cobaltstrike | 8ee6a69509b3669509d7fad8f87452cd8598f6221a0673b1e8f8796dec77c2c2

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/11/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
Size 5.2MB
Sample241117-stctmaxldq
SHA256 8ee6a69509b3669509d7fad8f87452cd8598f6221a0673b1e8f8796dec77c2c2
MD5 21f308bf659eb603b4df09f06e7f6641
SHA1 baf719af332a52d9df08cfe643bb7dac3ecfb095
SHA512 d0f7bb575c53463a41dd60e857c1d6d463a71c7c2892112b3095212593a5e90a446d11720ae37a386297e44045c4e84b2934245c53f4ad6cd0df81ffe8098cca
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00080000000120f9-3.dat	cobalt_reflective_dll
behavioral1/files/0x000900000001707f-10.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000174b4-14.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000017570-18.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000175f1-22.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000175f7-25.dat	cobalt_reflective_dll
behavioral1/files/0x000f000000018683-30.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000018697-33.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019274-37.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019358-69.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193d0-124.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193dc-129.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193f9-134.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193cc-120.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001938e-118.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000192a1-79.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016df8-64.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019354-62.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001939f-103.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001927a-41.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019299-45.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral1/memory/2840-97-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/1204-96-0x0000000002180000-0x00000000024D1000-memory.dmp	xmrig
behavioral1/memory/2780-95-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2920-93-0x000000013FC80000-0x000000013FFD1000-memory.dmp	xmrig
behavioral1/memory/2860-91-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2200-89-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2348-87-0x000000013F870000-0x000000013FBC1000-memory.dmp	xmrig
behavioral1/memory/3056-85-0x000000013F060000-0x000000013F3B1000-memory.dmp	xmrig
behavioral1/memory/2476-83-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2304-81-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/1204-137-0x000000013F1C0000-0x000000013F511000-memory.dmp	xmrig
behavioral1/memory/1892-110-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig
behavioral1/memory/2892-153-0x000000013FFF0000-0x0000000140341000-memory.dmp	xmrig
behavioral1/memory/1956-151-0x000000013F9B0000-0x000000013FD01000-memory.dmp	xmrig
behavioral1/memory/2792-149-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	xmrig
behavioral1/memory/1204-109-0x000000013FFF0000-0x0000000140341000-memory.dmp	xmrig
behavioral1/memory/2144-108-0x000000013F820000-0x000000013FB71000-memory.dmp	xmrig
behavioral1/memory/1848-158-0x000000013F040000-0x000000013F391000-memory.dmp	xmrig
behavioral1/memory/1800-157-0x000000013F810000-0x000000013FB61000-memory.dmp	xmrig
behavioral1/memory/332-156-0x000000013F6B0000-0x000000013FA01000-memory.dmp	xmrig
behavioral1/memory/2996-155-0x000000013F5E0000-0x000000013F931000-memory.dmp	xmrig
behavioral1/memory/692-154-0x000000013F670000-0x000000013F9C1000-memory.dmp	xmrig
behavioral1/memory/2672-106-0x000000013FD20000-0x0000000140071000-memory.dmp	xmrig
behavioral1/memory/2808-102-0x000000013F240000-0x000000013F591000-memory.dmp	xmrig
behavioral1/memory/2476-228-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2808-238-0x000000013F240000-0x000000013F591000-memory.dmp	xmrig
behavioral1/memory/2144-242-0x000000013F820000-0x000000013FB71000-memory.dmp	xmrig
behavioral1/memory/2672-246-0x000000013FD20000-0x0000000140071000-memory.dmp	xmrig
behavioral1/memory/2920-248-0x000000013FC80000-0x000000013FFD1000-memory.dmp	xmrig
behavioral1/memory/2200-244-0x000000013F220000-0x000000013F571000-memory.dmp	xmrig
behavioral1/memory/2780-236-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2304-234-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2860-232-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/3056-240-0x000000013F060000-0x000000013F3B1000-memory.dmp	xmrig
behavioral1/memory/2348-230-0x000000013F870000-0x000000013FBC1000-memory.dmp	xmrig
behavioral1/memory/2840-227-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/1892-225-0x000000013F150000-0x000000013F4A1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1892	SfdhKqj.exe
2304	QplkdKz.exe
2476	SbVyjcd.exe
3056	NPfyVwx.exe
2348	mKmHuyy.exe
2200	RxqWgWC.exe
2860	JlRDcYx.exe
2920	fatNXXu.exe
2780	ceSaiun.exe
2840	GrmROuv.exe
2808	NJCRHrS.exe
2672	LEHGdYM.exe
2144	PUJmwiW.exe
2792	ZaXlcQJ.exe
692	SnqNuAz.exe
1956	OyJuRXm.exe
2892	TVPMFDg.exe
2996	sXNVwau.exe
332	LrnQApS.exe
1800	LpWgPdj.exe
1848	gtoTYBJ.exe

Loads dropped DLL 21 IoCs

pid	Process
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1204-0-0x000000013F1C0000-0x000000013F511000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-3.dat	upx
behavioral1/files/0x000900000001707f-10.dat	upx
behavioral1/files/0x00080000000174b4-14.dat	upx
behavioral1/files/0x0007000000017570-18.dat	upx
behavioral1/files/0x00070000000175f1-22.dat	upx
behavioral1/files/0x00070000000175f7-25.dat	upx
behavioral1/files/0x000f000000018683-30.dat	upx
behavioral1/files/0x0007000000018697-33.dat	upx
behavioral1/files/0x0005000000019274-37.dat	upx
behavioral1/files/0x0005000000019358-69.dat	upx
behavioral1/files/0x00050000000193d0-124.dat	upx
behavioral1/files/0x00050000000193dc-129.dat	upx
behavioral1/files/0x00050000000193f9-134.dat	upx
behavioral1/files/0x00050000000193cc-120.dat	upx
behavioral1/files/0x000500000001938e-118.dat	upx
behavioral1/memory/2840-97-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/2780-95-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2920-93-0x000000013FC80000-0x000000013FFD1000-memory.dmp	upx
behavioral1/memory/2860-91-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/2200-89-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2348-87-0x000000013F870000-0x000000013FBC1000-memory.dmp	upx
behavioral1/memory/3056-85-0x000000013F060000-0x000000013F3B1000-memory.dmp	upx
behavioral1/memory/2476-83-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2304-81-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/files/0x00050000000192a1-79.dat	upx
behavioral1/files/0x0009000000016df8-64.dat	upx
behavioral1/files/0x0005000000019354-62.dat	upx
behavioral1/memory/1204-50-0x0000000002180000-0x00000000024D1000-memory.dmp	upx
behavioral1/memory/1204-137-0x000000013F1C0000-0x000000013F511000-memory.dmp	upx
behavioral1/memory/1892-110-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx
behavioral1/memory/2892-153-0x000000013FFF0000-0x0000000140341000-memory.dmp	upx
behavioral1/memory/1956-151-0x000000013F9B0000-0x000000013FD01000-memory.dmp	upx
behavioral1/memory/2792-149-0x000000013F0A0000-0x000000013F3F1000-memory.dmp	upx
behavioral1/memory/2144-108-0x000000013F820000-0x000000013FB71000-memory.dmp	upx
behavioral1/memory/1848-158-0x000000013F040000-0x000000013F391000-memory.dmp	upx
behavioral1/memory/1800-157-0x000000013F810000-0x000000013FB61000-memory.dmp	upx
behavioral1/memory/332-156-0x000000013F6B0000-0x000000013FA01000-memory.dmp	upx
behavioral1/memory/2996-155-0x000000013F5E0000-0x000000013F931000-memory.dmp	upx
behavioral1/memory/692-154-0x000000013F670000-0x000000013F9C1000-memory.dmp	upx
behavioral1/memory/2672-106-0x000000013FD20000-0x0000000140071000-memory.dmp	upx
behavioral1/files/0x000500000001939f-103.dat	upx
behavioral1/memory/2808-102-0x000000013F240000-0x000000013F591000-memory.dmp	upx
behavioral1/files/0x000500000001927a-41.dat	upx
behavioral1/files/0x0005000000019299-45.dat	upx
behavioral1/memory/2476-228-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2808-238-0x000000013F240000-0x000000013F591000-memory.dmp	upx
behavioral1/memory/2144-242-0x000000013F820000-0x000000013FB71000-memory.dmp	upx
behavioral1/memory/2672-246-0x000000013FD20000-0x0000000140071000-memory.dmp	upx
behavioral1/memory/2920-248-0x000000013FC80000-0x000000013FFD1000-memory.dmp	upx
behavioral1/memory/2200-244-0x000000013F220000-0x000000013F571000-memory.dmp	upx
behavioral1/memory/2780-236-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2304-234-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2860-232-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/3056-240-0x000000013F060000-0x000000013F3B1000-memory.dmp	upx
behavioral1/memory/2348-230-0x000000013F870000-0x000000013FBC1000-memory.dmp	upx
behavioral1/memory/2840-227-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/1892-225-0x000000013F150000-0x000000013F4A1000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\LEHGdYM.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TVPMFDg.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SnqNuAz.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZaXlcQJ.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PUJmwiW.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LrnQApS.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LpWgPdj.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QplkdKz.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SbVyjcd.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NPfyVwx.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JlRDcYx.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mKmHuyy.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RxqWgWC.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GrmROuv.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OyJuRXm.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sXNVwau.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gtoTYBJ.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SfdhKqj.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fatNXXu.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ceSaiun.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NJCRHrS.exe	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1204 wrote to memory of 1892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1204 wrote to memory of 1892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1204 wrote to memory of 2304	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1204 wrote to memory of 2304	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1204 wrote to memory of 2304	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1204 wrote to memory of 2476	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1204 wrote to memory of 2476	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1204 wrote to memory of 2476	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1204 wrote to memory of 3056	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1204 wrote to memory of 3056	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1204 wrote to memory of 3056	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1204 wrote to memory of 2348	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1204 wrote to memory of 2348	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1204 wrote to memory of 2348	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1204 wrote to memory of 2200	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1204 wrote to memory of 2200	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1204 wrote to memory of 2200	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1204 wrote to memory of 2860	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1204 wrote to memory of 2860	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1204 wrote to memory of 2860	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1204 wrote to memory of 2920	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1204 wrote to memory of 2920	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1204 wrote to memory of 2920	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1204 wrote to memory of 2780	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1204 wrote to memory of 2780	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1204 wrote to memory of 2780	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1204 wrote to memory of 2840	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1204 wrote to memory of 2840	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1204 wrote to memory of 2840	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1204 wrote to memory of 2808	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1204 wrote to memory of 2808	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1204 wrote to memory of 2808	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1204 wrote to memory of 2792	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1204 wrote to memory of 2792	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1204 wrote to memory of 2792	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1204 wrote to memory of 2672	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1204 wrote to memory of 2672	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1204 wrote to memory of 2672	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1204 wrote to memory of 1956	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1204 wrote to memory of 1956	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1204 wrote to memory of 1956	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1204 wrote to memory of 2144	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1204 wrote to memory of 2144	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1204 wrote to memory of 2144	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1204 wrote to memory of 2892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1204 wrote to memory of 2892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1204 wrote to memory of 2892	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1204 wrote to memory of 692	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1204 wrote to memory of 692	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1204 wrote to memory of 692	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1204 wrote to memory of 2996	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1204 wrote to memory of 2996	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1204 wrote to memory of 2996	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1204 wrote to memory of 332	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1204 wrote to memory of 332	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1204 wrote to memory of 332	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1204 wrote to memory of 1800	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1204 wrote to memory of 1800	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1204 wrote to memory of 1800	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1204 wrote to memory of 1848	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1204 wrote to memory of 1848	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1204 wrote to memory of 1848	1204	2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System\SfdhKqj.exe
  C:\Windows\System\SfdhKqj.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\QplkdKz.exe
  C:\Windows\System\QplkdKz.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\SbVyjcd.exe
  C:\Windows\System\SbVyjcd.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\NPfyVwx.exe
  C:\Windows\System\NPfyVwx.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\mKmHuyy.exe
  C:\Windows\System\mKmHuyy.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\RxqWgWC.exe
  C:\Windows\System\RxqWgWC.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\JlRDcYx.exe
  C:\Windows\System\JlRDcYx.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fatNXXu.exe
  C:\Windows\System\fatNXXu.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\ceSaiun.exe
  C:\Windows\System\ceSaiun.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\GrmROuv.exe
  C:\Windows\System\GrmROuv.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\NJCRHrS.exe
  C:\Windows\System\NJCRHrS.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ZaXlcQJ.exe
  C:\Windows\System\ZaXlcQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\LEHGdYM.exe
  C:\Windows\System\LEHGdYM.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OyJuRXm.exe
  C:\Windows\System\OyJuRXm.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\PUJmwiW.exe
  C:\Windows\System\PUJmwiW.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\TVPMFDg.exe
  C:\Windows\System\TVPMFDg.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\SnqNuAz.exe
  C:\Windows\System\SnqNuAz.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\sXNVwau.exe
  C:\Windows\System\sXNVwau.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\LrnQApS.exe
  C:\Windows\System\LrnQApS.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\LpWgPdj.exe
  C:\Windows\System\LpWgPdj.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\gtoTYBJ.exe
  C:\Windows\System\gtoTYBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GrmROuv.exe

Path C:\Windows\system\GrmROuv.exe
Size 5.2MB
SHA256 6023c538c5cc0d3a7c0bb3df5463c3b9ca97138466f8aaa0756492308ff92094
MD5 f2230c657b08a3da88c7bd59c2a024fa
SHA1 c4d0eb6c3f1a16f2e6db4438674946371371058b
SHA512 8256df275e23f11b58e483550ed0321e180efe01589ef0122760b97d62b8820148534e33013589258198de6dfbabbdce7fd277a9e871c77c6c4b3c28f6779117
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

JlRDcYx.exe

Path C:\Windows\system\JlRDcYx.exe
Size 5.2MB
SHA256 30256117cf592d0df167fd95c341058361fe3995adf1432b03d0f82985e256c7
MD5 d1187f9c418b51a3b8ddfd099ad83f94
SHA1 c0ef5f84df3cbacf78a0eefaadb36378ad87ca4a
SHA512 8304323b14aef0d825657116dc806f4cc1d4ff0f46ce4e562adfde24cd5dc9b22a77763884551e8b0f60dab1459ed7d81e3d64bd6e7f680096d4c63163e8f804
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

LEHGdYM.exe

Path C:\Windows\system\LEHGdYM.exe
Size 5.2MB
SHA256 340c189e6efb7d95e7990a2f24741a590730674de8d8964a8c457938ae00ae12
MD5 566b2f6bdd6943fb0d993edc45fe6f6e
SHA1 559ba69100f2c5e60363ad7682815a2713b9f6e4
SHA512 ae837e3d34c3e21a1d981bcbd5d065f331755713ca3c78b9667d6e6b2df9eb43ca829963ba8f30e31c5f539b71491a1bce9a0ecfe0e556f74f34f5412706c697
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LpWgPdj.exe

Path C:\Windows\system\LpWgPdj.exe
Size 5.2MB
SHA256 442c2c30a449ceb5aa84ffc4da4e4370951827ea9614281178796ff6ee37b3f2
MD5 29278290ee6a42d8bce25a2b3800af7d
SHA1 cbbe05b99698249d9554fe1747523e995ae237d0
SHA512 5958f8d26c792bdfa5de88bc73c1340cbb0b1e8c6465e44a942dbc0f13fe91583c7fc9ef662dcd6c06773412d9352594f2cfe244e202adc84b6e449cfe08d3e8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LrnQApS.exe

Path C:\Windows\system\LrnQApS.exe
Size 5.2MB
SHA256 449347cbfd69fbccc7fadd390830c52550ad5669625a6cd12d0ab8ec4524e84c
MD5 bf99febb5b0cdd32272e5fabee2cd680
SHA1 b86b7c7caa1e8311e7ce6a26630941af37e2a475
SHA512 ebdf50c4cc2c9529335deb3f868c7add06013eb13bdb53afad15796df742e239dd1da583f65382cdd42ffc450a2733d22ba0f35406a7a04df83980df140b6867
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJCRHrS.exe

Path C:\Windows\system\NJCRHrS.exe
Size 5.2MB
SHA256 8e3bdede05422bff172952d74d359a04cffbfeead774627088a47ec69a269803
MD5 9a41bd216c76cb936e25abf97f5abe0b
SHA1 262a90599fd8df3ae6ee6aa2248505fed8388cb3
SHA512 c11aed479739be012773abe5df284653a16ab7f1a00d874128d3e55e9cdd7118b9a4df9e5fe5d5dd94c0e1481e8a128584f5c70527736f3156ef1ef3365f1234
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

NPfyVwx.exe

Path C:\Windows\system\NPfyVwx.exe
Size 5.2MB
SHA256 ec8327c9960b66602009c46336eed16bff79146e990fc39178cbdd37f046f12d
MD5 61f3ff90016a0ad03712a077241fe2b4
SHA1 26fca1791292d24520efbaa89477aa0b790a0aa0
SHA512 c52b0213b518706ede22b34f3ba739c183665b9d44a472290d82a634ebbe7f8aeffb1402227dcc63d4b513efe7bea7e5d2a54dd005a1d6167a22ee06ae74729d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

QplkdKz.exe

Path C:\Windows\system\QplkdKz.exe
Size 5.2MB
SHA256 4eb2a55838521912129788d7a72a46f1ebca8dd38deb08379de178d430f9e5cd
MD5 fde5b70468b7e789c2c7cb070b1bda07
SHA1 52f02ad0efffe2999cb710a6e27f73ea387bb64d
SHA512 13b893cfaf5a6f574e803e47b60d7627f294d59e7d1767269ec8c0ba3b2e35a975ec3ffa19131c46773b82acdc5f1bd51a45e86c62f2caa55e2a03ca286a9211
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

RxqWgWC.exe

Path C:\Windows\system\RxqWgWC.exe
Size 5.2MB
SHA256 ab574926aa35a5a6c2b645d61fb4b001c7dfc75b73f01f5ecf81cf37acab9f38
MD5 f2ab449c76a89b0d1efcbb4c8b031f86
SHA1 e53258e5201ca82bfc29997dc59b77eb1b7cc3b5
SHA512 4446027f4e6357b02ed8f007ac390f0a0a145c8776fe8fc84e94d090c4f4595b10f4899ad9e42c515841c54d05e6bd45e4a45d06c4c9dca13b18d7593c003cba
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

SbVyjcd.exe

Path C:\Windows\system\SbVyjcd.exe
Size 5.2MB
SHA256 63bcf3d6167685ebef940fccba8bf773e223448394e6d20407891512a0beaf53
MD5 3c3afef8991c8cd91ea1272f70cfe705
SHA1 263c6b40e79b192c435be19068a6577ef474730e
SHA512 19360df81cffd8fd4564b450f8af2e4705aee8bb8af0ad4f91b4f2452f2ed5d005e82b06f2e92fa5de147756f5cc3c0162de26ac0b69258fdc3f19e68db2ffea
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnqNuAz.exe

Path C:\Windows\system\SnqNuAz.exe
Size 5.2MB
SHA256 7be474772975fa2bc1cfe002dfd9926ae1c5f337f12e219ae63e164583997f3f
MD5 adc45b19147542675a67a1b7e6ca0d82
SHA1 3b0acfda39cf84c1f3b526d1a3b59a0cfa90c4cd
SHA512 65f0bdac92c9038852899d508ea76f03bfe5f51b4e5a85883e7972aef60eed9f37ef8e9655aeb2df35d8b75b9e02fa28114efce568a60fc0e1660a9b7be26e02
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TVPMFDg.exe

Path C:\Windows\system\TVPMFDg.exe
Size 5.2MB
SHA256 92354bb9c7c70c79eacc9c180129885accf572807743443584735d73dbb46096
MD5 9c777c9747b6f7f709c8fc435b57829f
SHA1 06d49ccdeeb509677b873882785e787bf305f42f
SHA512 8178064e4b1217eb85d9161a29b20455e99ee3b36d19318a7d63e3e48fa18a81921e68bdc0136ba04726412f066f2df71828c8169bb54e077a6ffe13c898467d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZaXlcQJ.exe

Path C:\Windows\system\ZaXlcQJ.exe
Size 5.2MB
SHA256 18e3e5664c3b808af6a0531e93b92b8a5174d7bb250e9e7f3a7f299d66ea50eb
MD5 3d647f7fb32d568f25888bff87f037a6
SHA1 edfc20f94823fd5748d6943a658207a0f993c1c5
SHA512 12f6d2a4ecaf31b049d02d4928df5610ce4d47d0dffcc6d9719a23c067ad5580628359dc5783dd81eb49febfe8bb34e72f7ae4177d48f86927ec40da1978eba0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ceSaiun.exe

Path C:\Windows\system\ceSaiun.exe
Size 5.2MB
SHA256 aa463188d66e6eb24b85ed5bb2cb201c02a3e1bae5ef16d56b8616796c5cacd4
MD5 4aa6f662d2be6ce67e8cf72f6f808360
SHA1 e52694a246a53ddb12e7b39f250259e89080421a
SHA512 308706e3315b9100c984ec433407e40bbca5f62fda6e21a3d90136aa3088d1e03b89fe1c84b85e3f5ae7b155b066858b2476333074ae352f88a8fe5ce3e7c4e7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

fatNXXu.exe

Path C:\Windows\system\fatNXXu.exe
Size 5.2MB
SHA256 e1da8cdf474b17da4f1d7de6fda570c0f2ef19c4b84e8ff5cf1c36acd3eb3363
MD5 3410e27a4fd8df8af36f781abcec7373
SHA1 05bfa541e19e9f9a01b0e647aaf22834da9f7e1f
SHA512 5f19cd9b3032d4bbf5fe68f63db1ae61226dae4883544840f57ea4bc4e21666b86f85c8b9998e6e7857ebc06ebd820a3f8ff7afe05a6657fa7ddb55d95b72232
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtoTYBJ.exe

Path C:\Windows\system\gtoTYBJ.exe
Size 5.2MB
SHA256 bd651efb4c7ca15303d3f727453f3000513924ace87a311f12fc185ea38ef565
MD5 782d58ef2bff216fc850d410094f96cd
SHA1 4035790f063aece628b50ab3a44ed51d3ceef5a0
SHA512 85b41f1aadc308550c706d04cd5e2b542a1b0622caf844ad084f7ce4c179cc0c669950a4f8ecabf3d144e71087f2d1f114809a46bc4dc84bc4fa62d632173f3c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

mKmHuyy.exe

Path C:\Windows\system\mKmHuyy.exe
Size 5.2MB
SHA256 8ce994df690e50fd61c72e6fcaf443bfd2e1977591907b9e881fbd70849d75da
MD5 50e6035424b63564b86b1ecc7a6972d5
SHA1 2b33eae690ac7a79e054f59b5d44a6ee2db976ac
SHA512 59a42ebb20e72d7c15a1e30cb38047f515786c3b4e6287524723fb5338d2704e7ed0167d16a097110691069a58ba403010a6448b155867b9bed0b03633156ff5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXNVwau.exe

Path C:\Windows\system\sXNVwau.exe
Size 5.2MB
SHA256 efa59a85f96046ec3178869ba0a2c719a3b99c80afccda22c0b469a5e77ba5de
MD5 e569021c2a7179f51e179174ae198441
SHA1 d157452d177252aa234b0d6f3f74366ba2abf54e
SHA512 c60e6dbb876dbfaec99e0e9c86f134a6f06a9187fa4c09d07b7a4be63041716e758307bdb37abb7f6ced02d8aec0ad97c15d4272fdaec511d2fc6a2d584ff7e8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OyJuRXm.exe

Path \Windows\system\OyJuRXm.exe
Size 5.2MB
SHA256 2f198b4b9e46a217b638387c5fb7a9ca4b05d244b020c588f6cebee04a603b3a
MD5 31f540290a49cba4c7eafee229866970
SHA1 8aa3a26d840eced370bc7383a5666c156b56c777
SHA512 6b4aa6c8a3e435546fdf535a8d82a9c26678a30bdec3b55bb7548d54b92ba479c097d10bdc7f3084b4afd3253a8bb66205b0ac02f2a467ffd673a3b34ab0cdc0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUJmwiW.exe

Path \Windows\system\PUJmwiW.exe
Size 5.2MB
SHA256 0f33e47f604c2894bfae6972e64f3f49f588f95183a3766b64a8aba42e0c24eb
MD5 eb383ad16d8ec686d101a1237ed8425b
SHA1 9eb2ce56e88f19bb507a3eb7323c04d2b7e056c4
SHA512 4f4a58331327112cc4362db952046b65ed313282a7dc2251ad9fade41d37bd175b7a3e3a4c1452fe8da6fa3edc0b790bca3788426d1a68451b373d5a872caf5c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfdhKqj.exe

Path \Windows\system\SfdhKqj.exe
Size 5.2MB
SHA256 17ba68807fefdb32029de89bf1ae2de985d93ed186b35a296edd6dc8473154f8
MD5 c45f9b6aa51e6e58d851bea2c450b9de
SHA1 af26aed2a4729d14a03fa3111a29fe88769e547b
SHA512 8e85eee0d2ebb3ade468a9e8aabaa243038a0ce460ad6c9eb5522b0e589c71e1a13388f27d6476cffd916cc90b6cba00509cb4fbcdaab1725dd4ad52ca4a7a4f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/332-156-0x000000013F6B0000-0x000000013FA01000-memory.dmp

Download

memory/692-154-0x000000013F670000-0x000000013F9C1000-memory.dmp

Download

memory/1204-96-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/1204-90-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/1204-111-0x000000013FD20000-0x0000000140071000-memory.dmp

Download

memory/1204-88-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-101-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-86-0x000000013F870000-0x000000013FBC1000-memory.dmp

Download

memory/1204-104-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-84-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-105-0x000000013F9B0000-0x000000013FD01000-memory.dmp

Download

memory/1204-82-0x000000013F800000-0x000000013FB51000-memory.dmp

Download

memory/1204-107-0x000000013F820000-0x000000013FB71000-memory.dmp

Download

memory/1204-92-0x000000013FC80000-0x000000013FFD1000-memory.dmp

Download

memory/1204-0-0x000000013F1C0000-0x000000013F511000-memory.dmp

Download

memory/1204-94-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/1204-51-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Download

memory/1204-50-0x0000000002180000-0x00000000024D1000-memory.dmp

Download

memory/1204-137-0x000000013F1C0000-0x000000013F511000-memory.dmp

Download

memory/1204-109-0x000000013FFF0000-0x0000000140341000-memory.dmp

Download

memory/1800-157-0x000000013F810000-0x000000013FB61000-memory.dmp

Download

memory/1848-158-0x000000013F040000-0x000000013F391000-memory.dmp

Download

memory/1892-225-0x000000013F150000-0x000000013F4A1000-memory.dmp

Download

memory/1892-110-0x000000013F150000-0x000000013F4A1000-memory.dmp

Download

memory/1956-151-0x000000013F9B0000-0x000000013FD01000-memory.dmp

Download

memory/2144-108-0x000000013F820000-0x000000013FB71000-memory.dmp

Download

memory/2144-242-0x000000013F820000-0x000000013FB71000-memory.dmp

Download

memory/2200-89-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/2200-244-0x000000013F220000-0x000000013F571000-memory.dmp

Download

memory/2304-234-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Download

memory/2304-81-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Download

memory/2348-87-0x000000013F870000-0x000000013FBC1000-memory.dmp

Download

memory/2348-230-0x000000013F870000-0x000000013FBC1000-memory.dmp

Download

memory/2476-228-0x000000013F800000-0x000000013FB51000-memory.dmp

Download

memory/2476-83-0x000000013F800000-0x000000013FB51000-memory.dmp

Download

memory/2672-246-0x000000013FD20000-0x0000000140071000-memory.dmp

Download

memory/2672-106-0x000000013FD20000-0x0000000140071000-memory.dmp

Download

memory/2780-236-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/2780-95-0x000000013FE60000-0x00000001401B1000-memory.dmp

Download

memory/2792-149-0x000000013F0A0000-0x000000013F3F1000-memory.dmp

Download

memory/2808-102-0x000000013F240000-0x000000013F591000-memory.dmp

Download

memory/2808-238-0x000000013F240000-0x000000013F591000-memory.dmp

Download

memory/2840-97-0x000000013F420000-0x000000013F771000-memory.dmp

Download

memory/2840-227-0x000000013F420000-0x000000013F771000-memory.dmp

Download

memory/2860-232-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/2860-91-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Download

memory/2892-153-0x000000013FFF0000-0x0000000140341000-memory.dmp

Download

memory/2920-93-0x000000013FC80000-0x000000013FFD1000-memory.dmp

Download

memory/2920-248-0x000000013FC80000-0x000000013FFD1000-memory.dmp

Download

memory/2996-155-0x000000013F5E0000-0x000000013F931000-memory.dmp

Download

memory/3056-85-0x000000013F060000-0x000000013F3B1000-memory.dmp

Download

memory/3056-240-0x000000013F060000-0x000000013F3B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads