cobaltstrike | 5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
Size 5.2MB
Sample260910-3qs2jszsdz
SHA256 5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf
MD5 c98b90633bd8e1e8b5a81a6bbad06990
SHA1 bf3dce5d44a7c3cbb56ce93fb7561f7946e612a8
SHA512 4a75ad5d0e9540269dd9bd619e1d70846abd0df1c22aacd0c6a0b154b567b7b46bb28fd54bad8691d41e3e93af110bc154cd4eb93e38f3df3fb9d0f6045c2253
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUq
TLSH
T12E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000024543-7.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024544-18.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024552-77.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024546-78.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024551-94.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024555-110.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454f-108.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454c-106.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454b-104.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024547-101.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024553-99.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454a-88.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024549-86.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024554-83.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024550-75.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454e-73.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454d-70.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024545-69.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024548-63.dat	cobalt_reflective_dll
behavioral1/files/0x000800000002453d-28.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000024366-12.dat	cobalt_reflective_dll

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral1/memory/4520-119-0x00007FF7660D0000-0x00007FF766421000-memory.dmp	xmrig
behavioral1/memory/1296-126-0x00007FF694360000-0x00007FF6946B1000-memory.dmp	xmrig
behavioral1/memory/5020-127-0x00007FF731620000-0x00007FF731971000-memory.dmp	xmrig
behavioral1/memory/4416-125-0x00007FF7AA080000-0x00007FF7AA3D1000-memory.dmp	xmrig
behavioral1/memory/5012-124-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp	xmrig
behavioral1/memory/2116-123-0x00007FF7824C0000-0x00007FF782811000-memory.dmp	xmrig
behavioral1/memory/1652-122-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp	xmrig
behavioral1/memory/3800-121-0x00007FF645040000-0x00007FF645391000-memory.dmp	xmrig
behavioral1/memory/4412-120-0x00007FF75B6D0000-0x00007FF75BA21000-memory.dmp	xmrig
behavioral1/memory/3516-118-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp	xmrig
behavioral1/memory/1272-117-0x00007FF6AD3E0000-0x00007FF6AD731000-memory.dmp	xmrig
behavioral1/memory/1432-116-0x00007FF796F10000-0x00007FF797261000-memory.dmp	xmrig
behavioral1/memory/3508-115-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp	xmrig
behavioral1/memory/2852-114-0x00007FF638280000-0x00007FF6385D1000-memory.dmp	xmrig
behavioral1/memory/4824-113-0x00007FF6C0480000-0x00007FF6C07D1000-memory.dmp	xmrig
behavioral1/memory/4816-112-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp	xmrig
behavioral1/memory/640-102-0x00007FF7F1420000-0x00007FF7F1771000-memory.dmp	xmrig
behavioral1/memory/3920-84-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp	xmrig
behavioral1/memory/1788-128-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/4848-131-0x00007FF698500000-0x00007FF698851000-memory.dmp	xmrig
behavioral1/memory/1636-130-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp	xmrig
behavioral1/memory/4132-129-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp	xmrig
behavioral1/memory/1788-172-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-173-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-195-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/4132-217-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp	xmrig
behavioral1/memory/1636-219-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp	xmrig
behavioral1/memory/4848-221-0x00007FF698500000-0x00007FF698851000-memory.dmp	xmrig
behavioral1/memory/3920-223-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp	xmrig
behavioral1/memory/1296-250-0x00007FF694360000-0x00007FF6946B1000-memory.dmp	xmrig
behavioral1/memory/5012-257-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp	xmrig
behavioral1/memory/3800-255-0x00007FF645040000-0x00007FF645391000-memory.dmp	xmrig
behavioral1/memory/1652-254-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp	xmrig
behavioral1/memory/2116-251-0x00007FF7824C0000-0x00007FF782811000-memory.dmp	xmrig
behavioral1/memory/3508-247-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp	xmrig
behavioral1/memory/1432-246-0x00007FF796F10000-0x00007FF797261000-memory.dmp	xmrig
behavioral1/memory/4520-243-0x00007FF7660D0000-0x00007FF766421000-memory.dmp	xmrig
behavioral1/memory/4816-242-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp	xmrig
behavioral1/memory/3516-239-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp	xmrig
behavioral1/memory/640-238-0x00007FF7F1420000-0x00007FF7F1771000-memory.dmp	xmrig
behavioral1/memory/4824-235-0x00007FF6C0480000-0x00007FF6C07D1000-memory.dmp	xmrig
behavioral1/memory/2852-234-0x00007FF638280000-0x00007FF6385D1000-memory.dmp	xmrig
behavioral1/memory/5020-231-0x00007FF731620000-0x00007FF731971000-memory.dmp	xmrig
behavioral1/memory/4416-230-0x00007FF7AA080000-0x00007FF7AA3D1000-memory.dmp	xmrig
behavioral1/memory/1272-228-0x00007FF6AD3E0000-0x00007FF6AD731000-memory.dmp	xmrig
behavioral1/memory/4412-226-0x00007FF75B6D0000-0x00007FF75BA21000-memory.dmp	xmrig
behavioral1/memory/1788-258-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-259-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-260-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-261-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-262-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-263-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-264-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-265-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-266-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig
behavioral1/memory/1788-267-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4132	wKhUKxK.exe
1636	UqyokaM.exe
4848	EOPxHCp.exe
3920	tgAsZhv.exe
4416	lPncOGc.exe
640	IcwNBis.exe
1296	ZYktkrk.exe
4816	NUOUxZt.exe
4824	NxbgdLe.exe
2852	ExDKGwz.exe
3508	eeWyzyO.exe
1432	jiOAscz.exe
1272	wwxnQai.exe
3516	gvMNOBo.exe
4520	sAfHXKF.exe
4412	JpThthQ.exe
3800	wUJfeeW.exe
1652	WUoBBZE.exe
2116	NsBmtxE.exe
5020	lFFWAQd.exe
5012	vqpelyK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-0-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	upx
behavioral1/files/0x0007000000024543-7.dat	upx
behavioral1/files/0x0007000000024544-18.dat	upx
behavioral1/files/0x0007000000024552-77.dat	upx
behavioral1/files/0x0007000000024546-78.dat	upx
behavioral1/files/0x0007000000024551-94.dat	upx
behavioral1/files/0x0007000000024555-110.dat	upx
behavioral1/memory/4520-119-0x00007FF7660D0000-0x00007FF766421000-memory.dmp	upx
behavioral1/memory/1296-126-0x00007FF694360000-0x00007FF6946B1000-memory.dmp	upx
behavioral1/memory/5020-127-0x00007FF731620000-0x00007FF731971000-memory.dmp	upx
behavioral1/memory/4416-125-0x00007FF7AA080000-0x00007FF7AA3D1000-memory.dmp	upx
behavioral1/memory/5012-124-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp	upx
behavioral1/memory/2116-123-0x00007FF7824C0000-0x00007FF782811000-memory.dmp	upx
behavioral1/memory/1652-122-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp	upx
behavioral1/memory/3800-121-0x00007FF645040000-0x00007FF645391000-memory.dmp	upx
behavioral1/memory/4412-120-0x00007FF75B6D0000-0x00007FF75BA21000-memory.dmp	upx
behavioral1/memory/3516-118-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp	upx
behavioral1/memory/1272-117-0x00007FF6AD3E0000-0x00007FF6AD731000-memory.dmp	upx
behavioral1/memory/1432-116-0x00007FF796F10000-0x00007FF797261000-memory.dmp	upx
behavioral1/memory/3508-115-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp	upx
behavioral1/memory/2852-114-0x00007FF638280000-0x00007FF6385D1000-memory.dmp	upx
behavioral1/memory/4824-113-0x00007FF6C0480000-0x00007FF6C07D1000-memory.dmp	upx
behavioral1/memory/4816-112-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp	upx
behavioral1/files/0x000700000002454f-108.dat	upx
behavioral1/files/0x000700000002454c-106.dat	upx
behavioral1/files/0x000700000002454b-104.dat	upx
behavioral1/memory/640-102-0x00007FF7F1420000-0x00007FF7F1771000-memory.dmp	upx
behavioral1/files/0x0007000000024547-101.dat	upx
behavioral1/files/0x0007000000024553-99.dat	upx
behavioral1/files/0x000700000002454a-88.dat	upx
behavioral1/files/0x0007000000024549-86.dat	upx
behavioral1/memory/3920-84-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp	upx
behavioral1/files/0x0007000000024554-83.dat	upx
behavioral1/memory/4848-79-0x00007FF698500000-0x00007FF698851000-memory.dmp	upx
behavioral1/files/0x0007000000024550-75.dat	upx
behavioral1/files/0x000700000002454e-73.dat	upx
behavioral1/files/0x000700000002454d-70.dat	upx
behavioral1/files/0x0007000000024545-69.dat	upx
behavioral1/files/0x0007000000024548-63.dat	upx
behavioral1/memory/1636-39-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp	upx
behavioral1/files/0x000800000002453d-28.dat	upx
behavioral1/memory/4132-13-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp	upx
behavioral1/files/0x000a000000024366-12.dat	upx
behavioral1/memory/1788-128-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	upx
behavioral1/memory/4848-131-0x00007FF698500000-0x00007FF698851000-memory.dmp	upx
behavioral1/memory/1636-130-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp	upx
behavioral1/memory/4132-129-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp	upx
behavioral1/memory/1788-172-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	upx
behavioral1/memory/1788-173-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	upx
behavioral1/memory/1788-195-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp	upx
behavioral1/memory/4132-217-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp	upx
behavioral1/memory/1636-219-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp	upx
behavioral1/memory/4848-221-0x00007FF698500000-0x00007FF698851000-memory.dmp	upx
behavioral1/memory/3920-223-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp	upx
behavioral1/memory/1296-250-0x00007FF694360000-0x00007FF6946B1000-memory.dmp	upx
behavioral1/memory/5012-257-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp	upx
behavioral1/memory/3800-255-0x00007FF645040000-0x00007FF645391000-memory.dmp	upx
behavioral1/memory/1652-254-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp	upx
behavioral1/memory/2116-251-0x00007FF7824C0000-0x00007FF782811000-memory.dmp	upx
behavioral1/memory/3508-247-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp	upx
behavioral1/memory/1432-246-0x00007FF796F10000-0x00007FF797261000-memory.dmp	upx
behavioral1/memory/4520-243-0x00007FF7660D0000-0x00007FF766421000-memory.dmp	upx
behavioral1/memory/4816-242-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp	upx
behavioral1/memory/3516-239-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wKhUKxK.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\ExDKGwz.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\sAfHXKF.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\wUJfeeW.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\NsBmtxE.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\tgAsZhv.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\lPncOGc.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\IcwNBis.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\ZYktkrk.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\gvMNOBo.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\lFFWAQd.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\vqpelyK.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\UqyokaM.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\NUOUxZt.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\NxbgdLe.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\eeWyzyO.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\jiOAscz.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\EOPxHCp.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\wwxnQai.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\JpThthQ.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\WUoBBZE.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
Token: SeLockMemoryPrivilege	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4132	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	86
PID 1788 wrote to memory of 1636	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	87
PID 1788 wrote to memory of 4848	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	88
PID 1788 wrote to memory of 3920	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	89
PID 1788 wrote to memory of 4416	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	90
PID 1788 wrote to memory of 640	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	91
PID 1788 wrote to memory of 1296	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	92
PID 1788 wrote to memory of 4816	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	93
PID 1788 wrote to memory of 4824	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	94
PID 1788 wrote to memory of 2852	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	95
PID 1788 wrote to memory of 3508	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	96
PID 1788 wrote to memory of 1432	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	97
PID 1788 wrote to memory of 1272	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	98
PID 1788 wrote to memory of 3516	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	99
PID 1788 wrote to memory of 4520	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	100
PID 1788 wrote to memory of 4412	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	101
PID 1788 wrote to memory of 3800	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	102
PID 1788 wrote to memory of 1652	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	103
PID 1788 wrote to memory of 2116	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	104
PID 1788 wrote to memory of 5020	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	105
PID 1788 wrote to memory of 5012	1788	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	106

C:\Users\Admin\AppData\Local\Temp\5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
"C:\Users\Admin\AppData\Local\Temp\5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\System\wKhUKxK.exe
  C:\Windows\System\wKhUKxK.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\UqyokaM.exe
  C:\Windows\System\UqyokaM.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\EOPxHCp.exe
  C:\Windows\System\EOPxHCp.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\tgAsZhv.exe
  C:\Windows\System\tgAsZhv.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\lPncOGc.exe
  C:\Windows\System\lPncOGc.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\IcwNBis.exe
  C:\Windows\System\IcwNBis.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ZYktkrk.exe
  C:\Windows\System\ZYktkrk.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\NUOUxZt.exe
  C:\Windows\System\NUOUxZt.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\NxbgdLe.exe
  C:\Windows\System\NxbgdLe.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\ExDKGwz.exe
  C:\Windows\System\ExDKGwz.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\eeWyzyO.exe
  C:\Windows\System\eeWyzyO.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\jiOAscz.exe
  C:\Windows\System\jiOAscz.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\wwxnQai.exe
  C:\Windows\System\wwxnQai.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\gvMNOBo.exe
  C:\Windows\System\gvMNOBo.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\sAfHXKF.exe
  C:\Windows\System\sAfHXKF.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\JpThthQ.exe
  C:\Windows\System\JpThthQ.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\wUJfeeW.exe
  C:\Windows\System\wUJfeeW.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\WUoBBZE.exe
  C:\Windows\System\WUoBBZE.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\NsBmtxE.exe
  C:\Windows\System\NsBmtxE.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\lFFWAQd.exe
  C:\Windows\System\lFFWAQd.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\vqpelyK.exe
  C:\Windows\System\vqpelyK.exe
  2⤵
  - Executes dropped EXE
  PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EOPxHCp.exe

Path C:\Windows\System\EOPxHCp.exe
Size 5.2MB
SHA256 1f112071ce5d7acc37f6b38a2669223a7268947ab57f517d72ae6d4d45f2fa0c
MD5 e834a15c2794b62ec35bdb80cb51af95
SHA1 1b3eac048985712823053933afbd1008d5800047
SHA512 f52ae7f86fa88a1b3eb81e20995c62822e6aa7c33bf5ce15df3972356142db01fec61a3e03e87eb4146dc91b704bcaa751c920f45d54ba261b4f90489b8faf45
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUo
TLSH
T1DC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExDKGwz.exe

Path C:\Windows\System\ExDKGwz.exe
Size 5.2MB
SHA256 e6d235191667a39260a069ac2892fb756ef8253dcd6ab3d81ea5705510f65263
MD5 a552e74f1493a92bda43cb327159c981
SHA1 30cd06d08e59fa0f7ab4f6c8ba12db5bd19740e6
SHA512 668e125c82e5053c337549e431a1e09aacf5c328b170165df8e551f9f1af60cff88694260a51f17cf8ead81f2b86e929102d07df8959409a110c23ed4d2dfb4b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUh
TLSH
T1AD465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IcwNBis.exe

Path C:\Windows\System\IcwNBis.exe
Size 5.2MB
SHA256 6838e801b66d746862fae0d7daee108f3169f6f7f3e8153cc5a617819fa7b73f
MD5 e20c964c9580474a7d923c56d0dc8623
SHA1 ce8c75c1e6c7c0cfcc82c5d16f1d458c0265954a
SHA512 db76ed467c096f88fbe1c290a4ec1f9d61171db38a07d2dbeb99b60911f4095dd2d1f17972f45abd7861711de0061c91ea520e677171bc925db0ec0f405e32c6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUT
TLSH
T124465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JpThthQ.exe

Path C:\Windows\System\JpThthQ.exe
Size 5.2MB
SHA256 517ebc7047c806de3b0f5e55dd0bd06a01c52ea480ae526e253d1ed348ad107e
MD5 c87b790379b5682003261f4768b9ea57
SHA1 0a74ee3d2c3867bfc3609caeb652a62b7346e71f
SHA512 781aea9fdd1983037b16e23e2e8fbe496792f415b3caa16feee8dea50aa6e0dfbc264ba7f9d281c45ee642af90619d474e3cbd848d7b3844cd2df50babf8ea3d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUB
TLSH
T114465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NUOUxZt.exe

Path C:\Windows\System\NUOUxZt.exe
Size 5.2MB
SHA256 87393dbc9d4ae89bd75a9f00455789600b208feece8f2cefddfdef5a6e5f34b1
MD5 27aac5112a75c922b166d42b544f8389
SHA1 902f133b57fe8f4fb6cd2a219c84f5f660196e00
SHA512 7913d047cfad068ca598e7dcb18b86e6ceeb286e70e9bb4aa1df4e43dd6cd84cdb91710309894e25617fe2d42506d5d5590493602af32283cb2cc1effdb42198
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUK
TLSH
T128465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NsBmtxE.exe

Path C:\Windows\System\NsBmtxE.exe
Size 5.2MB
SHA256 208fb2f291c8965336f469193dff09485d6755a305c47410c8466de2fd6dfad1
MD5 c6bd864764c66c7517dc5f4163483b29
SHA1 8918220f379edc86cc3d83a69e3b536fdf7dce1c
SHA512 9ff3d4d679e686ce002d7a6fec4c9bce742d30e6a6558a357e687c8a0f1208a679ee20ce8950aa4dbf644d23711b3c23695023123bc9eb6073713e69060dd3f6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUH
TLSH
T134465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxbgdLe.exe

Path C:\Windows\System\NxbgdLe.exe
Size 5.2MB
SHA256 c406883d54ca06c31be32a7537d465829d0b08d615c2a51b533287dc4597c278
MD5 93a1a511ecfe35c143def2aa69e2c77f
SHA1 f0d5d3a9f2551feeb38f6e373e993299a24c5d59
SHA512 7a1a63e9d9c39760d02a285c0978afe1b547c4c3c9426c88ee14557db6efc0e3e5c5ebb064d93abdf50d386ed99018543fe0d31d7f56509b30a8e7702ba53c3e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUL
TLSH
T1B7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UqyokaM.exe

Path C:\Windows\System\UqyokaM.exe
Size 5.2MB
SHA256 c6b0a1d89c192b8c4a9d222a5389871af49e5c9433de760dc7127b30f682adb3
MD5 42b170bed00480fdbbece490f92f4c70
SHA1 faf555e1d3a96a61f982b84fc330d6d1713cb6e6
SHA512 19afc829479cc5ced1cd0568a869764cbaaa203f7ade774fecfd1b9064b7298b80125878e69a8f9a6ab4b09e9f3be3c95232ae2770c5f01ad1989c643354cebd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lU2
TLSH
T1D9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUoBBZE.exe

Path C:\Windows\System\WUoBBZE.exe
Size 5.2MB
SHA256 5fb447d1eaec1155503d83de4864063a2257964c7aa89a10b1dfff4d910410cd
MD5 eed8d56e47f43a4f66a592477868d3b7
SHA1 15d4297044c4f4d2ecbb79057a7da7f087e62058
SHA512 0aff93629365d7702c51c92130f3f00b27340492c359d35c76a3b1a412b2e0021a17a134fea98fba9370df2b21e035c47c5eb332405e05e7812d2180ccd65110
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lU7
TLSH
T1E0465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZYktkrk.exe

Path C:\Windows\System\ZYktkrk.exe
Size 5.2MB
SHA256 aa31ebd594fcdfac42fb9bdf36a429035073643bd2bdcc2edd39caeb89302a6a
MD5 6ece8b6d9274b911c984e9847d799c0c
SHA1 05c32b4ce1766a44f7fc41139e7546dcebdb17b3
SHA512 a6fdeae1d0fb91b7e8f2666449cdee6c05b0827e857cd26f60751d4e5ab31d457221ad2fceeafdd9ff8b5ffa01f62d6caefbb2f9fae0d99a187574560bb4346e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lU6
TLSH
T1E6465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeWyzyO.exe

Path C:\Windows\System\eeWyzyO.exe
Size 5.2MB
SHA256 40aa9315029b8a717afa101abdcc38fbb6d2d0b7e35b0d15e77b83ecb105aa41
MD5 8fa167b998e8088ad58b848ecd87ab8d
SHA1 70cab76b359a732181ad2e8d8879262e8bc2420d
SHA512 45ad60501b1df84d852e16627261780b75e0a356511bbfe371aa7312df7c4fe42079f6f4110c45d0c31f780a360c783a93e82ca24e85c75675850af6e7a81677
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUi
TLSH
T1C1465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gvMNOBo.exe

Path C:\Windows\System\gvMNOBo.exe
Size 5.2MB
SHA256 2cdf9f7d9fe8c628c1ca7e027f990663959df887a1159f7c550383fc400bfa2d
MD5 1565663c0fc9630a1fabf85f46b6f028
SHA1 3e93ccd2bc04842a9edf85bed8b3fee0535c5277
SHA512 68c1613ae9b6ed23e6d874376f2d876fc4cffbfa554749e4eb0bb395d86b088daa630db5c80cbe6ecd1c7c4528bf1fe45e798a92720d135e0d7702354e37dc42
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUu
TLSH
T13E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jiOAscz.exe

Path C:\Windows\System\jiOAscz.exe
Size 5.2MB
SHA256 4bc5c3196c7f84c9b2713eb66ac743cf73fd8dd244c3ced93a15257bb5d3959c
MD5 d84a5c4ebf65fe9a0925fb6691c64c76
SHA1 53ee5357eee906717bd2f1ce9d138937afe96a92
SHA512 d59ecf37cb4cfdebd2cb080592574b10c7f0ea272a1b1538eb8ce098772deb58f9a517ed1576a82d5db8339f629872b06ceac524c65120723500b0a584b28e9c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUw
TLSH
T13A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lFFWAQd.exe

Path C:\Windows\System\lFFWAQd.exe
Size 5.2MB
SHA256 6ff6c19cacd5ed0deb09e273c2dfd87b9e9054fba6acd70566f24b186eb48d14
MD5 bbe393cb7aac87682892f12c4467eb55
SHA1 1d570b8adff72501b5eb0e278e69cd2c0344cf4d
SHA512 ca8cbb6a68e91154189a6a56e8b8fdd75d09e202c5ebe233eb5d236f0f8fdcd1b6647e780e1a59683802affbf5e5bae82c091f32556d88b1c20142fcbc2389f4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUw
TLSH
T1CD465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lPncOGc.exe

Path C:\Windows\System\lPncOGc.exe
Size 5.2MB
SHA256 e232ae6f9739357cb2cd7ed1cc249b6145626e96037662161081fd2260c677bc
MD5 54e5245a37630a18dea582f08d67aed7
SHA1 9c6dcaaa8a395a70e513d2878623d7acd096f945
SHA512 3bcb35cd0ae264c6e5d781c767a6b90c9d616e17e9db9d3ef810cb6715324dc6e33702e8906dd07b2a7b4fa364165588d6834d487bfe7f44cf2ec284dab13e56
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU/
TLSH
T16F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAfHXKF.exe

Path C:\Windows\System\sAfHXKF.exe
Size 5.2MB
SHA256 10ae3e67835b5a10e8c1c4bfd49546963b46d33aa7cd9957a0e1a4aed1f662ac
MD5 318ace4b7222c84f110a125c04d12b3e
SHA1 79bf7b022486637c2a8b389b35a67738f60f1b60
SHA512 a11c52ebb80af2abecb4c5b4e78fcf4f895261434aa9011ee95fec9c2e31319ad6e115226be9dfc3455378e589caef0ee96d6bc68ae7be4ef95545921e7adc96
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUC
TLSH
T108465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tgAsZhv.exe

Path C:\Windows\System\tgAsZhv.exe
Size 5.2MB
SHA256 2a2aaa0b667a743370bbde64c0427c3d28397bebcb0a42958af68039dead6000
MD5 802e647b56b8fcc42c93439f31274ea6
SHA1 b9078f8b632ad0150e5177136065ce2559bb4af9
SHA512 1111fdec51c43f0fe822d5e68ef836a8fde4b33d60d8f9a030f0b4d12149c23ffb1f0d064cf19db2bda8caba24d66e85e414f06bce53d5ebed37fdfc4460fd89
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUA
TLSH
T1FC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqpelyK.exe

Path C:\Windows\System\vqpelyK.exe
Size 5.2MB
SHA256 df844b3be8d20d1b887c9f3861ee951910801279a2cb49ce6dc9a5118edda8dd
MD5 d461a53fe734993a4ff6d98e64d7f9bc
SHA1 e6fb728748233a17ba7ef5a2d6bc8c344d68bfe8
SHA512 87355515dc972e551db1449e46996d59bfa308cdc24b87c54c56217d879489304a753254efcf4be386266430f067a49d51a6edfe83ba3a677d73c90eb0b31252
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lU5
TLSH
T152465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wKhUKxK.exe

Path C:\Windows\System\wKhUKxK.exe
Size 5.2MB
SHA256 7ff0978e594f36e14ab7801d8d76735479978da515250eb030d4ca2a2d7b38b1
MD5 e5a1079c9cba867728da4c820b6da09c
SHA1 5982536506941e71315c8f227e3b9cba2c93cd3e
SHA512 0f156889c0e878dc46818439632f0df0886ad391377c55897228ee59f0e1ce636b2de6dd5bfda67b0e6d3cb1fc626f281fbaa697fb3d9bba58235d878365530c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUm
TLSH
T1C7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wUJfeeW.exe

Path C:\Windows\System\wUJfeeW.exe
Size 5.2MB
SHA256 0cc21197ab10d6f977be339772597c02af8150ffd5c0069c0065c15fbc4fe3c8
MD5 7776b6c31b2650f02967a27711dea508
SHA1 cf1e0072db024c10f136d3b7d8371f3df3ae6a45
SHA512 b5626442c3d1565be87e4abab5f417165a24a8f9b43323dbda66073ed62a6ca721c732bd9134a0af23734bff2f65873cfa4807b76074d61c5d04391e568694f1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUi
TLSH
T1C0465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwxnQai.exe

Path C:\Windows\System\wwxnQai.exe
Size 5.2MB
SHA256 c9350d8b6d4a08fd8c5f971314cc84a2468ab5abe2615bfd7d3878ce3571a3e6
MD5 5e6e50debd956f3c596cd3cf61f7d8f7
SHA1 08b6a5becd0676d01b10de127ce8f87b1521e6df
SHA512 e05e227d42b8be7213bdd25ff4321ed614c40dfde3b93d27794e1ded7112d5f59b6fce2521703cb9391ee7a144ca3adcc25e0307addda873fd829ae51e770844
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUe
TLSH
T10D465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-238-0x00007FF7F1420000-0x00007FF7F1771000-memory.dmp

Download

memory/640-102-0x00007FF7F1420000-0x00007FF7F1771000-memory.dmp

Download

memory/1272-228-0x00007FF6AD3E0000-0x00007FF6AD731000-memory.dmp

Download

memory/1272-117-0x00007FF6AD3E0000-0x00007FF6AD731000-memory.dmp

Download

memory/1296-250-0x00007FF694360000-0x00007FF6946B1000-memory.dmp

Download

memory/1296-126-0x00007FF694360000-0x00007FF6946B1000-memory.dmp

Download

memory/1432-246-0x00007FF796F10000-0x00007FF797261000-memory.dmp

Download

memory/1432-116-0x00007FF796F10000-0x00007FF797261000-memory.dmp

Download

memory/1636-39-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp

Download

memory/1636-219-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp

Download

memory/1636-130-0x00007FF6D4920000-0x00007FF6D4C71000-memory.dmp

Download

memory/1652-122-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp

Download

memory/1652-254-0x00007FF6F8370000-0x00007FF6F86C1000-memory.dmp

Download

memory/1788-261-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-1-0x0000024E56EA0000-0x0000024E56EB0000-memory.dmp

Download

memory/1788-0-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-262-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-195-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-258-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-265-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-267-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-263-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-259-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-128-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-260-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-264-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-266-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-172-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/1788-173-0x00007FF72E060000-0x00007FF72E3B1000-memory.dmp

Download

memory/2116-251-0x00007FF7824C0000-0x00007FF782811000-memory.dmp

Download

memory/2116-123-0x00007FF7824C0000-0x00007FF782811000-memory.dmp

Download

memory/2852-114-0x00007FF638280000-0x00007FF6385D1000-memory.dmp

Download

memory/2852-234-0x00007FF638280000-0x00007FF6385D1000-memory.dmp

Download

memory/3508-115-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp

Download

memory/3508-247-0x00007FF6EE8C0000-0x00007FF6EEC11000-memory.dmp

Download

memory/3516-239-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp

Download

memory/3516-118-0x00007FF7F4210000-0x00007FF7F4561000-memory.dmp

Download

memory/3800-121-0x00007FF645040000-0x00007FF645391000-memory.dmp

Download

memory/3800-255-0x00007FF645040000-0x00007FF645391000-memory.dmp

Download

memory/3920-223-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp

Download

memory/3920-84-0x00007FF6C5E00000-0x00007FF6C6151000-memory.dmp

Download

memory/4132-13-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp

Download

memory/4132-217-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp

Download

memory/4132-129-0x00007FF7368C0000-0x00007FF736C11000-memory.dmp

Download

memory/4412-120-0x00007FF75B6D0000-0x00007FF75BA21000-memory.dmp

Download

memory/4412-226-0x00007FF75B6D0000-0x00007FF75BA21000-memory.dmp

Download

memory/4416-125-0x00007FF7AA080000-0x00007FF7AA3D1000-memory.dmp

Download

memory/4416-230-0x00007FF7AA080000-0x00007FF7AA3D1000-memory.dmp

Download

memory/4520-119-0x00007FF7660D0000-0x00007FF766421000-memory.dmp

Download

memory/4520-243-0x00007FF7660D0000-0x00007FF766421000-memory.dmp

Download

memory/4816-242-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp

Download

memory/4816-112-0x00007FF7E0BB0000-0x00007FF7E0F01000-memory.dmp

Download

memory/4824-113-0x00007FF6C0480000-0x00007FF6C07D1000-memory.dmp

Download

memory/4824-235-0x00007FF6C0480000-0x00007FF6C07D1000-memory.dmp

Download

memory/4848-131-0x00007FF698500000-0x00007FF698851000-memory.dmp

Download

memory/4848-221-0x00007FF698500000-0x00007FF698851000-memory.dmp

Download

memory/4848-79-0x00007FF698500000-0x00007FF698851000-memory.dmp

Download

memory/5012-257-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp

Download

memory/5012-124-0x00007FF72BC70000-0x00007FF72BFC1000-memory.dmp

Download

memory/5020-231-0x00007FF731620000-0x00007FF731971000-memory.dmp

Download

memory/5020-127-0x00007FF731620000-0x00007FF731971000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads