cobaltstrike | a46c616f9f113294a8bbe7db4c3d5102805abbab78d747a3a6752ce2a15006b6

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/10/2024, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
Size 5.2MB
Sample241027-e6931atenb
SHA256 a46c616f9f113294a8bbe7db4c3d5102805abbab78d747a3a6752ce2a15006b6
MD5 df2cd50a48bf0ed8b685da5e003b78cb
SHA1 a106a8e7b4c4d91e7fa7e3cb254c8a6246d14a04
SHA512 a59e3fdc418fc9656f92cacf4a966f8e4d3e8705dfdbf1d389829fa0611e9093d7982c46d8f96daa682a65c333fa2d550774086ee074045a364ae30d6e3b1504
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibd56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000a00000001202c-6.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015f4f-23.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015fdb-24.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015e8f-7.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015ef6-15.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016485-44.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015d33-31.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016307-37.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001925b-56.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001932a-71.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001946b-101.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019429-98.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001939c-88.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001938a-81.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001941b-94.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001938e-87.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019377-76.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001930d-66.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001925d-61.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016621-51.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016239-36.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral1/memory/352-18-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/1000-120-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2496-118-0x000000013F320000-0x000000013F671000-memory.dmp	xmrig
behavioral1/memory/2452-116-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/1000-114-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/352-110-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2844-109-0x000000013FFE0000-0x0000000140331000-memory.dmp	xmrig
behavioral1/memory/1984-108-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2960-121-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2640-128-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig
behavioral1/memory/2752-137-0x000000013F930000-0x000000013FC81000-memory.dmp	xmrig
behavioral1/memory/2708-129-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2844-147-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig
behavioral1/memory/2844-148-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2796-146-0x000000013F530000-0x000000013F881000-memory.dmp	xmrig
behavioral1/memory/2084-144-0x000000013FE30000-0x0000000140181000-memory.dmp	xmrig
behavioral1/memory/2816-143-0x000000013FFA0000-0x00000001402F1000-memory.dmp	xmrig
behavioral1/memory/2676-142-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2652-139-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/1788-136-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2492-135-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/3068-134-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2600-133-0x000000013FA50000-0x000000013FDA1000-memory.dmp	xmrig
behavioral1/memory/2532-132-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2636-131-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2108-130-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/2844-151-0x000000013FFE0000-0x0000000140331000-memory.dmp	xmrig
behavioral1/memory/352-204-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2452-206-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/1984-208-0x000000013F990000-0x000000013FCE1000-memory.dmp	xmrig
behavioral1/memory/2496-210-0x000000013F320000-0x000000013F671000-memory.dmp	xmrig
behavioral1/memory/2652-222-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/2676-224-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2960-226-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2816-228-0x000000013FFA0000-0x00000001402F1000-memory.dmp	xmrig
behavioral1/memory/2084-230-0x000000013FE30000-0x0000000140181000-memory.dmp	xmrig
behavioral1/memory/2796-232-0x000000013F530000-0x000000013F881000-memory.dmp	xmrig
behavioral1/memory/2640-234-0x000000013F1E0000-0x000000013F531000-memory.dmp	xmrig
behavioral1/memory/2708-236-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2108-238-0x000000013FD70000-0x00000001400C1000-memory.dmp	xmrig
behavioral1/memory/1000-255-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
352	FCERGWZ.exe
1984	gtxAIvM.exe
2452	uPPyebN.exe
2496	mquPQIX.exe
1000	KXMYMgK.exe
2960	CKuHHgU.exe
2652	TAZVylb.exe
2676	bGQssQH.exe
2816	WSCqWsH.exe
2084	lYRZdRa.exe
2796	fwGhAPA.exe
2640	lEYykPZ.exe
2708	fOPiDzY.exe
2108	hjPquFn.exe
2636	zRMvMXv.exe
2532	XkcILPv.exe
2600	SdVxgiL.exe
2492	QqtTUTW.exe
3068	YmKNfUq.exe
2752	dSUBEmy.exe
1788	uQkshDF.exe

Loads dropped DLL 21 IoCs

pid	Process
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2844-0-0x000000013FFE0000-0x0000000140331000-memory.dmp	upx
behavioral1/files/0x000a00000001202c-6.dat	upx
behavioral1/files/0x0008000000015f4f-23.dat	upx
behavioral1/files/0x0008000000015fdb-24.dat	upx
behavioral1/files/0x0008000000015e8f-7.dat	upx
behavioral1/memory/352-18-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/files/0x0008000000015ef6-15.dat	upx
behavioral1/files/0x0007000000016485-44.dat	upx
behavioral1/files/0x0008000000015d33-31.dat	upx
behavioral1/files/0x0007000000016307-37.dat	upx
behavioral1/files/0x000500000001925b-56.dat	upx
behavioral1/files/0x000500000001932a-71.dat	upx
behavioral1/files/0x000500000001946b-101.dat	upx
behavioral1/files/0x0005000000019429-98.dat	upx
behavioral1/files/0x000500000001939c-88.dat	upx
behavioral1/files/0x000500000001938a-81.dat	upx
behavioral1/files/0x000500000001941b-94.dat	upx
behavioral1/files/0x000500000001938e-87.dat	upx
behavioral1/files/0x0005000000019377-76.dat	upx
behavioral1/files/0x000500000001930d-66.dat	upx
behavioral1/files/0x000500000001925d-61.dat	upx
behavioral1/files/0x0008000000016621-51.dat	upx
behavioral1/files/0x0007000000016239-36.dat	upx
behavioral1/memory/1000-120-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2496-118-0x000000013F320000-0x000000013F671000-memory.dmp	upx
behavioral1/memory/2452-116-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/memory/1000-114-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/352-110-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2844-109-0x000000013FFE0000-0x0000000140331000-memory.dmp	upx
behavioral1/memory/1984-108-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/memory/2960-121-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2640-128-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/memory/2752-137-0x000000013F930000-0x000000013FC81000-memory.dmp	upx
behavioral1/memory/2708-129-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2796-146-0x000000013F530000-0x000000013F881000-memory.dmp	upx
behavioral1/memory/2084-144-0x000000013FE30000-0x0000000140181000-memory.dmp	upx
behavioral1/memory/2816-143-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/memory/2676-142-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/memory/2652-139-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/memory/1788-136-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/memory/2492-135-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/3068-134-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2600-133-0x000000013FA50000-0x000000013FDA1000-memory.dmp	upx
behavioral1/memory/2532-132-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2636-131-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2108-130-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/2844-151-0x000000013FFE0000-0x0000000140331000-memory.dmp	upx
behavioral1/memory/352-204-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2452-206-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/memory/1984-208-0x000000013F990000-0x000000013FCE1000-memory.dmp	upx
behavioral1/memory/2496-210-0x000000013F320000-0x000000013F671000-memory.dmp	upx
behavioral1/memory/2652-222-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/memory/2676-224-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/memory/2960-226-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2816-228-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/memory/2084-230-0x000000013FE30000-0x0000000140181000-memory.dmp	upx
behavioral1/memory/2796-232-0x000000013F530000-0x000000013F881000-memory.dmp	upx
behavioral1/memory/2640-234-0x000000013F1E0000-0x000000013F531000-memory.dmp	upx
behavioral1/memory/2708-236-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2108-238-0x000000013FD70000-0x00000001400C1000-memory.dmp	upx
behavioral1/memory/1000-255-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QqtTUTW.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bGQssQH.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fwGhAPA.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lEYykPZ.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fOPiDzY.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hjPquFn.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\YmKNfUq.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WSCqWsH.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SdVxgiL.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uQkshDF.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mquPQIX.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TAZVylb.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lYRZdRa.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XkcILPv.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dSUBEmy.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FCERGWZ.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uPPyebN.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gtxAIvM.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KXMYMgK.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CKuHHgU.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zRMvMXv.exe	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 352	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2844 wrote to memory of 352	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2844 wrote to memory of 352	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2844 wrote to memory of 2452	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2844 wrote to memory of 2452	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2844 wrote to memory of 2452	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2844 wrote to memory of 1984	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2844 wrote to memory of 1984	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2844 wrote to memory of 1984	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2844 wrote to memory of 2496	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2844 wrote to memory of 2496	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2844 wrote to memory of 2496	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2844 wrote to memory of 1000	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2844 wrote to memory of 1000	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2844 wrote to memory of 1000	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2844 wrote to memory of 2960	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2844 wrote to memory of 2960	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2844 wrote to memory of 2960	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2844 wrote to memory of 2652	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2844 wrote to memory of 2652	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2844 wrote to memory of 2652	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2844 wrote to memory of 2816	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2844 wrote to memory of 2816	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2844 wrote to memory of 2816	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2844 wrote to memory of 2676	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2844 wrote to memory of 2676	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2844 wrote to memory of 2676	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2844 wrote to memory of 2084	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2844 wrote to memory of 2084	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2844 wrote to memory of 2084	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2844 wrote to memory of 2796	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2844 wrote to memory of 2796	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2844 wrote to memory of 2796	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2844 wrote to memory of 2640	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2844 wrote to memory of 2640	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2844 wrote to memory of 2640	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2844 wrote to memory of 2708	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2844 wrote to memory of 2708	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2844 wrote to memory of 2708	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2844 wrote to memory of 2108	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2844 wrote to memory of 2108	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2844 wrote to memory of 2108	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2844 wrote to memory of 2636	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2844 wrote to memory of 2636	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2844 wrote to memory of 2636	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2844 wrote to memory of 2532	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2844 wrote to memory of 2532	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2844 wrote to memory of 2532	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2844 wrote to memory of 2600	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2844 wrote to memory of 2600	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2844 wrote to memory of 2600	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2844 wrote to memory of 3068	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2844 wrote to memory of 3068	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2844 wrote to memory of 3068	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2844 wrote to memory of 2492	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2844 wrote to memory of 2492	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2844 wrote to memory of 2492	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2844 wrote to memory of 1788	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2844 wrote to memory of 1788	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2844 wrote to memory of 1788	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2844 wrote to memory of 2752	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2844 wrote to memory of 2752	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2844 wrote to memory of 2752	2844	2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe	49

C:\Users\Admin\AppData\Local\Temp\2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-27_df2cd50a48bf0ed8b685da5e003b78cb_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System\FCERGWZ.exe
  C:\Windows\System\FCERGWZ.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\uPPyebN.exe
  C:\Windows\System\uPPyebN.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\gtxAIvM.exe
  C:\Windows\System\gtxAIvM.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\mquPQIX.exe
  C:\Windows\System\mquPQIX.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KXMYMgK.exe
  C:\Windows\System\KXMYMgK.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\CKuHHgU.exe
  C:\Windows\System\CKuHHgU.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\TAZVylb.exe
  C:\Windows\System\TAZVylb.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\WSCqWsH.exe
  C:\Windows\System\WSCqWsH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\bGQssQH.exe
  C:\Windows\System\bGQssQH.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\lYRZdRa.exe
  C:\Windows\System\lYRZdRa.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\fwGhAPA.exe
  C:\Windows\System\fwGhAPA.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\lEYykPZ.exe
  C:\Windows\System\lEYykPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\fOPiDzY.exe
  C:\Windows\System\fOPiDzY.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\hjPquFn.exe
  C:\Windows\System\hjPquFn.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\zRMvMXv.exe
  C:\Windows\System\zRMvMXv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\XkcILPv.exe
  C:\Windows\System\XkcILPv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\SdVxgiL.exe
  C:\Windows\System\SdVxgiL.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\YmKNfUq.exe
  C:\Windows\System\YmKNfUq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\QqtTUTW.exe
  C:\Windows\System\QqtTUTW.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\uQkshDF.exe
  C:\Windows\System\uQkshDF.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\dSUBEmy.exe
  C:\Windows\System\dSUBEmy.exe
  2⤵
  - Executes dropped EXE
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CKuHHgU.exe

Path C:\Windows\system\CKuHHgU.exe
Size 5.2MB
SHA256 3e4dcc6b7d2dda614d05bc73d281a6d5de28c624c1e2a1dd0bc699c392134765
MD5 b22e0308ecb73dc9720a7cc276e4b02c
SHA1 1f7fffac0c9935f866755864ab695f14dce7551d
SHA512 f21fd67c34077e60964adf3b537e734898a10d9c36ac24d2820aef8c1bd4130b6870e5317f2a3c50c83839a6f5cce5ac45e79257ec576ce7cea4ecb9c60c326b
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibd56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

FCERGWZ.exe

Path C:\Windows\system\FCERGWZ.exe
Size 5.2MB
SHA256 0e3cb2a990f5777f7c187bc1f5e5d60e3942e1b313ac6a9c342048abe3d8ec36
MD5 24780d04fa54332fb9896c4518e943e1
SHA1 065ee74b69c31f78c05636f40757883cf4fff4b5
SHA512 584ad8507016bd82854497f30e0ea7e400d9fbbbd7dab038eac43d0b88f4283799eb2b23425e110569dc69fffa5feb1fdd3815af16d8558030d6ce7f2c0f1226
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibd56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqtTUTW.exe

Path C:\Windows\system\QqtTUTW.exe
Size 5.2MB
SHA256 91b9749dc9a8b6a40b19265ef367b1fe9e2774ff8ae19efd5695f97a3c61e406
MD5 01817b7f4d80ad1d4cfd2535bcb3dd09
SHA1 3c164d02d6286a188485cc041215be691b68922c
SHA512 193b8d9480ccb106fb4ea03748b262af03fa74f935708e6a17b6d07cfdef21b05130ae4f644b8b8571992c1dc808f007f6e4ef5051d2456970ef9713bd942931
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibd56utgpPFotBER/mQ32lU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

SdVxgiL.exe

Path C:\Windows\system\SdVxgiL.exe
Size 5.2MB
SHA256 9f67ebab94c4ef4980178d7b4a3de5653c97db69843f94240956cff5a2b8ee9f
MD5 b928fada5199c9b4453ffc43380fb6d9
SHA1 91b15727d1b8dfe3a5a7a7ffde28fb38dc4bdd0f
SHA512 c72280d7f2bb79fc47f589e6ba13a2a27aa24064ef3fde04f6fff794dbfee6a253347c5f2f7356ed6c6dec3865d82cece7bf91e6e46bc298f23b2a4f18964cb3
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibd56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TAZVylb.exe

Path C:\Windows\system\TAZVylb.exe
Size 5.2MB
SHA256 0bc940c7669f66dbfb241ce765b5944115597c94452eae1ab2b59b8566933b78
MD5 ca16c460c0974be6f60f72ab5c016799
SHA1 028cde7accc894ae71881cad604ba1c23d04fe50
SHA512 4ef877a36f931f98f83b9b29aec6a4f97c2d8a6c63980bc632aa907936377630327165647696817bc7e343d69d09d91253fb7e2dae085dae6b93cf80a6753e8e
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkcILPv.exe

Path C:\Windows\system\XkcILPv.exe
Size 5.2MB
SHA256 8031ae297bbd2135a75757908676613467122a8c6138aab4db0b77c6d2a7251d
MD5 9ba22371af9d21f406c8f747b76db6ef
SHA1 a3fa3c0c7dc5d37957e21d5f5cfcf61080ec52a1
SHA512 7c3da549da715c6f1573b0eab14bb73b727212152df46f934f657d5812627251f55f53b09aed0874026700b1ac897fd04a8580f68c14f17f9be2947364c9bbd7
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibd56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bGQssQH.exe

Path C:\Windows\system\bGQssQH.exe
Size 5.2MB
SHA256 a49f27c230370150e0c850e27ca61851f22fd91d083e811502f3675c14b880fd
MD5 ae6832fcb7959b0dc1ca1631a1992f89
SHA1 eda30ff684152438814dd1c90480fd41d01846bb
SHA512 756f5f8f40abb25b6c423853942c0d02c6267fcaab0c77e4a1a9b9f323779a60dd590df868048a8c86b2b8b0ab431ecb6deca9a97bb0dc933834855d2976d3ea
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibd56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

fOPiDzY.exe

Path C:\Windows\system\fOPiDzY.exe
Size 5.2MB
SHA256 996f06985f5185340d73ff20c39d8b3aa0bf50d28712a40667112f133502e0af
MD5 b9ab7b711203669c1b727597803878a7
SHA1 55fb2c0b60777fcff1c17a6fa50fbe7df2c624d1
SHA512 558d25b1a1730c6e9150b17c78854cb7cb149444f0f4cbbb3db0289aa773689c488ced7102fb1313dd2d8f52a47a674d27071a0b26db5622fc86ab0518c238ec
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibd56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwGhAPA.exe

Path C:\Windows\system\fwGhAPA.exe
Size 5.2MB
SHA256 6fb2dc6dd4b28d17f8650a2e9256024bea0f20cf0ea96c68f5446c917b12d298
MD5 326161f2f7355037ba09175dffa6202f
SHA1 dac8aba9cccec2feeafbfbcdd45dd4b764ab504e
SHA512 d140089823a66d348a03f5819242273f0d922bb402b9f4f18a6d8f137d7674c58581dbaa276ecaeb2797a1006a3c3c6a2b8a2238cfd2e9d7caf2146861bf397e
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibd56utgpPFotBER/mQ32lUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtxAIvM.exe

Path C:\Windows\system\gtxAIvM.exe
Size 5.2MB
SHA256 083858a645f2d2425021ec643c4b87a1473e99e1f019467dfa9a35c918a7cd5c
MD5 d489716cb29ebdfc60c6cfd8a6b188e3
SHA1 35b0b385c224e5c0afe0e2aec22a1bbe4f33e652
SHA512 5ea29534e4785213585fbb3e65617db9eaf7c008881253402cf0b294543c001b7828ca9677eb895ec7088ea19de15b4293c683a206f07cd45c2e0df65ce6ad3b
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibd56utgpPFotBER/mQ32lUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjPquFn.exe

Path C:\Windows\system\hjPquFn.exe
Size 5.2MB
SHA256 ca7a9cd772cb3df92e8ee95694c279472308faddaa409fab23269c59c66388db
MD5 f67d36177ed462bbe17bf4c2919f7590
SHA1 d4d59cb97fd4bda3df2031c205cea54454f0af1b
SHA512 d4395db13c4c07b85af52e9f8a6205219f9ff66a94940345587b03d15f4fcdece90aa4c12cd4e16e043720bfb572c2550075b3be64be41131aaaa9b094920997
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

lEYykPZ.exe

Path C:\Windows\system\lEYykPZ.exe
Size 5.2MB
SHA256 7ff62d19057c597277bd41010e8bcad9a870a09204d90451791e7913a169002e
MD5 a008ab2033cbb5c08fb5ca667cde6cfd
SHA1 58643eb09ae57910a9356027565818381d9cda50
SHA512 6ed64b8778d2b7d65dfea8c922797503dfef19f07b727df6fb4c76cb16a5ed7ca94b6e3cad17bf75e965af4c5fbb5212f5425e7508e72ac554800c4c71e24438
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibd56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lYRZdRa.exe

Path C:\Windows\system\lYRZdRa.exe
Size 5.2MB
SHA256 28c5cffa1d67cae91544bde228ac8a63a34a128d3764338cf37482eb4c5f88bc
MD5 4d3b248f11fc550481c611530a2e3a1b
SHA1 7393d113d53f07e82225161dd92603a8265695eb
SHA512 122ddc9398a23ac99cd370e0e4686131ddf0659401f22e66d4e8b4c9a321f52719176113131a1355a5b9271ff0c0d9fad0acb5ade853fcd17d442c06c7b5e370
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibd56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

mquPQIX.exe

Path C:\Windows\system\mquPQIX.exe
Size 5.2MB
SHA256 0aeef98a7da22b309c79affabf88f93a9d366cb7778c08f2fffdc3497c18fe73
MD5 e9883eb7aab545627b9bf2afd1da6d8c
SHA1 7a0058d3fcd57481a7752125c8228dca2d9162d5
SHA512 6aa86962a64c6ad9c9d8dbf191d2c02398bb6bfb921cd1b4dcb272f2dff2885febda4d6af38dbc204cb9d4920f38dd51a5c20a96193424faa30634e92dabe681
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

zRMvMXv.exe

Path C:\Windows\system\zRMvMXv.exe
Size 5.2MB
SHA256 d11c6bdf821659b84eb1ee0d2f01ece288547958b1936c39e2f8195e7c7ef97e
MD5 f89e7166da7ddb7837634965df2465d2
SHA1 fa8f73e89ae783fa42635a7ecc111056bcad0766
SHA512 c39536f8c16bf2969ee85ef9825ebcd87cf386aa0dbde851380b3e74f156d9e82da4ecaaa4f2a6304bd635bbcc0caaa23fbe607c198b691e306f9fcfc1c11056
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibd56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

KXMYMgK.exe

Path \Windows\system\KXMYMgK.exe
Size 5.2MB
SHA256 fd45bb7fd764593bcf80ccfb8473b120b1232ad033cdefbda2f4b6ad062f6325
MD5 a700391fd0cfc51210806172c640c508
SHA1 d02ddc1df5cde07734b6565038c58dc675478ba2
SHA512 caf548aae7b4792dc9b033b7055c9689eff79b8958a8b619ee884738d306f8c6e449b6ce17b65eb412d661693aaec413eb7888974098ce57efd882325530dd99
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibd56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WSCqWsH.exe

Path \Windows\system\WSCqWsH.exe
Size 5.2MB
SHA256 05892bf5977c7e5002bca7cd9dbc48c6f470e099167b6caa5bb722ee89b63cf4
MD5 efe7bec85b58b687bb25db45cc406904
SHA1 2fe982772c6292bdc70bc5afb5c0281e7eb7d10d
SHA512 b6b0aafd22600f874768fc25c73c9d3a04c80817be3fe2aac9710e880d2f4f3d4461ac355abe0227b9df0f81ae9654136d28a02abec4795a91c62dcac27f44f5
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibd56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

YmKNfUq.exe

Path \Windows\system\YmKNfUq.exe
Size 5.2MB
SHA256 390b57f4e4abea5f37c609bb3c2902623afcb0968292cf28bc16b2658a6db835
MD5 0c519caca025c08a4bdc3fae769e211a
SHA1 2d60768c9db5c648464f1ce73720ec0cbde0618b
SHA512 b5f6ed59436be08cecfd7677a978d8fcbca54c5bc725b74fd3c38455cd7266ef53b28a9d3e0f81e7cb598b0ba84bb81b307ffaf7ef8f9a79169557e1035cfcc6
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dSUBEmy.exe

Path \Windows\system\dSUBEmy.exe
Size 5.2MB
SHA256 e847f3a2cf56593cd85932f163e54469536053dc3243af1906056b51e1844e2b
MD5 71f14efef63ec9c2b2cf52668336e096
SHA1 2a4d6f43b7c5887ceba69498ca10e5564d66eef3
SHA512 bcffde4acc857ebc2ecf3000c6ace845402bff5a824dc1108f85df19619b5acc997fc3d89a0d1cbcbbf68ad78140b568edd4e3d60c32ab8c625a50b0c8973244
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibd56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

uPPyebN.exe

Path \Windows\system\uPPyebN.exe
Size 5.2MB
SHA256 96fac8588bdeebe012a989cadf66033f55dac67911034873b866c73f55c8c032
MD5 2974c589845eb2ee30f5573ad29e1b96
SHA1 3e6efb718ac159b39d792b1f0f4082af77978083
SHA512 c17e497af08f0f89a37432dd4ba8997abadd99c63e50f15b6115d179fdc418c07f38f27234c7d46af5113a844b8a678d7291748fb14fb0693ebf5a0a1188216c
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

uQkshDF.exe

Path \Windows\system\uQkshDF.exe
Size 5.2MB
SHA256 ed007f5ca81ec7734d2eb973b64300852ed8060ce99a67b154209da0386ba948
MD5 981691877ffa1091b24a07b8d25099bb
SHA1 98312efe4e17eba2e2e6a0cc90b0ce679dc5bb2a
SHA512 f27586c87ec86fb7a1eba2952fb24b11a7af17453ed05295ce1d6ccbafc59451cde1de5aa7a3de066f85eef1c4e67989bfbff8fabfe97f5de8cf4d8b82f247c7
SSDEEP 49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/352-18-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/352-204-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/352-110-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/1000-114-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Download

memory/1000-255-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Download

memory/1000-120-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Download

memory/1788-136-0x000000013F5C0000-0x000000013F911000-memory.dmp

Download

memory/1984-108-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/1984-208-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/2084-230-0x000000013FE30000-0x0000000140181000-memory.dmp

Download

memory/2084-144-0x000000013FE30000-0x0000000140181000-memory.dmp

Download

memory/2108-238-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2108-130-0x000000013FD70000-0x00000001400C1000-memory.dmp

Download

memory/2452-116-0x000000013F2C0000-0x000000013F611000-memory.dmp

Download

memory/2452-206-0x000000013F2C0000-0x000000013F611000-memory.dmp

Download

memory/2492-135-0x000000013F850000-0x000000013FBA1000-memory.dmp

Download

memory/2496-210-0x000000013F320000-0x000000013F671000-memory.dmp

Download

memory/2496-118-0x000000013F320000-0x000000013F671000-memory.dmp

Download

memory/2532-132-0x000000013F2B0000-0x000000013F601000-memory.dmp

Download

memory/2600-133-0x000000013FA50000-0x000000013FDA1000-memory.dmp

Download

memory/2636-131-0x000000013FDC0000-0x0000000140111000-memory.dmp

Download

memory/2640-234-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2640-128-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2652-222-0x000000013F160000-0x000000013F4B1000-memory.dmp

Download

memory/2652-139-0x000000013F160000-0x000000013F4B1000-memory.dmp

Download

memory/2676-142-0x000000013F290000-0x000000013F5E1000-memory.dmp

Download

memory/2676-224-0x000000013F290000-0x000000013F5E1000-memory.dmp

Download

memory/2708-129-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Download

memory/2708-236-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Download

memory/2752-137-0x000000013F930000-0x000000013FC81000-memory.dmp

Download

memory/2796-146-0x000000013F530000-0x000000013F881000-memory.dmp

Download

memory/2796-232-0x000000013F530000-0x000000013F881000-memory.dmp

Download

memory/2816-228-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Download

memory/2816-143-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Download

memory/2844-147-0x000000013F1E0000-0x000000013F531000-memory.dmp

Download

memory/2844-150-0x000000013F990000-0x000000013FCE1000-memory.dmp

Download

memory/2844-0-0x000000013FFE0000-0x0000000140331000-memory.dmp

Download

memory/2844-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Download

memory/2844-174-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Download

memory/2844-10-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/2844-145-0x000000013F530000-0x000000013F881000-memory.dmp

Download

memory/2844-157-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/2844-109-0x000000013FFE0000-0x0000000140331000-memory.dmp

Download

memory/2844-117-0x000000013F320000-0x000000013F671000-memory.dmp

Download

memory/2844-148-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Download

memory/2844-151-0x000000013FFE0000-0x0000000140331000-memory.dmp

Download

memory/2844-141-0x000000013F290000-0x000000013F5E1000-memory.dmp

Download

memory/2844-149-0x000000013F2C0000-0x000000013F611000-memory.dmp

Download

memory/2844-119-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Download

memory/2844-138-0x000000013F160000-0x000000013F4B1000-memory.dmp

Download

memory/2844-140-0x0000000002300000-0x0000000002651000-memory.dmp

Download

memory/2960-226-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/2960-121-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/3068-134-0x000000013F510000-0x000000013F861000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads