cobaltstrike | 5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
Size 5.2MB
Sample260910-3qs2jszsdz
SHA256 5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf
MD5 c98b90633bd8e1e8b5a81a6bbad06990
SHA1 bf3dce5d44a7c3cbb56ce93fb7561f7946e612a8
SHA512 4a75ad5d0e9540269dd9bd619e1d70846abd0df1c22aacd0c6a0b154b567b7b46bb28fd54bad8691d41e3e93af110bc154cd4eb93e38f3df3fb9d0f6045c2253
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUq
TLSH
T12E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00160000000115f1-4.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ab-10.dat	cobalt_reflective_dll
behavioral2/files/0x002400000001c2fc-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b3-23.dat	cobalt_reflective_dll
behavioral2/files/0x001000000001c4a6-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b4-36.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b6-46.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b7-51.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b8-56.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4bc-75.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4bd-81.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4c0-95.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4c3-110.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4c2-106.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4c1-101.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4bf-91.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4be-86.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4bb-71.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ba-66.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b9-61.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4b5-41.dat	cobalt_reflective_dll

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral2/memory/6048-115-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp	xmrig
behavioral2/memory/1672-116-0x00007FF7150D0000-0x00007FF715421000-memory.dmp	xmrig
behavioral2/memory/2952-119-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp	xmrig
behavioral2/memory/1540-121-0x00007FF744210000-0x00007FF744561000-memory.dmp	xmrig
behavioral2/memory/936-126-0x00007FF7664F0000-0x00007FF766841000-memory.dmp	xmrig
behavioral2/memory/2816-133-0x00007FF715E30000-0x00007FF716181000-memory.dmp	xmrig
behavioral2/memory/256-132-0x00007FF6C26A0000-0x00007FF6C29F1000-memory.dmp	xmrig
behavioral2/memory/108-131-0x00007FF68E710000-0x00007FF68EA61000-memory.dmp	xmrig
behavioral2/memory/4152-129-0x00007FF747350000-0x00007FF7476A1000-memory.dmp	xmrig
behavioral2/memory/3156-130-0x00007FF7AC1F0000-0x00007FF7AC541000-memory.dmp	xmrig
behavioral2/memory/4260-128-0x00007FF6411E0000-0x00007FF641531000-memory.dmp	xmrig
behavioral2/memory/944-127-0x00007FF666890000-0x00007FF666BE1000-memory.dmp	xmrig
behavioral2/memory/5236-125-0x00007FF6371F0000-0x00007FF637541000-memory.dmp	xmrig
behavioral2/memory/4352-123-0x00007FF7C39A0000-0x00007FF7C3CF1000-memory.dmp	xmrig
behavioral2/memory/3004-120-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp	xmrig
behavioral2/memory/3920-124-0x00007FF7962F0000-0x00007FF796641000-memory.dmp	xmrig
behavioral2/memory/1560-118-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp	xmrig
behavioral2/memory/1652-122-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp	xmrig
behavioral2/memory/5908-117-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp	xmrig
behavioral2/memory/4620-114-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp	xmrig
behavioral2/memory/4080-113-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp	xmrig
behavioral2/memory/4660-112-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-134-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-156-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-157-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-179-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4080-182-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp	xmrig
behavioral2/memory/4620-190-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp	xmrig
behavioral2/memory/6048-191-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp	xmrig
behavioral2/memory/1672-192-0x00007FF7150D0000-0x00007FF715421000-memory.dmp	xmrig
behavioral2/memory/5908-194-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp	xmrig
behavioral2/memory/1560-196-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp	xmrig
behavioral2/memory/3004-203-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp	xmrig
behavioral2/memory/2952-211-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp	xmrig
behavioral2/memory/1652-218-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp	xmrig
behavioral2/memory/3920-222-0x00007FF7962F0000-0x00007FF796641000-memory.dmp	xmrig
behavioral2/memory/5236-224-0x00007FF6371F0000-0x00007FF637541000-memory.dmp	xmrig
behavioral2/memory/936-226-0x00007FF7664F0000-0x00007FF766841000-memory.dmp	xmrig
behavioral2/memory/944-228-0x00007FF666890000-0x00007FF666BE1000-memory.dmp	xmrig
behavioral2/memory/4352-220-0x00007FF7C39A0000-0x00007FF7C3CF1000-memory.dmp	xmrig
behavioral2/memory/1540-216-0x00007FF744210000-0x00007FF744561000-memory.dmp	xmrig
behavioral2/memory/3156-234-0x00007FF7AC1F0000-0x00007FF7AC541000-memory.dmp	xmrig
behavioral2/memory/108-240-0x00007FF68E710000-0x00007FF68EA61000-memory.dmp	xmrig
behavioral2/memory/256-238-0x00007FF6C26A0000-0x00007FF6C29F1000-memory.dmp	xmrig
behavioral2/memory/4260-236-0x00007FF6411E0000-0x00007FF641531000-memory.dmp	xmrig
behavioral2/memory/2816-232-0x00007FF715E30000-0x00007FF716181000-memory.dmp	xmrig
behavioral2/memory/4152-230-0x00007FF747350000-0x00007FF7476A1000-memory.dmp	xmrig
behavioral2/memory/4660-241-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-242-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-243-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-244-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-245-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-246-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-247-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-248-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-249-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig
behavioral2/memory/4660-250-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4080	AmBzVYD.exe
4620	pZromJB.exe
6048	fGqcYMs.exe
1672	bgeLuJp.exe
5908	BqkXjof.exe
1560	KmbBPPE.exe
2952	jBZecgt.exe
3004	fjzQujO.exe
1540	HZSvJdY.exe
1652	QYUTHAc.exe
4352	BqCXmlJ.exe
3920	jJJrgKq.exe
5236	uEWykgU.exe
936	JIZrUgK.exe
944	rYIFaYh.exe
4260	SVHlAQK.exe
4152	NdPOAzB.exe
3156	UQTAJyK.exe
108	ySCzsXd.exe
256	AqnAxMa.exe
2816	GjxttJb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-0-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4080-6-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp	upx
behavioral2/files/0x00160000000115f1-4.dat	upx
behavioral2/files/0x000d00000001c4ab-10.dat	upx
behavioral2/files/0x002400000001c2fc-11.dat	upx
behavioral2/memory/4620-13-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp	upx
behavioral2/memory/6048-17-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp	upx
behavioral2/files/0x000d00000001c4b3-23.dat	upx
behavioral2/files/0x001000000001c4a6-28.dat	upx
behavioral2/memory/5908-31-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp	upx
behavioral2/files/0x000d00000001c4b4-36.dat	upx
behavioral2/files/0x000d00000001c4b6-46.dat	upx
behavioral2/files/0x000d00000001c4b7-51.dat	upx
behavioral2/files/0x000d00000001c4b8-56.dat	upx
behavioral2/files/0x000d00000001c4bc-75.dat	upx
behavioral2/files/0x000d00000001c4bd-81.dat	upx
behavioral2/files/0x000d00000001c4c0-95.dat	upx
behavioral2/files/0x000d00000001c4c3-110.dat	upx
behavioral2/files/0x000d00000001c4c2-106.dat	upx
behavioral2/files/0x000d00000001c4c1-101.dat	upx
behavioral2/files/0x000d00000001c4bf-91.dat	upx
behavioral2/files/0x000d00000001c4be-86.dat	upx
behavioral2/files/0x000d00000001c4bb-71.dat	upx
behavioral2/files/0x000d00000001c4ba-66.dat	upx
behavioral2/files/0x000d00000001c4b9-61.dat	upx
behavioral2/files/0x000d00000001c4b5-41.dat	upx
behavioral2/memory/1672-24-0x00007FF7150D0000-0x00007FF715421000-memory.dmp	upx
behavioral2/memory/6048-115-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp	upx
behavioral2/memory/1672-116-0x00007FF7150D0000-0x00007FF715421000-memory.dmp	upx
behavioral2/memory/2952-119-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp	upx
behavioral2/memory/1540-121-0x00007FF744210000-0x00007FF744561000-memory.dmp	upx
behavioral2/memory/936-126-0x00007FF7664F0000-0x00007FF766841000-memory.dmp	upx
behavioral2/memory/2816-133-0x00007FF715E30000-0x00007FF716181000-memory.dmp	upx
behavioral2/memory/256-132-0x00007FF6C26A0000-0x00007FF6C29F1000-memory.dmp	upx
behavioral2/memory/108-131-0x00007FF68E710000-0x00007FF68EA61000-memory.dmp	upx
behavioral2/memory/4152-129-0x00007FF747350000-0x00007FF7476A1000-memory.dmp	upx
behavioral2/memory/3156-130-0x00007FF7AC1F0000-0x00007FF7AC541000-memory.dmp	upx
behavioral2/memory/4260-128-0x00007FF6411E0000-0x00007FF641531000-memory.dmp	upx
behavioral2/memory/944-127-0x00007FF666890000-0x00007FF666BE1000-memory.dmp	upx
behavioral2/memory/5236-125-0x00007FF6371F0000-0x00007FF637541000-memory.dmp	upx
behavioral2/memory/4352-123-0x00007FF7C39A0000-0x00007FF7C3CF1000-memory.dmp	upx
behavioral2/memory/3004-120-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp	upx
behavioral2/memory/3920-124-0x00007FF7962F0000-0x00007FF796641000-memory.dmp	upx
behavioral2/memory/1560-118-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp	upx
behavioral2/memory/1652-122-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp	upx
behavioral2/memory/5908-117-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp	upx
behavioral2/memory/4620-114-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp	upx
behavioral2/memory/4080-113-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp	upx
behavioral2/memory/4660-112-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4660-134-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4660-156-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4660-157-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4660-179-0x00007FF613280000-0x00007FF6135D1000-memory.dmp	upx
behavioral2/memory/4080-182-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp	upx
behavioral2/memory/4620-190-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp	upx
behavioral2/memory/6048-191-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp	upx
behavioral2/memory/1672-192-0x00007FF7150D0000-0x00007FF715421000-memory.dmp	upx
behavioral2/memory/5908-194-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp	upx
behavioral2/memory/1560-196-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp	upx
behavioral2/memory/3004-203-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp	upx
behavioral2/memory/2952-211-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp	upx
behavioral2/memory/1652-218-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp	upx
behavioral2/memory/3920-222-0x00007FF7962F0000-0x00007FF796641000-memory.dmp	upx
behavioral2/memory/5236-224-0x00007FF6371F0000-0x00007FF637541000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\jJJrgKq.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\uEWykgU.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\JIZrUgK.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\SVHlAQK.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\ySCzsXd.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\AmBzVYD.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\bgeLuJp.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\KmbBPPE.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\fjzQujO.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\rYIFaYh.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\AqnAxMa.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\GjxttJb.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\BqkXjof.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\BqCXmlJ.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\NdPOAzB.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\UQTAJyK.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\pZromJB.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\fGqcYMs.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\jBZecgt.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\HZSvJdY.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
File created	C:\Windows\System\QYUTHAc.exe	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
Token: SeLockMemoryPrivilege	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4080	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	90
PID 4660 wrote to memory of 4620	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	91
PID 4660 wrote to memory of 6048	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	92
PID 4660 wrote to memory of 1672	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	93
PID 4660 wrote to memory of 5908	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	94
PID 4660 wrote to memory of 1560	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	95
PID 4660 wrote to memory of 2952	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	96
PID 4660 wrote to memory of 3004	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	97
PID 4660 wrote to memory of 1540	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	98
PID 4660 wrote to memory of 1652	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	99
PID 4660 wrote to memory of 4352	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	100
PID 4660 wrote to memory of 3920	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	101
PID 4660 wrote to memory of 5236	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	102
PID 4660 wrote to memory of 936	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	103
PID 4660 wrote to memory of 944	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	104
PID 4660 wrote to memory of 4260	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	105
PID 4660 wrote to memory of 4152	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	106
PID 4660 wrote to memory of 3156	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	107
PID 4660 wrote to memory of 108	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	108
PID 4660 wrote to memory of 256	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	109
PID 4660 wrote to memory of 2816	4660	5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe	110

C:\Users\Admin\AppData\Local\Temp\5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe
"C:\Users\Admin\AppData\Local\Temp\5746742bb93501a8d51e388d013124bb61c4d1cdf07d24a3fd4836af4a24e2cf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System\AmBzVYD.exe
  C:\Windows\System\AmBzVYD.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\pZromJB.exe
  C:\Windows\System\pZromJB.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\fGqcYMs.exe
  C:\Windows\System\fGqcYMs.exe
  2⤵
  - Executes dropped EXE
  PID:6048
- C:\Windows\System\bgeLuJp.exe
  C:\Windows\System\bgeLuJp.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\BqkXjof.exe
  C:\Windows\System\BqkXjof.exe
  2⤵
  - Executes dropped EXE
  PID:5908
- C:\Windows\System\KmbBPPE.exe
  C:\Windows\System\KmbBPPE.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\jBZecgt.exe
  C:\Windows\System\jBZecgt.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\fjzQujO.exe
  C:\Windows\System\fjzQujO.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\HZSvJdY.exe
  C:\Windows\System\HZSvJdY.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\QYUTHAc.exe
  C:\Windows\System\QYUTHAc.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\BqCXmlJ.exe
  C:\Windows\System\BqCXmlJ.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\jJJrgKq.exe
  C:\Windows\System\jJJrgKq.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\uEWykgU.exe
  C:\Windows\System\uEWykgU.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\JIZrUgK.exe
  C:\Windows\System\JIZrUgK.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\rYIFaYh.exe
  C:\Windows\System\rYIFaYh.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\SVHlAQK.exe
  C:\Windows\System\SVHlAQK.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\NdPOAzB.exe
  C:\Windows\System\NdPOAzB.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\UQTAJyK.exe
  C:\Windows\System\UQTAJyK.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ySCzsXd.exe
  C:\Windows\System\ySCzsXd.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\AqnAxMa.exe
  C:\Windows\System\AqnAxMa.exe
  2⤵
  - Executes dropped EXE
  PID:256
- C:\Windows\System\GjxttJb.exe
  C:\Windows\System\GjxttJb.exe
  2⤵
  - Executes dropped EXE
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AmBzVYD.exe

Path C:\Windows\System\AmBzVYD.exe
Size 5.2MB
SHA256 7d340e140f2c694e892c8add7e8458df909d02eb8178ae075589870af844c267
MD5 df3acf7c4baeb40b4f4c15ce069d5957
SHA1 0eb39083dcf5c6a7dcb410ef287465381a8ce2a7
SHA512 947ffd0adfdfb49e3b95171b040042b570c75bc92da9b42d09549591b9cd3889ba458691f109e2199d12e6790fc847b458d230f82ab44f851ae774d2b20b510f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUM
TLSH
T108465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AqnAxMa.exe

Path C:\Windows\System\AqnAxMa.exe
Size 5.2MB
SHA256 985efdc001a3e3a1c3f13d7fa7d323a72dae9fd6d292e5d9dd0df31f4369de92
MD5 b8b3d788d9bd82305acc9b401ab36ca9
SHA1 635a0030ce7bc1a3e3b7a6467ad523e6ebde43f3
SHA512 e57e2d9fbf6619faf7ad59bfe9be3c1a298bf458c836a49e6b7f60385f0192ad8f89cc0e510a6458a2818769ca41eeea93b71f07a7c537c8b150f0a1f71f35dc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lU7
TLSH
T1E9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BqCXmlJ.exe

Path C:\Windows\System\BqCXmlJ.exe
Size 5.2MB
SHA256 e2f55a921a1b055b1cfea865309d611cdf6d17a00790e163869f25d9b856df2d
MD5 399911266257f7773d51e7f251012003
SHA1 cf0422a8df42c542daba75e91f159b35e650ebc8
SHA512 533f80f01c474bec4518d977e7340fc090ed13be558c81ebb3cb465b9cf20674160d5c77b112eea7c948e44cf915a2b54dbae3e7c02a757c5f53322d76d04d39
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUY
TLSH
T163465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BqkXjof.exe

Path C:\Windows\System\BqkXjof.exe
Size 5.2MB
SHA256 b38bc0f2212b40b211f6479afc9b4f09d84800f06090641f0084f8645a7700e1
MD5 719eed58ba24bccdd52d2a2388d035f4
SHA1 a02007de71f495a68be8a560fbbd9a4642830b9e
SHA512 57bed65c157639438b1a5c5bf6e776f3a9d6380601e7254848d5f1d9fd58e8f26f4e319e96c441aef0d1b8c6a90b80c0c6eb4d711e562f3d1c6b204db17eeca4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUT
TLSH
T1BC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GjxttJb.exe

Path C:\Windows\System\GjxttJb.exe
Size 5.2MB
SHA256 015ef7d8d778f43b40dd0e61d2db162c47f5b0d26651d4e97cd64bbb1ebf0365
MD5 0ca9e0faa7265d08f1d74481802580fd
SHA1 841d025b30db09482c23e7635321f1cdd83da11c
SHA512 4e3319863ed5f9d04bbd77af683f5eda8710e427da774425dd60d9d92e6a52d983559bc030ec83fa34c61ea06f3a3b7e19dbc37b094f73d584886e3c1b3dff8b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUZ
TLSH
T1CB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HZSvJdY.exe

Path C:\Windows\System\HZSvJdY.exe
Size 5.2MB
SHA256 cb38fa6564a84aaa5ede277e8a2ecabc60a03bb3a5ee1862813c990b0c366102
MD5 cce95f60212aad3acb8f121b9c77168a
SHA1 fbe8e0c5b75a2f097de703e37aa63befe6b774b1
SHA512 a599f19f78eff9567a422db65a940bdaec3b3fde0ef891c34d0bf1f9fb3ca02895a72de7f8c26b4c43e21811fe746e4d5f6449533332e1a7383c6bb122357e09
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUO
TLSH
T18D465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JIZrUgK.exe

Path C:\Windows\System\JIZrUgK.exe
Size 5.2MB
SHA256 0a52cc3b0c2f070cdaedd131f58b390d4bb609844b600dc292ec036f242e282b
MD5 2049297a66d25955953e521eda275765
SHA1 1733d4d2d6294bf9682e6afc3f70713b35857f1e
SHA512 0834f3c829923b05f4fe412b20600f69059262604bcc8989538ebe458da9e8435d2b5bfc74049c36021ff554d19ca02091b94889ecfc9d9f92e64107c6a2743d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lU8
TLSH
T13B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KmbBPPE.exe

Path C:\Windows\System\KmbBPPE.exe
Size 5.2MB
SHA256 977406d68f0e432668f82de5306a741b7963a8678ec29a75ea366919c944a5dd
MD5 0ab93bb39ff31c2411dac74675c195d8
SHA1 fa542ec0a50dcb102ffcad569a13a208aa4ac926
SHA512 e66b69163559a626b25e21aee720d664e5468f31218a0477f9176c00c7e801a08c24358d81333aa6f3d1ab974a7ce2e423ffba5363fe81e90c1570c9b5aabbe3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUW
TLSH
T18C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NdPOAzB.exe

Path C:\Windows\System\NdPOAzB.exe
Size 5.2MB
SHA256 65354d4b82e7c79cbb5947288a0134bdd579794b0d8b3ce5d0a649f40ce15dce
MD5 cc824fa1243d84733735667913cc2d19
SHA1 13a52b24854c1506244d749ae6e2785674ed62ff
SHA512 6363aae611f5c2cdac4a3c58290177a21a52153e54cefd636b30a47f32d4ffd6d2c9a4a0fe20579b559832ea69fa322cd6f3144ac12a1bd49f1d77103f0e7b0d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
TLSH
T14A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QYUTHAc.exe

Path C:\Windows\System\QYUTHAc.exe
Size 5.2MB
SHA256 cd272eb6324231553dfa9bdbb311369c0d53da5a28efaa13851385f5350b165a
MD5 ab26f7f9033f885478436a43429fbe5d
SHA1 b1a395df74dcc8f24ff71e41205468cac2d4c95d
SHA512 fe0c008a70510521734df1422d8e04dd953f00c8bb3491355125a43b8bc80f908550f1d9fa6ce109429f44652c7489e1adaeaf0dc7ca4ce644b4e18a03fe8c00
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUq
TLSH
T1F9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVHlAQK.exe

Path C:\Windows\System\SVHlAQK.exe
Size 5.2MB
SHA256 d2aab78682fc7b185a45089fa16d11f187d64c34319553def4205ab955d9c438
MD5 ce519040e5808f584ffbd369b8e1c0bf
SHA1 355744b17fb941b67437856d7a9486cfa744593c
SHA512 a656dbd0c72ed819e3d159911ca3dd8c34042ccabd6b4cafe0c56ed9ca1980573bfb3f1c8779eabcdedd9d29a1804f4f5e330c30baf15659c86e974026bfce6d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUf
TLSH
T129465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UQTAJyK.exe

Path C:\Windows\System\UQTAJyK.exe
Size 5.2MB
SHA256 bd47b27c601b00782d8e8297502a4f97c4530ed13a0c924e5de09f7084a50530
MD5 395c2dfd7536450761330b6a7fb1408d
SHA1 dd7beddd5a496208411fa77a86ba68fe9414533b
SHA512 e0acdb3d84d21433d3d4c1d79da34f81c246bba2fbecbf34b754f85808c8d15316b82aee97c06c2b83b6db998fca2560b1fe7b3f276776a55d5be1f52cb42685
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUm
TLSH
T1A9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgeLuJp.exe

Path C:\Windows\System\bgeLuJp.exe
Size 5.2MB
SHA256 12874b5e758b90177f4050f6ea9162a3873689d8396b94ffb6c3e9d0f4467678
MD5 b344e8da7f8c0408bb96247ed1d4f0c2
SHA1 ec6043b2d027ce0ff6c1f3d39bc470292ab46d90
SHA512 1ddf429019a855ba2293ae58e867090a7ec07635fe229851e99568723d1c44346f48a35b703aeaadce80f98056d1323a4c676903e40b58295e9b92c63bc17e32
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lUm
TLSH
T1AF465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fGqcYMs.exe

Path C:\Windows\System\fGqcYMs.exe
Size 5.2MB
SHA256 b5f35a713d8f2c6aecf3931a13ac02d88d77e577906d478ea76ea5e4c76c3ea8
MD5 51cb7ff2251caace3ff6e1492d37dbdd
SHA1 9abf1f6f78fa4f2c8fcd09ae5d9466e765c9b45b
SHA512 da9ef1ae6cb3ce294a2e304950b6287953dc1169099f599bf5d11f5e709d440f97108f9c8bff7174e4eababcdbb37ad75ce54dc7f8a333f9aa200680f51fe46a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lU8
TLSH
T18C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fjzQujO.exe

Path C:\Windows\System\fjzQujO.exe
Size 5.2MB
SHA256 120a68013af4ff72f25aa23646ece26eeb32a1ed4780a4793b2090a48beedaa8
MD5 0c5acca9ec6e2e827a6199bd3eb686e1
SHA1 dfe8aad483308e7caf79da5016cdd7760f3e908a
SHA512 96d4e4c13d90d2a9447c5d5a2f8f26d06a9c0dc1885973cca6e419f161054d25d8a596e82604e1ce8302383a57d988be694822583e3ee30ee26bde6d15bb4520
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUI
TLSH
T11B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jBZecgt.exe

Path C:\Windows\System\jBZecgt.exe
Size 5.2MB
SHA256 3d434e32f886c88dcab9097f8a4e5ab66584b5160ee19b32c24196d6b7cd876c
MD5 a5aabcfc3a89759c365106568e216400
SHA1 242aeaf89be2e8432e0f979f78f09920eceeb94f
SHA512 3e925b7683a149018ebba13b114d1d5ff7859f70f853f5531fbf81601d1129ecc90a548d45cf5a4c07f1d59b71f89ad36ac2e44d650659fab4e356299cd9d002
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUL
TLSH
T168465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jJJrgKq.exe

Path C:\Windows\System\jJJrgKq.exe
Size 5.2MB
SHA256 f9a1e8a3b00df174c08fa24d7faeb4b93f6d403f303caad06af1b26dbdc6c983
MD5 2a1d7dc1bfb701125c510773e9619b1f
SHA1 db5f4d2b9bbc24e10b58426e4e78e10db9cd84d7
SHA512 efb4546c476e78190b7f641fc5e1f2f6f2cdd8e7490fe24e2f56fa0f51d0184cf337ef63aa9e684f670a07948842fe87f05a7f4e143542a65017b0adb97500fc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU1
TLSH
T1DD465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pZromJB.exe

Path C:\Windows\System\pZromJB.exe
Size 5.2MB
SHA256 e30afc989880934526e8fc87514f654efdde4917bbe8163a3bf3494166fd08c7
MD5 4e7f8a1497ccd8ef1608a29452426371
SHA1 a73851b1f9350ccb171b892dfd1197381bac212f
SHA512 aa8b03479b7e6d411f0f9ee1c08e4980216cc441ff391b792daf62655ef54d99b4292e2562517dbb858fd3805b717e7d51aba91c0ced42f484f3a7360910b36b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lU8
TLSH
T1E1465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rYIFaYh.exe

Path C:\Windows\System\rYIFaYh.exe
Size 5.2MB
SHA256 dff10c12bdeec184f4e09e3749507c8c12dbb2d2569771317c21c9ff30c471b1
MD5 6988b78e0b8bdac19b72472e9dd3eb69
SHA1 f45f4c0f30beb0c51042bc27d2a02ce098a2d751
SHA512 06b8b86782e83eb2a9da256a17210e31c851ad1a6846e4c5f5830b01c93796d06cfee174399d3bf4e2328d57d66e44f8a1379c67e2188a63f58f1f0869533c94
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUL
TLSH
T13E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uEWykgU.exe

Path C:\Windows\System\uEWykgU.exe
Size 5.2MB
SHA256 8d2fed6c52e6004a648dd11d21462b588bcf15c7a676f12d487deb7a11c31ea9
MD5 8797dc37b99f31fde5c7a9f54eef5276
SHA1 4f6b624c148d1188af84d935b3f2043446204af7
SHA512 6b0f6a7dc161fa1829463cf6d3c3d01a057d2f53c75b0c78a66da9a5730a9e756196b53bc159f90152adc7745b0e9d5abb0bf9a4e0c794df530f0ac39c2d9630
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUB
TLSH
T18B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ySCzsXd.exe

Path C:\Windows\System\ySCzsXd.exe
Size 5.2MB
SHA256 78d2c0918ef931e64c6a52490bd10d7dc3690a2d89c63bc2bbfbbb844a95e554
MD5 988161800203bd9234ba6404fd546b39
SHA1 1bcdb934e8a7404a33e6ef88a7b86d892a68fc93
SHA512 95049168a50e848785be9c73c9ccfbb45a28fa57328d5d53b870e7106943a36e1c658980231e449a6f608eabce00d9b02548f70204278f10a9d4b90be19537ec
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUa
TLSH
T1AA465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-131-0x00007FF68E710000-0x00007FF68EA61000-memory.dmp

Download

memory/108-240-0x00007FF68E710000-0x00007FF68EA61000-memory.dmp

Download

memory/256-238-0x00007FF6C26A0000-0x00007FF6C29F1000-memory.dmp

Download

memory/256-132-0x00007FF6C26A0000-0x00007FF6C29F1000-memory.dmp

Download

memory/936-126-0x00007FF7664F0000-0x00007FF766841000-memory.dmp

Download

memory/936-226-0x00007FF7664F0000-0x00007FF766841000-memory.dmp

Download

memory/944-228-0x00007FF666890000-0x00007FF666BE1000-memory.dmp

Download

memory/944-127-0x00007FF666890000-0x00007FF666BE1000-memory.dmp

Download

memory/1540-121-0x00007FF744210000-0x00007FF744561000-memory.dmp

Download

memory/1540-216-0x00007FF744210000-0x00007FF744561000-memory.dmp

Download

memory/1560-118-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp

Download

memory/1560-196-0x00007FF78BAD0000-0x00007FF78BE21000-memory.dmp

Download

memory/1652-218-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp

Download

memory/1652-122-0x00007FF75FAA0000-0x00007FF75FDF1000-memory.dmp

Download

memory/1672-116-0x00007FF7150D0000-0x00007FF715421000-memory.dmp

Download

memory/1672-24-0x00007FF7150D0000-0x00007FF715421000-memory.dmp

Download

memory/1672-192-0x00007FF7150D0000-0x00007FF715421000-memory.dmp

Download

memory/2816-232-0x00007FF715E30000-0x00007FF716181000-memory.dmp

Download

memory/2816-133-0x00007FF715E30000-0x00007FF716181000-memory.dmp

Download

memory/2952-211-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp

Download

memory/2952-119-0x00007FF7C8480000-0x00007FF7C87D1000-memory.dmp

Download

memory/3004-203-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp

Download

memory/3004-120-0x00007FF60B080000-0x00007FF60B3D1000-memory.dmp

Download

memory/3156-130-0x00007FF7AC1F0000-0x00007FF7AC541000-memory.dmp

Download

memory/3156-234-0x00007FF7AC1F0000-0x00007FF7AC541000-memory.dmp

Download

memory/3920-124-0x00007FF7962F0000-0x00007FF796641000-memory.dmp

Download

memory/3920-222-0x00007FF7962F0000-0x00007FF796641000-memory.dmp

Download

memory/4080-182-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp

Download

memory/4080-113-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp

Download

memory/4080-6-0x00007FF750C70000-0x00007FF750FC1000-memory.dmp

Download

memory/4152-230-0x00007FF747350000-0x00007FF7476A1000-memory.dmp

Download

memory/4152-129-0x00007FF747350000-0x00007FF7476A1000-memory.dmp

Download

memory/4260-236-0x00007FF6411E0000-0x00007FF641531000-memory.dmp

Download

memory/4260-128-0x00007FF6411E0000-0x00007FF641531000-memory.dmp

Download

memory/4352-123-0x00007FF7C39A0000-0x00007FF7C3CF1000-memory.dmp

Download

memory/4352-220-0x00007FF7C39A0000-0x00007FF7C3CF1000-memory.dmp

Download

memory/4620-114-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp

Download

memory/4620-190-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp

Download

memory/4620-13-0x00007FF78C480000-0x00007FF78C7D1000-memory.dmp

Download

memory/4660-242-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-245-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-0-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-134-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-250-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-249-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-248-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-247-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-246-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-244-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-243-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-112-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-156-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-1-0x000001ED9FB80000-0x000001ED9FB90000-memory.dmp

Download

memory/4660-179-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-241-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/4660-157-0x00007FF613280000-0x00007FF6135D1000-memory.dmp

Download

memory/5236-125-0x00007FF6371F0000-0x00007FF637541000-memory.dmp

Download

memory/5236-224-0x00007FF6371F0000-0x00007FF637541000-memory.dmp

Download

memory/5908-31-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp

Download

memory/5908-117-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp

Download

memory/5908-194-0x00007FF6BE660000-0x00007FF6BE9B1000-memory.dmp

Download

memory/6048-191-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp

Download

memory/6048-17-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp

Download

memory/6048-115-0x00007FF723F50000-0x00007FF7242A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads