qakbot | 053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

Analysis

max time kernel
151s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dasfdsfsdf (1).exe
Size

1.0MB
MD5

a7c930732560445a040bf5534d87013e
SHA1

585d7cbb0dd5ae9a166f94949d2ac815b02fbc88
SHA256

053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061
SHA512

d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Score

10^/10

qakbot spx139 1591962820 banker cryptone evasion packer stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

spx139

Campaign

1591962820

98.16.204.189:995

88.158.199.95:443

24.102.235.160:995

96.18.240.158:443

67.165.206.193:995

81.103.144.77:443

184.180.157.203:2222

47.136.224.60:443

104.221.4.11:2222

203.33.138.230:443

72.204.242.138:20

75.137.239.211:443

74.215.201.122:443

41.228.201.162:443

92.29.5.162:995

108.30.125.94:443

207.255.161.8:2078

173.172.205.216:443

68.134.181.98:443

5.12.50.241:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 8 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe	cryptone

Executes dropped EXE 4 IoCs

Processes:

oaoieix.exeoaoieix.exeoaoieix.exeoaoieix.exe

pid process

1708 oaoieix.exe
1524 oaoieix.exe
2036 oaoieix.exe
2024 oaoieix.exe
Loads dropped DLL 3 IoCs

Processes:

dasfdsfsdf (1).exedasfdsfsdf (1).exe

pid process

1668 dasfdsfsdf (1).exe
1668 dasfdsfsdf (1).exe
1584 dasfdsfsdf (1).exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1440 schtasks.exe

pid	process
1708	oaoieix.exe
1524	oaoieix.exe
2036	oaoieix.exe
2024	oaoieix.exe

pid	process
1440	schtasks.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

dasfdsfsdf (1).exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dasfdsfsdf (1).exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	dasfdsfsdf (1).exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	dasfdsfsdf (1).exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1736 PING.EXE

pid	process
1736	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

dasfdsfsdf (1).exedasfdsfsdf (1).exeoaoieix.exeoaoieix.exeexplorer.exedasfdsfsdf (1).exeoaoieix.exeoaoieix.exe

pid	process
1668	dasfdsfsdf (1).exe
1748	dasfdsfsdf (1).exe
1748	dasfdsfsdf (1).exe
1708	oaoieix.exe
1524	oaoieix.exe
1524	oaoieix.exe
1684	explorer.exe
1684	explorer.exe
1584	dasfdsfsdf (1).exe
2036	oaoieix.exe
2024	oaoieix.exe
2024	oaoieix.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

oaoieix.exe

pid process

1708 oaoieix.exe

pid	process
1708	oaoieix.exe

Suspicious use of WriteProcessMemory 80 IoCs

Processes:

dasfdsfsdf (1).exeoaoieix.exetaskeng.exedasfdsfsdf (1).exe

description	pid	process	target process
PID 1668 wrote to memory of 1748	1668	dasfdsfsdf (1).exe	dasfdsfsdf (1).exe
PID 1668 wrote to memory of 1748	1668	dasfdsfsdf (1).exe	dasfdsfsdf (1).exe
PID 1668 wrote to memory of 1748	1668	dasfdsfsdf (1).exe	dasfdsfsdf (1).exe
PID 1668 wrote to memory of 1748	1668	dasfdsfsdf (1).exe	dasfdsfsdf (1).exe
PID 1668 wrote to memory of 1708	1668	dasfdsfsdf (1).exe	oaoieix.exe
PID 1668 wrote to memory of 1708	1668	dasfdsfsdf (1).exe	oaoieix.exe
PID 1668 wrote to memory of 1708	1668	dasfdsfsdf (1).exe	oaoieix.exe
PID 1668 wrote to memory of 1708	1668	dasfdsfsdf (1).exe	oaoieix.exe
PID 1668 wrote to memory of 1440	1668	dasfdsfsdf (1).exe	schtasks.exe
PID 1668 wrote to memory of 1440	1668	dasfdsfsdf (1).exe	schtasks.exe
PID 1668 wrote to memory of 1440	1668	dasfdsfsdf (1).exe	schtasks.exe
PID 1668 wrote to memory of 1440	1668	dasfdsfsdf (1).exe	schtasks.exe
PID 1708 wrote to memory of 1524	1708	oaoieix.exe	oaoieix.exe
PID 1708 wrote to memory of 1524	1708	oaoieix.exe	oaoieix.exe
PID 1708 wrote to memory of 1524	1708	oaoieix.exe	oaoieix.exe
PID 1708 wrote to memory of 1524	1708	oaoieix.exe	oaoieix.exe
PID 1708 wrote to memory of 1684	1708	oaoieix.exe	explorer.exe
PID 1708 wrote to memory of 1684	1708	oaoieix.exe	explorer.exe
PID 1708 wrote to memory of 1684	1708	oaoieix.exe	explorer.exe
PID 1708 wrote to memory of 1684	1708	oaoieix.exe	explorer.exe
PID 1708 wrote to memory of 1684	1708	oaoieix.exe	explorer.exe
PID 272 wrote to memory of 1584	272	taskeng.exe	dasfdsfsdf (1).exe
PID 272 wrote to memory of 1584	272	taskeng.exe	dasfdsfsdf (1).exe
PID 272 wrote to memory of 1584	272	taskeng.exe	dasfdsfsdf (1).exe
PID 272 wrote to memory of 1584	272	taskeng.exe	dasfdsfsdf (1).exe
PID 1584 wrote to memory of 1232	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1232	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1232	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1232	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1000	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1000	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1000	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1000	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 984	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 984	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 984	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 984	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 892	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 892	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 892	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 892	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1904	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1904	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1904	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1904	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1084	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1084	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1084	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1084	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 972	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 972	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 972	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 972	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 932	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 932	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 932	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 932	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1580	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1580	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1580	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 1580	1584	dasfdsfsdf (1).exe	reg.exe
PID 1584 wrote to memory of 2036	1584	dasfdsfsdf (1).exe	oaoieix.exe
PID 1584 wrote to memory of 2036	1584	dasfdsfsdf (1).exe	oaoieix.exe
PID 1584 wrote to memory of 2036	1584	dasfdsfsdf (1).exe	oaoieix.exe

C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /C
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe /C
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1524

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn gxkaticntx /tr "\"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe\" /I gxkaticntx" /SC ONCE /Z /ST 04:29 /ET 04:41
2⤵
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\taskeng.exe
taskeng.exe {C7E3AC36-9012-4C15-966F-740D7C4E789C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:272

C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe
"C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe" /I gxkaticntx
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:1232

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:1000

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:984

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:892

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:1904

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:1084

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
3⤵
PID:972

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
3⤵
PID:932

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Stneii" /d "0"
3⤵
PID:1580

C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2036

C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe /C
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\dasfdsfsdf (1).exe"
3⤵
PID:1796

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
4⤵
- Runs ping.exe
PID:1736

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN gxkaticntx
3⤵
PID:1472

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.dat
MD5
a50fb2d2fce3e805c18c2762ce20bfee

SHA1
f6e19394f806b82bc11ffbc488d73bc88583b219

SHA256
e4d58693aabd8edea3e99f441ef67bf9318dc867231aea357b67205ee2804f2d

SHA512
487bd7345299e0ded33af69b07db43c85bd73624bc8a0ba68709de338a9da5429f25ac418b73980dcae6310de99ebcc49008bb16a23dfc10f6db88b1e0fcc06b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Stneii\oaoieix.exe
MD5
a7c930732560445a040bf5534d87013e

SHA1
585d7cbb0dd5ae9a166f94949d2ac815b02fbc88

SHA256
053f8d5670c666f54c76fc8f3273ed916b1c323bc1a6c71a13f9f02a4746a061

SHA512
d1ac91f1cacb695d11c7e5d12bd50112a5b1790feec83ef21bb2cb1be7fe6ff0692c1d13779f99eb2e9a6713e34d47704bcd5829e2afb68f66fd00ad7aeead18

Download Submit
memory/892-18-0x0000000000000000-mapping.dmp

Download
memory/932-22-0x0000000000000000-mapping.dmp

Download
memory/972-21-0x0000000000000000-mapping.dmp

Download
memory/984-17-0x0000000000000000-mapping.dmp

Download
memory/1000-16-0x0000000000000000-mapping.dmp

Download
memory/1084-20-0x0000000000000000-mapping.dmp

Download
memory/1232-15-0x0000000000000000-mapping.dmp

Download
memory/1440-6-0x0000000000000000-mapping.dmp

Download
memory/1472-28-0x0000000000000000-mapping.dmp

Download
memory/1524-8-0x0000000000000000-mapping.dmp

Download
memory/1524-10-0x00000000023F0000-0x0000000002401000-memory.dmp

Filesize
68KB

Download
memory/1580-23-0x0000000000000000-mapping.dmp

Download
memory/1584-14-0x0000000000000000-mapping.dmp

Download
memory/1684-12-0x0000000000000000-mapping.dmp

Download
memory/1708-11-0x0000000000370000-0x00000000003AA000-memory.dmp

Filesize
232KB

Download
memory/1708-4-0x0000000000000000-mapping.dmp

Download
memory/1736-29-0x0000000000000000-mapping.dmp

Download
memory/1748-0-0x0000000000000000-mapping.dmp

Download
memory/1748-1-0x0000000002280000-0x0000000002291000-memory.dmp

Filesize
68KB

Download
memory/1796-27-0x0000000000000000-mapping.dmp

Download
memory/1904-19-0x0000000000000000-mapping.dmp

Download
memory/2024-30-0x0000000000000000-mapping.dmp

Download
memory/2024-32-0x0000000002380000-0x0000000002391000-memory.dmp

Filesize
68KB

Download
memory/2036-25-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads