-115-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/1816-113-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/848-112-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/2236-111-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2920-109-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/848-134-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/848-136-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2576-156-0x000000013FBD0000-0x000000013FF21000-memory.dmp	xmrig
behavioral1/memory/2516-155-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	xmrig
behavioral1/memory/2560-154-0x000000013F1D0000-0x000000013F521000-memory.dmp	xmrig
behavioral1/memory/2640-153-0x000000013F9C0000-0x000000013FD11000-memory.dmp	xmrig
behavioral1/memory/2860-152-0x000000013FCF0000-0x0000000140041000-memory.dmp	xmrig
behavioral1/memory/2376-151-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig
behavioral1/memory/3048-150-0x000000013F890000-0x000000013FBE1000-memory.dmp	xmrig
behavioral1/memory/848-157-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2452-224-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/1808-228-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2920-227-0x000000013F910000-0x000000013FC61000-memory.dmp	xmrig
behavioral1/memory/2948-234-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/2236-232-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/1816-231-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/2728-257-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2656-254-0x000000013FDB0000-0x0000000140101000-memory.dmp	xmrig
behavioral1/memory/2308-250-0x000000013F240000-0x000000013F591000-memory.dmp	xmrig
behavioral1/memory/2760-245-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2596-242-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/3032-241-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	xmrig
behavioral1/memory/444-238-0x000000013FB00000-0x000000013FE51000-memory.dmp	xmrig
behavioral1/memory/3000-237-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2452	HqrePMa.exe
1808	NXtETce.exe
2920	vRxpjmD.exe
2236	rhNrLeW.exe
1816	nqyHgUi.exe
2948	AWDYyjC.exe
444	GqXuXhZ.exe
3000	QVBaQWR.exe
2596	BxmgyeX.exe
3032	cuvHnrd.exe
2308	KhAtDbd.exe
2728	ZUEwSpt.exe
2656	HUhhXff.exe
2760	SjuYTuO.exe
3048	RYmnUqR.exe
2376	mDCcFfB.exe
2860	PyUHdMJ.exe
2640	hpBxAQL.exe
2560	ulwzBMl.exe
2516	kctBFIa.exe
2576	bLUouQE.exe

Loads dropped DLL 21 IoCs

pid	Process
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/848-0-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-3.dat	upx
behavioral1/files/0x000800000001727e-14.dat	upx
behavioral1/files/0x0008000000016e09-8.dat	upx
behavioral1/files/0x0008000000017530-16.dat	upx
behavioral1/files/0x00080000000175ae-23.dat	upx
behavioral1/files/0x00060000000186ca-26.dat	upx
behavioral1/files/0x00060000000186cc-31.dat	upx
behavioral1/files/0x00060000000186d9-35.dat	upx
behavioral1/files/0x0005000000019604-43.dat	upx
behavioral1/files/0x0005000000019605-47.dat	upx
behavioral1/files/0x000500000001961c-67.dat	upx
behavioral1/files/0x000500000001961e-70.dat	upx
behavioral1/files/0x00050000000196a1-78.dat	upx
behavioral1/files/0x0005000000019926-82.dat	upx
behavioral1/files/0x0005000000019c34-86.dat	upx
behavioral1/memory/2760-130-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/1808-133-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/memory/2452-132-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/memory/2656-128-0x000000013FDB0000-0x0000000140101000-memory.dmp	upx
behavioral1/memory/2728-126-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2308-124-0x000000013F240000-0x000000013F591000-memory.dmp	upx
behavioral1/memory/3032-123-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/memory/2596-121-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/3000-119-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/444-117-0x000000013FB00000-0x000000013FE51000-memory.dmp	upx
behavioral1/memory/2948-115-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/memory/1816-113-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/memory/2236-111-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/2920-109-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/files/0x0005000000019667-74.dat	upx
behavioral1/files/0x000500000001960c-62.dat	upx
behavioral1/files/0x000500000001960a-58.dat	upx
behavioral1/files/0x0005000000019608-55.dat	upx
behavioral1/files/0x0005000000019606-50.dat	upx
behavioral1/files/0x0008000000018710-38.dat	upx
behavioral1/memory/848-134-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/848-136-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2576-156-0x000000013FBD0000-0x000000013FF21000-memory.dmp	upx
behavioral1/memory/2516-155-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	upx
behavioral1/memory/2560-154-0x000000013F1D0000-0x000000013F521000-memory.dmp	upx
behavioral1/memory/2640-153-0x000000013F9C0000-0x000000013FD11000-memory.dmp	upx
behavioral1/memory/2860-152-0x000000013FCF0000-0x0000000140041000-memory.dmp	upx
behavioral1/memory/2376-151-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/memory/3048-150-0x000000013F890000-0x000000013FBE1000-memory.dmp	upx
behavioral1/memory/848-157-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2452-224-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/memory/1808-228-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/memory/2920-227-0x000000013F910000-0x000000013FC61000-memory.dmp	upx
behavioral1/memory/2948-234-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/memory/2236-232-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/1816-231-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/memory/2728-257-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2656-254-0x000000013FDB0000-0x0000000140101000-memory.dmp	upx
behavioral1/memory/2308-250-0x000000013F240000-0x000000013F591000-memory.dmp	upx
behavioral1/memory/2760-245-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/2596-242-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/3032-241-0x000000013FBA0000-0x000000013FEF1000-memory.dmp	upx
behavioral1/memory/444-238-0x000000013FB00000-0x000000013FE51000-memory.dmp	upx
behavioral1/memory/3000-237-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\hpBxAQL.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nqyHgUi.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AWDYyjC.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QVBaQWR.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cuvHnrd.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NXtETce.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KhAtDbd.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HUhhXff.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mDCcFfB.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PyUHdMJ.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kctBFIa.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rhNrLeW.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GqXuXhZ.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SjuYTuO.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RYmnUqR.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ulwzBMl.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bLUouQE.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HqrePMa.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vRxpjmD.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BxmgyeX.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZUEwSpt.exe	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2452	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 848 wrote to memory of 2452	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 848 wrote to memory of 2452	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 848 wrote to memory of 2920	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 848 wrote to memory of 2920	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 848 wrote to memory of 2920	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 848 wrote to memory of 1808	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 848 wrote to memory of 1808	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 848 wrote to memory of 1808	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 848 wrote to memory of 2236	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 848 wrote to memory of 2236	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 848 wrote to memory of 2236	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 848 wrote to memory of 1816	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 848 wrote to memory of 1816	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 848 wrote to memory of 1816	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 848 wrote to memory of 2948	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 848 wrote to memory of 2948	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 848 wrote to memory of 2948	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 848 wrote to memory of 444	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 848 wrote to memory of 444	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 848 wrote to memory of 444	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 848 wrote to memory of 3000	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 848 wrote to memory of 3000	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 848 wrote to memory of 3000	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 848 wrote to memory of 2596	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 848 wrote to memory of 2596	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 848 wrote to memory of 2596	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 848 wrote to memory of 3032	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 848 wrote to memory of 3032	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 848 wrote to memory of 3032	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 848 wrote to memory of 2308	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 848 wrote to memory of 2308	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 848 wrote to memory of 2308	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 848 wrote to memory of 2728	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 848 wrote to memory of 2728	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 848 wrote to memory of 2728	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 848 wrote to memory of 2656	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 848 wrote to memory of 2656	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 848 wrote to memory of 2656	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 848 wrote to memory of 2760	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 848 wrote to memory of 2760	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 848 wrote to memory of 2760	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 848 wrote to memory of 3048	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 848 wrote to memory of 3048	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 848 wrote to memory of 3048	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 848 wrote to memory of 2376	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 848 wrote to memory of 2376	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 848 wrote to memory of 2376	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 848 wrote to memory of 2860	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 848 wrote to memory of 2860	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 848 wrote to memory of 2860	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 848 wrote to memory of 2640	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 848 wrote to memory of 2640	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 848 wrote to memory of 2640	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 848 wrote to memory of 2560	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 848 wrote to memory of 2560	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 848 wrote to memory of 2560	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 848 wrote to memory of 2516	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 848 wrote to memory of 2516	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 848 wrote to memory of 2516	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 848 wrote to memory of 2576	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 848 wrote to memory of 2576	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 848 wrote to memory of 2576	848	2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe	49

C:\Users\Admin\AppData\Local\Temp\2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_180975eb63700fdae191d714bf3970b8_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\System\HqrePMa.exe
  C:\Windows\System\HqrePMa.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\vRxpjmD.exe
  C:\Windows\System\vRxpjmD.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\NXtETce.exe
  C:\Windows\System\NXtETce.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\rhNrLeW.exe
  C:\Windows\System\rhNrLeW.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\nqyHgUi.exe
  C:\Windows\System\nqyHgUi.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\AWDYyjC.exe
  C:\Windows\System\AWDYyjC.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\GqXuXhZ.exe
  C:\Windows\System\GqXuXhZ.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\QVBaQWR.exe
  C:\Windows\System\QVBaQWR.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\BxmgyeX.exe
  C:\Windows\System\BxmgyeX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\cuvHnrd.exe
  C:\Windows\System\cuvHnrd.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\KhAtDbd.exe
  C:\Windows\System\KhAtDbd.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZUEwSpt.exe
  C:\Windows\System\ZUEwSpt.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\HUhhXff.exe
  C:\Windows\System\HUhhXff.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\SjuYTuO.exe
  C:\Windows\System\SjuYTuO.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\RYmnUqR.exe
  C:\Windows\System\RYmnUqR.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\mDCcFfB.exe
  C:\Windows\System\mDCcFfB.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\PyUHdMJ.exe
  C:\Windows\System\PyUHdMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\hpBxAQL.exe
  C:\Windows\System\hpBxAQL.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ulwzBMl.exe
  C:\Windows\System\ulwzBMl.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\kctBFIa.exe
  C:\Windows\System\kctBFIa.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\bLUouQE.exe
  C:\Windows\System\bLUouQE.exe
  2⤵
  - Executes dropped EXE
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AWDYyjC.exe

Path C:\Windows\system\AWDYyjC.exe
Size 5.2MB
SHA256 7beb1f8920c53bfd906b867402b77e3ae9fd0f2d21a14ffcf85ac5c3f99128e8
MD5 9d601c274fbf2693da14b87d5eb69dee
SHA1 4ade219b93de8d277bd0e1ac870ba9449192a973
SHA512 fbc84873793432afc71b6e79e30e175998f4566aad310c457e0b7fae23c83cb364be5e6bcbc5081603597ef6f54021a5cf7884e34a2d366dd3f777ecbd4a14fa
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

BxmgyeX.exe

Path C:\Windows\system\BxmgyeX.exe
Size 5.2MB
SHA256 0d3edd1f15922cb15b59a981fb120b5d4cfdc10b3fb5dcd14e0a7f0fb3f94bef
MD5 0f878440af98aa91d9215b288a405abd
SHA1 68d8719a4eda090340f3508ed69025e2c33702cf
SHA512 53526948d5171b9a431f680d77016c716bd9d9ad88c9afe2b648d97e16d3522c2cb9f99e2cc245dfd8ab4869e4fb1c0abe87ce4c03cf3a8572845a9bc93ffd3c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

GqXuXhZ.exe

Path C:\Windows\system\GqXuXhZ.exe
Size 5.2MB
SHA256 f32f7ffc22889985f33ea00b3c76454cad64a989890ae84c6e092f88460b9d4c
MD5 a2ef37e91b72944c69f23ff58a813a83
SHA1 9e3baac6f741d96289ca1d3c0c4f4b33cac68ab2
SHA512 aefb48ff19e056da2188799f04196479921500a6c7cfe64d2fe4d7c41f08e6f42a4f39652aa9f70e243e9ad0822d4affc5a70944d42823135db69a7466ff76cf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUhhXff.exe

Path C:\Windows\system\HUhhXff.exe
Size 5.2MB
SHA256 1ba46789dd72055f7478350e1ca0b82da6539a08fb9303ecb26add14341739f4
MD5 2fe4cf7e2f8dd58dd53c8c9aa940e722
SHA1 4ffbb8f12d86d1a6b923c488469812a698f11587
SHA512 0efbb48db9ec0d9a3ccbc833c43e8f438aca125f303087426416e88aadcac8fa5feb7114599e6999f42393f9ea2186aa97390c2fa74f139f0964c3b38e175b97
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

KhAtDbd.exe

Path C:\Windows\system\KhAtDbd.exe
Size 5.2MB
SHA256 d4c31399b12c467ef6f8b8aefe824f02690abe17999f95eb74c4b4d823809d63
MD5 69516a03055c7053272943e95ebedc8a
SHA1 39a1352712a1ace241796e919417640ab1b5e667
SHA512 04ca6caadfaad6ca67d3e0ba411c659bece1d21f76f1ef7ac08b6f163e479f4a7fae5d9a51075041a5c615fd05b55d6db3761884edf682b92c1de1750003972c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

NXtETce.exe

Path C:\Windows\system\NXtETce.exe
Size 5.2MB
SHA256 3fa93bf75bec41bd48f50bfe5c73776039453d23bdd29c42057b884f6797d508
MD5 a61f98df6192d3eb3bf4f9efb1ae5fe8
SHA1 92f3d1b6040ce0efeac65a7e20a6f7228b9bbbf7
SHA512 3dfb841bc62a0fec7fdb1aaf79c1f35f89405015ad28fb2533094dca8bb1cc91004e26cda50f7e7abd2d5b2d8190c49f67f60791262147c747a34ebd18a89fc3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

PyUHdMJ.exe

Path C:\Windows\system\PyUHdMJ.exe
Size 5.2MB
SHA256 f39d05d1d3bbead1b7a9b99df2594e0fbe33213c34d38b2c51cc19c62077c2c9
MD5 db66dfc3e04ee1b27ae859ad5c9c1afb
SHA1 8c7b89b4892b3fdc7e58cc48d5c7e1eb3afad316
SHA512 5c79cfe217231f1c2206bc4687ff435b5290c674597dd37ca44f4261137c8dd62d51c086075e63a28e9b30673129d0d171bb764cab304a1e22b74e599833e2b8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

QVBaQWR.exe

Path C:\Windows\system\QVBaQWR.exe
Size 5.2MB
SHA256 67255e02724642a5741681cdeed3c78f8aa4cc3769851825bd595fd0b1b6fce4
MD5 c748e571296201bb26dc95f983951635
SHA1 534d57291f244affd7771d0a0b0c19709c2cfecc
SHA512 5f86e20803ab2e5261f241049c5ca072f38215cceea71fe8cbccc5328b6f31293c1beea6fdf210bff5214e61ac1a6613825fe6a99c239e8b5395053816116880
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RYmnUqR.exe

Path C:\Windows\system\RYmnUqR.exe
Size 5.2MB
SHA256 3854867bab972278880a28cd301bfc62f4b0192c77fe6f94bd61a7b4d165a5c7
MD5 624f5bacba48b617017c3aa2176a2d59
SHA1 1d875e505c96e15d59988baa6565a08c136af30b
SHA512 c3644c23dad89d71e95511e82770dec06e2333e0d466615b2c15867e007982e98d7ce5f76de85bbbff3a34ef735d5cf094b7759ce54f61db6de03a0a0aa45eed
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjuYTuO.exe

Path C:\Windows\system\SjuYTuO.exe
Size 5.2MB
SHA256 44a351afed950d865e00e601137d988ffd9157f149692ccd219495bb85a45cd7
MD5 cdb65ee835c0c92a17b5f0ab5a82a264
SHA1 fd119cb367a98532250365dd83b6994ca2811aff
SHA512 1927fe227ef041b6b2d4eb94276d170c77490d3545191849cdd2e0c0b0cde98d29a5a617f014dce3e26d328063bf7ce487731ab3d5bf890c0bc7fd8660ff1298
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZUEwSpt.exe

Path C:\Windows\system\ZUEwSpt.exe
Size 5.2MB
SHA256 5c0f3e2213066d31ffeb3021e6c712e27812f52c4e0c363d4f5472c7ed9dd2b7
MD5 fec2d90f48fa2dd3d074cf9a1d167e33
SHA1 1f91ee5c0ec051c7fd38a84967c658f6f6373982
SHA512 1757292cdb798e6d223947baeb85a82783411c10adb2a86b32b70bf409cc123e9c98c20933e2085807cffee8c1a74859b6876339e99def03b8524a84333181b6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

bLUouQE.exe

Path C:\Windows\system\bLUouQE.exe
Size 5.2MB
SHA256 8401fa3ac3d12cd6b7299b278aade8c1145d2525d23856ad091aa213013e2a31
MD5 2071cf626f658ef17ba442d22fb2d200
SHA1 894b1f18cd932809825b55fe8949dea5bdb2b5e1
SHA512 2da3931df7a39ab14af2abbe443f411868801636c2b6e43c69609aabe842aea016bf5fb11d68212ce92fdc98f6d7d2ac2db764aa4b13a29b7c0a52b0f4125ad4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

cuvHnrd.exe

Path C:\Windows\system\cuvHnrd.exe
Size 5.2MB
SHA256 3572668d66ec7911846f8d74cb40bfe11047d2d9dea70895b51ca1b7e5cf069d
MD5 badc157b2f81456ef8489f5e3aa9d259
SHA1 a3143ba71380d03fba34fd58a9ddf29ff1a31d36
SHA512 8745b25416a9049d365a65cfc19babb285fb6fd8c54e6217646f28a29563a85b3f0a12128e042de9c897bdce3980eea3f9f1e907fe95450f875fef1ab043dfcf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpBxAQL.exe

Path C:\Windows\system\hpBxAQL.exe
Size 5.2MB
SHA256 0760ce15976585b35a410d1ee1cfab85d37e142bc8d86bce7990887549021fe5
MD5 774248527f0c21f43662cb834a51f191
SHA1 e684011d8aaa990a7146ddbc767c6755a86ec2ad
SHA512 cfc47d2c1cbc9b44f123ee9a0ac1eb4568d609e7a2b6219f93fd365bb7c9361abd5561588425191fda26d6dbbbc572317a1ccec4afe3a6a36cfdfdcce12c6837
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

kctBFIa.exe

Path C:\Windows\system\kctBFIa.exe
Size 5.2MB
SHA256 3ba162220fbe47faed2dc668d9eedc6cc186c7ffc8d114bf5adcf08ac6478b18
MD5 a9a871682553182ba854b7596cf27486
SHA1 b435cba18b307e26e3ae2aa475b2fd9a6432812e
SHA512 1e9f4d1c76e2bce6a364224404ef757133110a58e782574b8adccb08ae813eaade87f4ea5f61631cc926cc8e526ae40fc0efee93d1a8d0d26167e0b2be03b4bd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mDCcFfB.exe

Path C:\Windows\system\mDCcFfB.exe
Size 5.2MB
SHA256 b904c5c68f9b850448cfeacde6a616ddd8b3fcd0881a95031b460507ee628ff2
MD5 7130a7e256cc80b3f01d15863bb29bac
SHA1 92ef15e9c666f638d631d0e76dd8e5ddb5d4e1fb
SHA512 3ba15ef06b4504caf5253218ba33879effd84f51a8ceb08ade6886340f6321ee1622e6ddeb208f77baf2853f9ae057a62110a5dc7804ba60511fcebf7dd1ef23
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

nqyHgUi.exe

Path C:\Windows\system\nqyHgUi.exe
Size 5.2MB
SHA256 858c5492d88f2d2cc1129870e142173c7c42dcf476daf46005308c0b31ce1961
MD5 1a686c2bdf0cff1dd1b45b428c37c455
SHA1 6e852861298b65d8dd4b21e582516b504d0863a7
SHA512 901e914be7a39416a0c3cfce8aa80964d052551cc1cfc7012ec0629104128b5d6422c0d549d352f2d803d2f91b5e4376d7017543df61fea6eb9986123fa2ec67
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ulwzBMl.exe

Path C:\Windows\system\ulwzBMl.exe
Size 5.2MB
SHA256 17cb6cfefd33cf5cadfec245ba414834a78294ed90b8e0f81a1c85c0072e5685
MD5 6b40030d8581de21c2c7eee580f97708
SHA1 9ad307ed112b788c4b8ac4fb2296ca55da446985
SHA512 d64960670980c0de35dbd2199a7816ae70556e5420e559a751194374344b417d3e2f01ddb6ff1d437dae7681b87ea6fdbc1785a7bd5f158b7238a6f20b33cbcf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

vRxpjmD.exe

Path C:\Windows\system\vRxpjmD.exe
Size 5.2MB
SHA256 334e95ebce26d0a4169fdb584c9d3741b6edcb5cd9ed9c55ef1bbf34f05f9b7f
MD5 7f9a0d53fc9fb5e8667cbf118e61a961
SHA1 d973cc051d7a2168162d4b8797fbe35766fc47a3
SHA512 bcb482bff0699b01fd4e4bf5f79ff28ff5449c4bfc935bbf1476bedfd8efe5df924f975b0ef32be9302fb8456f99f8bb809645afb48787f6fcd21af228b190e2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUu
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqrePMa.exe

Path \Windows\system\HqrePMa.exe
Size 5.2MB
SHA256 45480908a35f68c5e969677bc211259682a155fdf9ceb231d760a5c6ea09e05f
MD5 966f2a121292f4a29d60c887c45cd522
SHA1 6e95144d4dc5eecd84b2815140f0d67dcb744309
SHA512 3c98b702474c7c4181c4999f540dc314820e610c1537f6dd0d805862abd9aade8db58f6324d00c51d8406d159a7282a98f727f5e72044522e1d2edd991285e5c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhNrLeW.exe

Path \Windows\system\rhNrLeW.exe
Size 5.2MB
SHA256 70bc39f8954f4c60f388aebe7963ffa439e0aac4504bcdbb408537b9966468c8
MD5 a0a9c6bb2b832ac5367043de4c833b14
SHA1 4cb79d7be3158fce946c543a454d11961b85aa01
SHA512 bb313c54515157b33cdb52a7b4903fc4534755ee1032b31113d243696421aa14e66fdd7ae8f40c2dc1fe94bece54823bfac797a13d7ecfc263aee44ed5fb3061
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-117-0x000000013FB00000-0x000000013FE51000-memory.dmp

Download

memory/444-238-0x000000013FB00000-0x000000013FE51000-memory.dmp

Download

memory/848-125-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/848-114-0x0000000002360000-0x00000000026B1000-memory.dmp

Download

memory/848-134-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/848-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

memory/848-0-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/848-122-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Download

memory/848-131-0x000000013F890000-0x000000013FBE1000-memory.dmp

Download

memory/848-120-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/848-157-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/848-118-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/848-127-0x000000013FDB0000-0x0000000140101000-memory.dmp

Download

memory/848-116-0x000000013FB00000-0x000000013FE51000-memory.dmp

Download

memory/848-129-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/848-101-0x000000013F910000-0x000000013FC61000-memory.dmp

Download

memory/848-108-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/848-112-0x000000013FD80000-0x00000001400D1000-memory.dmp

Download

memory/848-136-0x000000013F510000-0x000000013F861000-memory.dmp

Download

memory/848-110-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/1808-228-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/1808-133-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/1816-113-0x000000013FD80000-0x00000001400D1000-memory.dmp

Download

memory/1816-231-0x000000013FD80000-0x00000001400D1000-memory.dmp

Download

memory/2236-111-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/2236-232-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/2308-250-0x000000013F240000-0x000000013F591000-memory.dmp

Download

memory/2308-124-0x000000013F240000-0x000000013F591000-memory.dmp

Download

memory/2376-151-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Download

memory/2452-132-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Download

memory/2452-224-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Download

memory/2516-155-0x000000013F0A0000-0x000000013F3F1000-memory.dmp

Download

memory/2560-154-0x000000013F1D0000-0x000000013F521000-memory.dmp

Download

memory/2576-156-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Download

memory/2596-242-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2596-121-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2640-153-0x000000013F9C0000-0x000000013FD11000-memory.dmp

Download

memory/2656-128-0x000000013FDB0000-0x0000000140101000-memory.dmp

Download

memory/2656-254-0x000000013FDB0000-0x0000000140101000-memory.dmp

Download

memory/2728-257-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2728-126-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2760-130-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/2760-245-0x000000013FE40000-0x0000000140191000-memory.dmp

Download

memory/2860-152-0x000000013FCF0000-0x0000000140041000-memory.dmp

Download

memory/2920-227-0x000000013F910000-0x000000013FC61000-memory.dmp

Download

memory/2920-109-0x000000013F910000-0x000000013FC61000-memory.dmp

Download

memory/2948-234-0x000000013F650000-0x000000013F9A1000-memory.dmp

Download

memory/2948-115-0x000000013F650000-0x000000013F9A1000-memory.dmp

Download

memory/3000-119-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/3000-237-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/3032-123-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Download

memory/3032-241-0x000000013FBA0000-0x000000013FEF1000-memory.dmp

Download

memory/3048-150-0x000000013F890000-0x000000013FBE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads