87096fcee6c6801e2bb7324340a390774da98ca9238a6b854529b0bfcdffeaa1

Analysis

max time kernel
13s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_a8349cf0f1767a947204790028d7481f_cobalt-strike_cobaltstrike_poet-rat.exe
Size

6.0MB
MD5

a8349cf0f1767a947204790028d7481f
SHA1

325e4824417ce330cd0afbdada5c772bbbc3ee88
SHA256

87096fcee6c6801e2bb7324340a390774da98ca9238a6b854529b0bfcdffeaa1
SHA512

25a25f55110f17c588f221651c1cf55148359c1350bf29262f51484f2f8ff655c61f3336871005949e09b344957524f1836c7016c6a00bfad3eb29fd2115b514
SSDEEP

98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUc:T+q56utgpPF8u/7c

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF692540000-0x00007FF692894000-memory.dmp	upx
behavioral2/files/0x0007000000023cc2-12.dat	upx
behavioral2/files/0x0007000000023cc4-29.dat	upx
behavioral2/memory/3992-32-0x00007FF76A2C0000-0x00007FF76A614000-memory.dmp	upx
behavioral2/files/0x0007000000023cc5-36.dat	upx
behavioral2/files/0x0007000000023cc7-46.dat	upx
behavioral2/files/0x0007000000023cc8-54.dat	upx
behavioral2/files/0x0007000000023ccb-71.dat	upx
behavioral2/files/0x0007000000023ccc-80.dat	upx
behavioral2/memory/2848-88-0x00007FF717080000-0x00007FF7173D4000-memory.dmp	upx
behavioral2/memory/3960-93-0x00007FF767A60000-0x00007FF767DB4000-memory.dmp	upx
behavioral2/memory/4008-120-0x00007FF6D2390000-0x00007FF6D26E4000-memory.dmp	upx
behavioral2/files/0x0007000000023cd2-127.dat	upx
behavioral2/files/0x0007000000023cd5-145.dat	upx
behavioral2/files/0x0007000000023cd5-149.dat	upx
behavioral2/memory/4624-158-0x00007FF725C40000-0x00007FF725F94000-memory.dmp	upx
behavioral2/memory/4480-164-0x00007FF73C5A0000-0x00007FF73C8F4000-memory.dmp	upx
behavioral2/memory/1800-165-0x00007FF70D750000-0x00007FF70DAA4000-memory.dmp	upx
behavioral2/files/0x0007000000023cd8-163.dat	upx
behavioral2/files/0x0007000000023cd6-159.dat	upx
behavioral2/files/0x0007000000023cd7-154.dat	upx
behavioral2/files/0x0007000000023cd8-166.dat	upx
behavioral2/files/0x0007000000023cdd-193.dat	upx
behavioral2/files/0x0007000000023cde-199.dat	upx
behavioral2/files/0x0007000000023cde-197.dat	upx
behavioral2/memory/3084-300-0x00007FF69F0A0000-0x00007FF69F3F4000-memory.dmp	upx
behavioral2/memory/4172-417-0x00007FF6B7E80000-0x00007FF6B81D4000-memory.dmp	upx
behavioral2/memory/4624-473-0x00007FF725C40000-0x00007FF725F94000-memory.dmp	upx
behavioral2/memory/1800-588-0x00007FF70D750000-0x00007FF70DAA4000-memory.dmp	upx
behavioral2/memory/444-699-0x00007FF6B6D70000-0x00007FF6B70C4000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2024-11-21_a8349cf0f1767a947204790028d7481f_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_a8349cf0f1767a947204790028d7481f_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
PID:2876
- C:\Windows\System\ZpHZwpg.exe
  C:\Windows\System\ZpHZwpg.exe
  2⤵
  PID:1956
- C:\Windows\System\ODCZYRG.exe
  C:\Windows\System\ODCZYRG.exe
  2⤵
  PID:2260
- C:\Windows\System\NasliHD.exe
  C:\Windows\System\NasliHD.exe
  2⤵
  PID:2848
- C:\Windows\System\zmGcyoj.exe
  C:\Windows\System\zmGcyoj.exe
  2⤵
  PID:3992
- C:\Windows\System\CfDpGtU.exe
  C:\Windows\System\CfDpGtU.exe
  2⤵
  PID:524
- C:\Windows\System\bzmqtte.exe
  C:\Windows\System\bzmqtte.exe
  2⤵
  PID:4008
- C:\Windows\System\iYSpvqd.exe
  C:\Windows\System\iYSpvqd.exe
  2⤵
  PID:2508
- C:\Windows\System\fWbZOJl.exe
  C:\Windows\System\fWbZOJl.exe
  2⤵
  PID:2080
- C:\Windows\System\LoizfWN.exe
  C:\Windows\System\LoizfWN.exe
  2⤵
  PID:4936
- C:\Windows\System\TMwNkCU.exe
  C:\Windows\System\TMwNkCU.exe
  2⤵
  PID:1616
- C:\Windows\System\ZyMsjJm.exe
  C:\Windows\System\ZyMsjJm.exe
  2⤵
  PID:3552
- C:\Windows\System\bUtjEeA.exe
  C:\Windows\System\bUtjEeA.exe
  2⤵
  PID:720
- C:\Windows\System\NBxUVEa.exe
  C:\Windows\System\NBxUVEa.exe
  2⤵
  PID:4172
- C:\Windows\System\oLyWvif.exe
  C:\Windows\System\oLyWvif.exe
  2⤵
  PID:1504
- C:\Windows\System\dhwqRUK.exe
  C:\Windows\System\dhwqRUK.exe
  2⤵
  PID:1840
- C:\Windows\System\gpYHzxS.exe
  C:\Windows\System\gpYHzxS.exe
  2⤵
  PID:1404
- C:\Windows\System\kAgGbwV.exe
  C:\Windows\System\kAgGbwV.exe
  2⤵
  PID:3928
- C:\Windows\System\pJhtMuc.exe
  C:\Windows\System\pJhtMuc.exe
  2⤵
  PID:1028
- C:\Windows\System\zgNWAIY.exe
  C:\Windows\System\zgNWAIY.exe
  2⤵
  PID:1552
- C:\Windows\System\gORVVmv.exe
  C:\Windows\System\gORVVmv.exe
  2⤵
  PID:4484
- C:\Windows\System\oNfsAIX.exe
  C:\Windows\System\oNfsAIX.exe
  2⤵
  PID:2656
- C:\Windows\System\uvJLyBR.exe
  C:\Windows\System\uvJLyBR.exe
  2⤵
  PID:2880
- C:\Windows\System\KkeCozH.exe
  C:\Windows\System\KkeCozH.exe
  2⤵
  PID:3580
- C:\Windows\System\TvUzyrH.exe
  C:\Windows\System\TvUzyrH.exe
  2⤵
  PID:928
- C:\Windows\System\xjqBqEB.exe
  C:\Windows\System\xjqBqEB.exe
  2⤵
  PID:3964
- C:\Windows\System\ahYjFcj.exe
  C:\Windows\System\ahYjFcj.exe
  2⤵
  PID:2916
- C:\Windows\System\VnrcOKL.exe
  C:\Windows\System\VnrcOKL.exe
  2⤵
  PID:640
- C:\Windows\System\pzZKfVH.exe
  C:\Windows\System\pzZKfVH.exe
  2⤵
  PID:3944
- C:\Windows\System\oYPWzbz.exe
  C:\Windows\System\oYPWzbz.exe
  2⤵
  PID:5088
- C:\Windows\System\LrRtWJB.exe
  C:\Windows\System\LrRtWJB.exe
  2⤵
  PID:4632
- C:\Windows\System\UFrfZvt.exe
  C:\Windows\System\UFrfZvt.exe
  2⤵
  PID:2756
- C:\Windows\System\EjWldZh.exe
  C:\Windows\System\EjWldZh.exe
  2⤵
  PID:1936
- C:\Windows\System\qoHIgky.exe
  C:\Windows\System\qoHIgky.exe
  2⤵
  PID:5064
- C:\Windows\System\DHDnVyU.exe
  C:\Windows\System\DHDnVyU.exe
  2⤵
  PID:4284
- C:\Windows\System\qTOaWqT.exe
  C:\Windows\System\qTOaWqT.exe
  2⤵
  PID:4280
- C:\Windows\System\ZwehSdz.exe
  C:\Windows\System\ZwehSdz.exe
  2⤵
  PID:3832
- C:\Windows\System\JGEObzh.exe
  C:\Windows\System\JGEObzh.exe
  2⤵
  PID:1316
- C:\Windows\System\PHsApSj.exe
  C:\Windows\System\PHsApSj.exe
  2⤵
  PID:4384
- C:\Windows\System\OGXBwqL.exe
  C:\Windows\System\OGXBwqL.exe
  2⤵
  PID:2820
- C:\Windows\System\fXOzQrB.exe
  C:\Windows\System\fXOzQrB.exe
  2⤵
  PID:1940
- C:\Windows\System\BENzCBp.exe
  C:\Windows\System\BENzCBp.exe
  2⤵
  PID:4148
- C:\Windows\System\LNetgzo.exe
  C:\Windows\System\LNetgzo.exe
  2⤵
  PID:432
- C:\Windows\System\HxAbuKP.exe
  C:\Windows\System\HxAbuKP.exe
  2⤵
  PID:2660
- C:\Windows\System\EmWzNjJ.exe
  C:\Windows\System\EmWzNjJ.exe
  2⤵
  PID:3948
- C:\Windows\System\cRBZDSG.exe
  C:\Windows\System\cRBZDSG.exe
  2⤵
  PID:756
- C:\Windows\System\PwaGwhp.exe
  C:\Windows\System\PwaGwhp.exe
  2⤵
  PID:4040
- C:\Windows\System\GcFjdXO.exe
  C:\Windows\System\GcFjdXO.exe
  2⤵
  PID:4964
- C:\Windows\System\wYGPKDO.exe
  C:\Windows\System\wYGPKDO.exe
  2⤵
  PID:1372
- C:\Windows\System\NOfsGfT.exe
  C:\Windows\System\NOfsGfT.exe
  2⤵
  PID:1916
- C:\Windows\System\dpMryUI.exe
  C:\Windows\System\dpMryUI.exe
  2⤵
  PID:3664
- C:\Windows\System\XPZzZfr.exe
  C:\Windows\System\XPZzZfr.exe
  2⤵
  PID:4776
- C:\Windows\System\uMXcwJi.exe
  C:\Windows\System\uMXcwJi.exe
  2⤵
  PID:2252
- C:\Windows\System\nTqAZwS.exe
  C:\Windows\System\nTqAZwS.exe
  2⤵
  PID:5052
- C:\Windows\System\sXADaTH.exe
  C:\Windows\System\sXADaTH.exe
  2⤵
  PID:4760
- C:\Windows\System\VauTkBR.exe
  C:\Windows\System\VauTkBR.exe
  2⤵
  PID:1396
- C:\Windows\System\HEMOlFT.exe
  C:\Windows\System\HEMOlFT.exe
  2⤵
  PID:3620
- C:\Windows\System\ThfkyIQ.exe
  C:\Windows\System\ThfkyIQ.exe
  2⤵
  PID:4136
- C:\Windows\System\UFnXsZP.exe
  C:\Windows\System\UFnXsZP.exe
  2⤵
  PID:2028
- C:\Windows\System\tuQNEIW.exe
  C:\Windows\System\tuQNEIW.exe
  2⤵
  PID:1368
- C:\Windows\System\RgvkiWQ.exe
  C:\Windows\System\RgvkiWQ.exe
  2⤵
  PID:2136
- C:\Windows\System\mrMaJgW.exe
  C:\Windows\System\mrMaJgW.exe
  2⤵
  PID:1836
- C:\Windows\System\zOkqsTh.exe
  C:\Windows\System\zOkqsTh.exe
  2⤵
  PID:1596
- C:\Windows\System\WeAGelh.exe
  C:\Windows\System\WeAGelh.exe
  2⤵
  PID:3460
- C:\Windows\System\IGuzYEj.exe
  C:\Windows\System\IGuzYEj.exe
  2⤵
  PID:4672
- C:\Windows\System\AhhUGiy.exe
  C:\Windows\System\AhhUGiy.exe
  2⤵
  PID:5148
- C:\Windows\System\GtAjhFJ.exe
  C:\Windows\System\GtAjhFJ.exe
  2⤵
  PID:5204
- C:\Windows\System\lFsiGVN.exe
  C:\Windows\System\lFsiGVN.exe
  2⤵
  PID:5356
- C:\Windows\System\XvsPMla.exe
  C:\Windows\System\XvsPMla.exe
  2⤵
  PID:5380
- C:\Windows\System\QcRZbbK.exe
  C:\Windows\System\QcRZbbK.exe
  2⤵
  PID:5412
- C:\Windows\System\KddtlYB.exe
  C:\Windows\System\KddtlYB.exe
  2⤵
  PID:5468
- C:\Windows\System\csDhGFR.exe
  C:\Windows\System\csDhGFR.exe
  2⤵
  PID:5496
- C:\Windows\System\rATIWcX.exe
  C:\Windows\System\rATIWcX.exe
  2⤵
  PID:5668
- C:\Windows\System\SOhuFil.exe
  C:\Windows\System\SOhuFil.exe
  2⤵
  PID:5808
- C:\Windows\System\UjgXHlQ.exe
  C:\Windows\System\UjgXHlQ.exe
  2⤵
  PID:5892
- C:\Windows\System\uRAnhFo.exe
  C:\Windows\System\uRAnhFo.exe
  2⤵
  PID:5980
- C:\Windows\System\XEzoGBg.exe
  C:\Windows\System\XEzoGBg.exe
  2⤵
  PID:6008
- C:\Windows\System\XTWAWvX.exe
  C:\Windows\System\XTWAWvX.exe
  2⤵
  PID:6036
- C:\Windows\System\XOuohzm.exe
  C:\Windows\System\XOuohzm.exe
  2⤵
  PID:6064
- C:\Windows\System\SOKzpPe.exe
  C:\Windows\System\SOKzpPe.exe
  2⤵
  PID:5336
- C:\Windows\System\NaERRBf.exe
  C:\Windows\System\NaERRBf.exe
  2⤵
  PID:5408
- C:\Windows\System\WEaIbqb.exe
  C:\Windows\System\WEaIbqb.exe
  2⤵
  PID:5456
- C:\Windows\System\HsuDNEa.exe
  C:\Windows\System\HsuDNEa.exe
  2⤵
  PID:5536
- C:\Windows\System\tYMrCRQ.exe
  C:\Windows\System\tYMrCRQ.exe
  2⤵
  PID:5600
- C:\Windows\System\GErdGmo.exe
  C:\Windows\System\GErdGmo.exe
  2⤵
  PID:5664
- C:\Windows\System\XwIBhmA.exe
  C:\Windows\System\XwIBhmA.exe
  2⤵
  PID:5800
- C:\Windows\System\MYULhuv.exe
  C:\Windows\System\MYULhuv.exe
  2⤵
  PID:5844
- C:\Windows\System\visXasG.exe
  C:\Windows\System\visXasG.exe
  2⤵
  PID:5904
- C:\Windows\System\WKhUVcX.exe
  C:\Windows\System\WKhUVcX.exe
  2⤵
  PID:6004
- C:\Windows\System\EwFSrbB.exe
  C:\Windows\System\EwFSrbB.exe
  2⤵
  PID:6060
- C:\Windows\System\dmZLQEl.exe
  C:\Windows\System\dmZLQEl.exe
  2⤵
  PID:6128
- C:\Windows\System\JCVzLUH.exe
  C:\Windows\System\JCVzLUH.exe
  2⤵
  PID:5308
- C:\Windows\System\GjNIzUE.exe
  C:\Windows\System\GjNIzUE.exe
  2⤵
  PID:5428
- C:\Windows\System\DQNDzeU.exe
  C:\Windows\System\DQNDzeU.exe
  2⤵
  PID:5620
- C:\Windows\System\JwZlLlD.exe
  C:\Windows\System\JwZlLlD.exe
  2⤵
  PID:5788
- C:\Windows\System\daXUzqc.exe
  C:\Windows\System\daXUzqc.exe
  2⤵
  PID:5940
- C:\Windows\System\HKHPojv.exe
  C:\Windows\System\HKHPojv.exe
  2⤵
  PID:6080
- C:\Windows\System\skRJtdz.exe
  C:\Windows\System\skRJtdz.exe
  2⤵
  PID:5636
- C:\Windows\System\AgDbyNG.exe
  C:\Windows\System\AgDbyNG.exe
  2⤵
  PID:5368
- C:\Windows\System\HrkdUTR.exe
  C:\Windows\System\HrkdUTR.exe
  2⤵
  PID:5860
- C:\Windows\System\FPaCkjr.exe
  C:\Windows\System\FPaCkjr.exe
  2⤵
  PID:6176
- C:\Windows\System\cOliYiG.exe
  C:\Windows\System\cOliYiG.exe
  2⤵
  PID:6208
- C:\Windows\System\mOzvecv.exe
  C:\Windows\System\mOzvecv.exe
  2⤵
  PID:6236
- C:\Windows\System\QTLhLiC.exe
  C:\Windows\System\QTLhLiC.exe
  2⤵
  PID:6264
- C:\Windows\System\ZPAtwlk.exe
  C:\Windows\System\ZPAtwlk.exe
  2⤵
  PID:6292
- C:\Windows\System\BuMNOwK.exe
  C:\Windows\System\BuMNOwK.exe
  2⤵
  PID:6320
- C:\Windows\System\dQYpmPw.exe
  C:\Windows\System\dQYpmPw.exe
  2⤵
  PID:6340
- C:\Windows\System\PQQlrVt.exe
  C:\Windows\System\PQQlrVt.exe
  2⤵
  PID:6376
- C:\Windows\System\slAworO.exe
  C:\Windows\System\slAworO.exe
  2⤵
  PID:6404
- C:\Windows\System\KHFGyOZ.exe
  C:\Windows\System\KHFGyOZ.exe
  2⤵
  PID:6428
- C:\Windows\System\nVoFHwQ.exe
  C:\Windows\System\nVoFHwQ.exe
  2⤵
  PID:6460
- C:\Windows\System\odlRojY.exe
  C:\Windows\System\odlRojY.exe
  2⤵
  PID:6488
- C:\Windows\System\IoBxQcJ.exe
  C:\Windows\System\IoBxQcJ.exe
  2⤵
  PID:6516
- C:\Windows\System\mLQBpSI.exe
  C:\Windows\System\mLQBpSI.exe
  2⤵
  PID:6544
- C:\Windows\System\xkdAuRH.exe
  C:\Windows\System\xkdAuRH.exe
  2⤵
  PID:6572
- C:\Windows\System\qQZWxkX.exe
  C:\Windows\System\qQZWxkX.exe
  2⤵
  PID:6600
- C:\Windows\System\mPHXvEA.exe
  C:\Windows\System\mPHXvEA.exe
  2⤵
  PID:6624
- C:\Windows\System\hHkkxKU.exe
  C:\Windows\System\hHkkxKU.exe
  2⤵
  PID:6652
- C:\Windows\System\vRUOLyR.exe
  C:\Windows\System\vRUOLyR.exe
  2⤵
  PID:6684
- C:\Windows\System\WadAbMg.exe
  C:\Windows\System\WadAbMg.exe
  2⤵
  PID:6712
- C:\Windows\System\diZEOeh.exe
  C:\Windows\System\diZEOeh.exe
  2⤵
  PID:6740
- C:\Windows\System\WxeafKb.exe
  C:\Windows\System\WxeafKb.exe
  2⤵
  PID:6768
- C:\Windows\System\nOlNvKo.exe
  C:\Windows\System\nOlNvKo.exe
  2⤵
  PID:6796
- C:\Windows\System\SvmQdbI.exe
  C:\Windows\System\SvmQdbI.exe
  2⤵
  PID:6828
- C:\Windows\System\WwWgEjM.exe
  C:\Windows\System\WwWgEjM.exe
  2⤵
  PID:6860
- C:\Windows\System\pzdzGWH.exe
  C:\Windows\System\pzdzGWH.exe
  2⤵
  PID:6884
- C:\Windows\System\ouFCXuB.exe
  C:\Windows\System\ouFCXuB.exe
  2⤵
  PID:6916
- C:\Windows\System\bRXhTYr.exe
  C:\Windows\System\bRXhTYr.exe
  2⤵
  PID:6944
- C:\Windows\System\HwgfQMC.exe
  C:\Windows\System\HwgfQMC.exe
  2⤵
  PID:6976
- C:\Windows\System\YmeYwnP.exe
  C:\Windows\System\YmeYwnP.exe
  2⤵
  PID:7000
- C:\Windows\System\QBSPfeS.exe
  C:\Windows\System\QBSPfeS.exe
  2⤵
  PID:7032
- C:\Windows\System\vReAsTr.exe
  C:\Windows\System\vReAsTr.exe
  2⤵
  PID:7060
- C:\Windows\System\yAHnmXx.exe
  C:\Windows\System\yAHnmXx.exe
  2⤵
  PID:7084
- C:\Windows\System\cKmNxUD.exe
  C:\Windows\System\cKmNxUD.exe
  2⤵
  PID:7144
- C:\Windows\System\JaIjmJX.exe
  C:\Windows\System\JaIjmJX.exe
  2⤵
  PID:6152
- C:\Windows\System\mgKupog.exe
  C:\Windows\System\mgKupog.exe
  2⤵
  PID:6216
- C:\Windows\System\hiMRUVM.exe
  C:\Windows\System\hiMRUVM.exe
  2⤵
  PID:6288
- C:\Windows\System\nhlZvAa.exe
  C:\Windows\System\nhlZvAa.exe
  2⤵
  PID:6412
- C:\Windows\System\yjRTEbS.exe
  C:\Windows\System\yjRTEbS.exe
  2⤵
  PID:6484
- C:\Windows\System\omwvaMr.exe
  C:\Windows\System\omwvaMr.exe
  2⤵
  PID:6532
- C:\Windows\System\mabdFnI.exe
  C:\Windows\System\mabdFnI.exe
  2⤵
  PID:6660
- C:\Windows\System\GumjhTb.exe
  C:\Windows\System\GumjhTb.exe
  2⤵
  PID:6736
- C:\Windows\System\ThBlniv.exe
  C:\Windows\System\ThBlniv.exe
  2⤵
  PID:6908
- C:\Windows\System\CFktvmC.exe
  C:\Windows\System\CFktvmC.exe
  2⤵
  PID:7100
- C:\Windows\System\cLIVNrY.exe
  C:\Windows\System\cLIVNrY.exe
  2⤵
  PID:7164
- C:\Windows\System\pWhOdmI.exe
  C:\Windows\System\pWhOdmI.exe
  2⤵
  PID:6316
- C:\Windows\System\RNoklzV.exe
  C:\Windows\System\RNoklzV.exe
  2⤵
  PID:7096
- C:\Windows\System\rbuxeQc.exe
  C:\Windows\System\rbuxeQc.exe
  2⤵
  PID:6900
- C:\Windows\System\blBWHOR.exe
  C:\Windows\System\blBWHOR.exe
  2⤵
  PID:7256
- C:\Windows\System\XkieHgr.exe
  C:\Windows\System\XkieHgr.exe
  2⤵
  PID:7284
- C:\Windows\System\kORkctW.exe
  C:\Windows\System\kORkctW.exe
  2⤵
  PID:7312
- C:\Windows\System\RRuwuuK.exe
  C:\Windows\System\RRuwuuK.exe
  2⤵
  PID:7428
- C:\Windows\System\TzpJdub.exe
  C:\Windows\System\TzpJdub.exe
  2⤵
  PID:7484
- C:\Windows\System\ziOCBTA.exe
  C:\Windows\System\ziOCBTA.exe
  2⤵
  PID:7540
- C:\Windows\System\MvABUYP.exe
  C:\Windows\System\MvABUYP.exe
  2⤵
  PID:7604
- C:\Windows\System\PUGlTPq.exe
  C:\Windows\System\PUGlTPq.exe
  2⤵
  PID:7632
- C:\Windows\System\NTAGSZj.exe
  C:\Windows\System\NTAGSZj.exe
  2⤵
  PID:7648
- C:\Windows\System\kbGPCtR.exe
  C:\Windows\System\kbGPCtR.exe
  2⤵
  PID:7676
- C:\Windows\System\XkOOyjS.exe
  C:\Windows\System\XkOOyjS.exe
  2⤵
  PID:7712
- C:\Windows\System\oIwVhCm.exe
  C:\Windows\System\oIwVhCm.exe
  2⤵
  PID:7740
- C:\Windows\System\jssyoNy.exe
  C:\Windows\System\jssyoNy.exe
  2⤵
  PID:7768
- C:\Windows\System\jwXZfSy.exe
  C:\Windows\System\jwXZfSy.exe
  2⤵
  PID:7824
- C:\Windows\System\TyoSRzs.exe
  C:\Windows\System\TyoSRzs.exe
  2⤵
  PID:7852
- C:\Windows\System\WukmDVr.exe
  C:\Windows\System\WukmDVr.exe
  2⤵
  PID:7884
- C:\Windows\System\xXLkdMA.exe
  C:\Windows\System\xXLkdMA.exe
  2⤵
  PID:7908
- C:\Windows\System\iiGTSGC.exe
  C:\Windows\System\iiGTSGC.exe
  2⤵
  PID:7932
- C:\Windows\System\BCOprKJ.exe
  C:\Windows\System\BCOprKJ.exe
  2⤵
  PID:7960
- C:\Windows\System\taPqUwc.exe
  C:\Windows\System\taPqUwc.exe
  2⤵
  PID:7988
- C:\Windows\System\tRfpWiT.exe
  C:\Windows\System\tRfpWiT.exe
  2⤵
  PID:8028
- C:\Windows\System\UMSjXfK.exe
  C:\Windows\System\UMSjXfK.exe
  2⤵
  PID:8052
- C:\Windows\System\cWqtFeb.exe
  C:\Windows\System\cWqtFeb.exe
  2⤵
  PID:8080
- C:\Windows\System\sNSNPIR.exe
  C:\Windows\System\sNSNPIR.exe
  2⤵
  PID:8104
- C:\Windows\System\fhlVaYu.exe
  C:\Windows\System\fhlVaYu.exe
  2⤵
  PID:8136
- C:\Windows\System\BqhJwaK.exe
  C:\Windows\System\BqhJwaK.exe
  2⤵
  PID:8160
- C:\Windows\System\qqOGUen.exe
  C:\Windows\System\qqOGUen.exe
  2⤵
  PID:7140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CfDpGtU.exe

Filesize
56KB

MD5
0bc4b237cf6d1ee28736b35a9a7780ca

SHA1
852131bd3a8249cc5fa8ca72d1d07be2fac60ef5

SHA256
af5be40d8a8bc8871674572d43dcf542fb498c0bfc49086e1383efd6cef417c3

SHA512
24429df84c18b0a7c34101f9360582b193d1e95b3f950fb9000d2ec8608fb11a0ceeb7c3a8ecd35a982908180befd5f3061d179476216190d457cd2d406dfc1f

Download Submit
C:\Windows\System\HZlplni.exe

Filesize
5KB

MD5
d93ed3960105b7ee1460f0a19877941a

SHA1
cf6472905b124503be2a370d7da07da82afcba6c

SHA256
0276f939a130e6dbd8ab86829f3f10f43a777e2c7d2fc7f3aab37a2c2dd9f7ec

SHA512
cedf0b3875158f8361a322afefc9ef684db6dbbba590f6cfb4be6b2707f6c467b76d4ac5b29f9732f9a99e944ba1d0836e6b1694ede9ce5e7bc1133811d944e0

Download Submit
C:\Windows\System\JzkQlsc.exe

Filesize
50KB

MD5
3bf942f1cc5157f91efc9e6fef68d98f

SHA1
c8de13cdd147a7416a483816f72052f45e71e376

SHA256
9f871b567dd89c999091219a205b4789f3780ebacf56d3767507f189d133eb4b

SHA512
424f8f169ef9c96aaa7c4e2caa822e0650b3dfb3cfe194d11632e48efdc3b4a8fc477a52c5db78c20809dbcded10b025874c66af8e5ba631f57532353137e82a

Download Submit
C:\Windows\System\NBxUVEa.exe

Filesize
33KB

MD5
dd25d7e24ff4f1d694093a3fc4c02479

SHA1
7c36d6ef0b47febc0e85435248d7b28eba48ad04

SHA256
320a8cf3b7476c00c8496cffae9805fc5b0c3a4cf65cc687a524392f0a397674

SHA512
876154bf4effaff0e76ef81556d1573f5bab3cc9a6a3d5a91c7092ab0c01444c7fbca1cb3b0538f82f9c2371e24f8712a05e943eebc97ca7eef54a950ba9cf8e

Download Submit
C:\Windows\System\NBxUVEa.exe

Filesize
5KB

MD5
0c1a425c48fd9ab85d8b706a59be39d2

SHA1
eed349fb3e9885e44e8745ae574ac667cae1134d

SHA256
f221a8ba5fae7516d4adb37d09c7518268daab707bc78890832f831d94a78418

SHA512
d97f43909eddf09c84d56052a6c565b186cd7aa3c6a83c85d357e71a185872dc36fe84694fd50696789e07a267f0f5fa03bc6bf416e2b3275a3d3b00f9c407ff

Download Submit
C:\Windows\System\YkXKTLb.exe

Filesize
31KB

MD5
249686638396b42b66ecd16906ea6e50

SHA1
0747f15b56561d5d7618e6f3e794901d387d2082

SHA256
eaf232432b6374019826add6053e6f0b1f750d21631a4000351348894b696106

SHA512
35c81357b2e08b25c0042eb99c5726e9d046e7b45a690670b31b4ced0c778b13d21c7fd80745cffd5a2aaaa9387f432f8c9297063f433486d61bf620530f7c43

Download Submit
C:\Windows\System\bUtjEeA.exe

Filesize
29KB

MD5
2a6bc4d0b2841e6b69069ddc2dac9a05

SHA1
6c72b0925962659e5d6fa3ff407e64d01b9216ce

SHA256
f70b754a043a0b54efa703aa7130776a662093a4055c152d950bad4a63a50a4f

SHA512
dca9196c3f57c540cda8409c922a4b8056ba49a211fb3836425fd0ed244f839dea6325d4e989aca73d69943e6cf5805bd59c542eced862ac286006a5ff27f2bd

Download Submit
C:\Windows\System\bzmqtte.exe

Filesize
37KB

MD5
8694b1cd896d80d7cd5ac72225bd8b85

SHA1
95b16d8cd8d8f5d9a41086efe515fad96b41b9c1

SHA256
c6785ed8a53cf0f6ce2bfe366fd147e1394cbd08aef41311257a01f2c200ae22

SHA512
dd60b3f20175317175cde1c5667d289b91c804b0260ec376cf1797ba44081eb3b389f59c44526a5f48408771544de39bc373558c0d9014a04a62c8e4cf2ca4e2

Download Submit
C:\Windows\System\fWbZOJl.exe

Filesize
8KB

MD5
40693158d063df02dd1d1ac23a7f645b

SHA1
17a37bcb4a036f97e2682e7a1549bc739ffa49ef

SHA256
643070badb34bacd2a46a7eb4e4a19cb29ee9cddf4587e3aa1cb3703c4df9d47

SHA512
f1abdc9485132c7b8fa20f59cb4d790ed7130a3f2ed04b4e0eab57803f8996bbdf4c64c703e8cc4b5b2d3e0d0b08a5fb848f91391acbe130b7029eb5eecf8e82

Download Submit
C:\Windows\System\kAgGbwV.exe

Filesize
1KB

MD5
475584c9e8d3045fd26c07a222d0faa0

SHA1
18ff4995ea104284b7705e5da8d83b03530ff688

SHA256
92b8cadedc42a5e8b07cbb05c5f8480c2d060da936a6d9db8ed0cd9795aff7f9

SHA512
02a8c9d91d2ef673e9e61f8dab6fafc8ec55e508c995ff59b830565b825297b9694b1bff3f0b0446344eb12520bc67d1c04ad1f742efbee5f5af7097b157a2dc

Download Submit
C:\Windows\System\kCyrkRw.exe

Filesize
93KB

MD5
9705ce79fb22315000c23b1dcde45eff

SHA1
a7c4dc63528dcbdb033f1ebcc86575a4f9b6b112

SHA256
37e4b94a6c63e3626f5b43a769daebd5a95e2bd16b5bcd76fca58881b8030150

SHA512
af3fc2209b986e8db7d3a8c2b169145b876ea4170c9cd0bed6fa1eebef28f6c1dbd1558d353ae5ef37eb1796907f69077641d5d3fe6cd8487819916e695cfcf5

Download Submit
C:\Windows\System\oMMzGFS.exe

Filesize
6KB

MD5
23ca4e97cccd7aa0636da7c1cef5ff22

SHA1
bdbcf5c3208965de5d12763c178d7121692f2754

SHA256
b3dc75951e2a9b64d051199a237755ed7a5cab2692ef86157194231467e730b3

SHA512
173b1ee4970368755e5df3331802cb4d1daa1aa99426207a447b76942b20687b04ea84ace41e0d953443df05c06b62d3c6c73f4fc6028f06cb6544687eb41457

Download Submit
C:\Windows\System\oMMzGFS.exe

Filesize
33KB

MD5
7dbdda163124ea49354f846e5b7519a6

SHA1
a24bc0f39a8f12454a7c38782762753bde6f45c1

SHA256
ee15cee2cdc64c9dede21be1b2d59fe216b7c1e995d02c6cb38255a48d62bfeb

SHA512
105637673f7b9da5833abbb037727cc15e9b07378daba4662353b0272ab5eaa1b253c49ecfa13bf5131d335a40f9e1a6199eb4ecb08bcafb7041fc7cf2993577

Download Submit
C:\Windows\System\pJhtMuc.exe

Filesize
59KB

MD5
cb117909427f5abe41b65cfa9b6c76df

SHA1
7d378453bfc8f04fc362ba1c6d5540cc21b6c743

SHA256
5f735d2d7c247d834f77c4334d86500a0c252d53299b51a8dbac7b9f05bb4c18

SHA512
882360ad8a5e140df4be2595f19aeba2f076137160256d594211515a5242758c64befed17434d2cb03c75efa5ee5e661c718cbae6b0e0b4da663f52d76e5132b

Download Submit
C:\Windows\System\pJhtMuc.exe

Filesize
84KB

MD5
651e0d0b35097614d0e740b1458dcb7e

SHA1
d582908bd4f7e167d2e13fe01b9e0ab18fbc8cf0

SHA256
428b75226074aaca51072ba2e1423b37520333d20d0ffe297a852eb90f1cfcda

SHA512
e3df1edf7a20b0222872eedff00e10740472b972d41c50b42d3a34b048f220537771571a4a47724827ebbedae99ae6e99c250a42b2e900e36e668ad76558057a

Download Submit
C:\Windows\System\zmGcyoj.exe

Filesize
59KB

MD5
d685f089e5c61c86d9927d33f74228be

SHA1
1f18fa744e7aadb0127ffc15f23d14bc1efd53ef

SHA256
4536f6be44b6fc34dd5ba996c0e5a8e5526fbfd7fa07ff2c0398a825f280b70d

SHA512
e00533b96a7a8054344cd56af89578fa7220f49691a9e38650da90136a6ee65eb5105a5859b32ffd31ccd1e1fa8b8c7a4c96f78df62fb9a30c13d4009b1aaf7c

Download Submit
memory/444-699-0x00007FF6B6D70000-0x00007FF6B70C4000-memory.dmp

Filesize
3.3MB

Download
memory/1800-588-0x00007FF70D750000-0x00007FF70DAA4000-memory.dmp

Filesize
3.3MB

Download
memory/1800-165-0x00007FF70D750000-0x00007FF70DAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2848-88-0x00007FF717080000-0x00007FF7173D4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-0-0x00007FF692540000-0x00007FF692894000-memory.dmp

Filesize
3.3MB

Download
memory/2876-1-0x000002901E930000-0x000002901E940000-memory.dmp

Filesize
64KB

Download
memory/3084-300-0x00007FF69F0A0000-0x00007FF69F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/3960-93-0x00007FF767A60000-0x00007FF767DB4000-memory.dmp

Filesize
3.3MB

Download
memory/3992-32-0x00007FF76A2C0000-0x00007FF76A614000-memory.dmp

Filesize
3.3MB

Download
memory/4008-120-0x00007FF6D2390000-0x00007FF6D26E4000-memory.dmp

Filesize
3.3MB

Download
memory/4172-417-0x00007FF6B7E80000-0x00007FF6B81D4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-164-0x00007FF73C5A0000-0x00007FF73C8F4000-memory.dmp

Filesize
3.3MB

Download
memory/4624-473-0x00007FF725C40000-0x00007FF725F94000-memory.dmp

Filesize
3.3MB

Download
memory/4624-158-0x00007FF725C40000-0x00007FF725F94000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads