a637d7360ef409b2d9f3038de841583a039287ee7f54d2f634d9cea6c0fd502f

Reason

Machine shutdown

General

Target

chthonic_2.23.15.14.vir.exe
Size

407KB
MD5

878804a067f5d32ba006f57a6635e87e
SHA1

1433f4c575719b8a9269597a997e15ff2420caf5
SHA256

a637d7360ef409b2d9f3038de841583a039287ee7f54d2f634d9cea6c0fd502f
SHA512

707930f022dd4a0595f98c76e8602d8b531c1c7de8c0c311eef082b97fffab67358e7f633541c3afe00e9080d8017eba8e46c89392b5af7eb9e5f838b5f75961

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exemsiexec.exe

pid process

1840 msiexec.exe
1988 msiexec.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.execmd.exe

pid process

1888 cmd.exe
1888 cmd.exe
2016 cmd.exe

pid	process
1840	msiexec.exe
1988	msiexec.exe

pid	process
1888	cmd.exe
1888	cmd.exe
2016	cmd.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\diagnosticshub.standardcollector.service\Start = "4"	msiexec.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

chthonic_2.23.15.14.vir.exechthonic_2.23.15.14.vir.exechthonic_2.23.15.14.vir.exemsiexec.execmd.exeWindowsSidebarb.exeWindowsSidebarb.exeWindowsSidebarb.exemsiexec.execmd.exe

description	pid	process	target process
PID 1516 wrote to memory of 1780	1516	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1516 wrote to memory of 1780	1516	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1516 wrote to memory of 1780	1516	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1516 wrote to memory of 1780	1516	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1780 wrote to memory of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1756 wrote to memory of 1840	1756	chthonic_2.23.15.14.vir.exe	msiexec.exe
PID 1840 wrote to memory of 1888	1840	msiexec.exe	cmd.exe
PID 1840 wrote to memory of 1888	1840	msiexec.exe	cmd.exe
PID 1840 wrote to memory of 1888	1840	msiexec.exe	cmd.exe
PID 1840 wrote to memory of 1888	1840	msiexec.exe	cmd.exe
PID 1888 wrote to memory of 1904	1888	cmd.exe	WindowsSidebarb.exe
PID 1888 wrote to memory of 1904	1888	cmd.exe	WindowsSidebarb.exe
PID 1888 wrote to memory of 1904	1888	cmd.exe	WindowsSidebarb.exe
PID 1888 wrote to memory of 1904	1888	cmd.exe	WindowsSidebarb.exe
PID 1904 wrote to memory of 1936	1904	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1904 wrote to memory of 1936	1904	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1904 wrote to memory of 1936	1904	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1904 wrote to memory of 1936	1904	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1936 wrote to memory of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1948 wrote to memory of 1988	1948	WindowsSidebarb.exe	msiexec.exe
PID 1988 wrote to memory of 2016	1988	msiexec.exe	cmd.exe
PID 1988 wrote to memory of 2016	1988	msiexec.exe	cmd.exe
PID 1988 wrote to memory of 2016	1988	msiexec.exe	cmd.exe
PID 1988 wrote to memory of 2016	1988	msiexec.exe	cmd.exe
PID 2016 wrote to memory of 1120	2016	cmd.exe	WindowsSidebarb.exe
PID 2016 wrote to memory of 1120	2016	cmd.exe	WindowsSidebarb.exe
PID 2016 wrote to memory of 1120	2016	cmd.exe	WindowsSidebarb.exe
PID 2016 wrote to memory of 1120	2016	cmd.exe	WindowsSidebarb.exe

Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

1840 msiexec.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeShutdownPrivilege 1840 msiexec.exe

pid	process
1840	msiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1840	msiexec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSidebarb = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsSidebarb\\WindowsSidebarb.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chthonic_2.23.15.14.vir.exeWindowsSidebarb.exe

description	pid	process	target process
PID 1780 set thread context of 1756	1780	chthonic_2.23.15.14.vir.exe	chthonic_2.23.15.14.vir.exe
PID 1936 set thread context of 1948	1936	WindowsSidebarb.exe	WindowsSidebarb.exe

Executes dropped EXE 4 IoCs

Processes:

WindowsSidebarb.exeWindowsSidebarb.exeWindowsSidebarb.exeWindowsSidebarb.exe

pid process

1904 WindowsSidebarb.exe
1936 WindowsSidebarb.exe
1948 WindowsSidebarb.exe
1120 WindowsSidebarb.exe

pid	process
1904	WindowsSidebarb.exe
1936	WindowsSidebarb.exe
1948	WindowsSidebarb.exe
1120	WindowsSidebarb.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1063

Processes:

msiexec.exemsiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

chthonic_2.23.15.14.vir.exemsiexec.exeWindowsSidebarb.exemsiexec.exe

pid process

1756 chthonic_2.23.15.14.vir.exe
1840 msiexec.exe
1948 WindowsSidebarb.exe
1988 msiexec.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

pid	process
1756	chthonic_2.23.15.14.vir.exe
1840	msiexec.exe
1948	WindowsSidebarb.exe
1988	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe" -l
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1780

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.15.14.vir.exe
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:1756

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
- Modifies service
- System policy modification
- Suspicious use of WriteProcessMemory
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks for any installed AV software in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe"
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
6⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1904

C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
"C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe" -l
7⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1936

C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
8⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:1948

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
- Checks for any installed AV software in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:1988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe"
10⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe
11⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1172

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Security Software Discovery

1

T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
\Users\Admin\AppData\Roaming\WindowsSidebarb\WindowsSidebarb.exe

Download Submit
memory/1120-20-0x0000000000000000-mapping.dmp

Download
memory/1172-33-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1172-31-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1172-22-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1756-3-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1756-2-0x0000000000405FC3-mapping.dmp

Download
memory/1756-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1780-0-0x0000000000000000-mapping.dmp

Download
memory/1840-4-0x0000000000000000-mapping.dmp

Download
memory/1888-5-0x0000000000000000-mapping.dmp

Download
memory/1904-9-0x0000000000000000-mapping.dmp

Download
memory/1936-11-0x0000000000000000-mapping.dmp

Download
memory/1948-14-0x0000000000405FC3-mapping.dmp

Download
memory/1988-17-0x0000000000000000-mapping.dmp

Download
memory/2016-18-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads