darkcomet | 8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50

General

Target

8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
Size

1.5MB
MD5

f7f98f7827a8eee2a8eba4542f6c4ff8
SHA1

f504d82d6826cf7d8defa916f71be01a46c6db09
SHA256

8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50
SHA512

b6fe1a75af8bb1818ec7af6d7f98288e09466d7b7deabdd015b312c0b94942badcbd554a52042e1d2b737525b501673f5b776d0b68fb8c245730a65c3f7b5ef1

Score

10^/10

darkcomet runescape persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Runescape

C2

mrsnickers03.no-ip.biz:340

Mutex

DC_MUTEX-6ZFK11A

Attributes

gencode
uNwew4gojxtu
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 3 IoCs

Processes:

ichader.exeichader.exeichader.exe

pid process

2116 ichader.exe
2084 ichader.exe
636 ichader.exe

pid	process
2116	ichader.exe
2084	ichader.exe
636	ichader.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2796-4-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2796-6-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2796-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/636-29-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/636-38-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/636-39-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Users\\Admin\\AppData\\Roaming\\IDM\\ichader.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exeichader.exe

description	pid	process	target process
PID 944 set thread context of 3148	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	svchost.exe
PID 944 set thread context of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 2116 set thread context of 2140	2116	ichader.exe	svchost.exe
PID 2116 set thread context of 2084	2116	ichader.exe	ichader.exe
PID 2116 set thread context of 636	2116	ichader.exe	ichader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 3148 WerFault.exe svchost.exe

pid	pid_target	process	target process
852	3148	WerFault.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe
2140	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ichader.exeichader.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	636	ichader.exe
Token: SeSecurityPrivilege	636	ichader.exe
Token: SeTakeOwnershipPrivilege	636	ichader.exe
Token: SeLoadDriverPrivilege	636	ichader.exe
Token: SeSystemProfilePrivilege	636	ichader.exe
Token: SeSystemtimePrivilege	636	ichader.exe
Token: SeProfSingleProcessPrivilege	636	ichader.exe
Token: SeIncBasePriorityPrivilege	636	ichader.exe
Token: SeCreatePagefilePrivilege	636	ichader.exe
Token: SeBackupPrivilege	636	ichader.exe
Token: SeRestorePrivilege	636	ichader.exe
Token: SeShutdownPrivilege	636	ichader.exe
Token: SeDebugPrivilege	636	ichader.exe
Token: SeSystemEnvironmentPrivilege	636	ichader.exe
Token: SeChangeNotifyPrivilege	636	ichader.exe
Token: SeRemoteShutdownPrivilege	636	ichader.exe
Token: SeUndockPrivilege	636	ichader.exe
Token: SeManageVolumePrivilege	636	ichader.exe
Token: SeImpersonatePrivilege	636	ichader.exe
Token: SeCreateGlobalPrivilege	636	ichader.exe
Token: 33	636	ichader.exe
Token: 34	636	ichader.exe
Token: 35	636	ichader.exe
Token: 36	636	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe
Token: SeDebugPrivilege	2084	ichader.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exeichader.exesvchost.exeichader.exeichader.exe

pid	process
944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
2116	ichader.exe
2140	svchost.exe
2084	ichader.exe
636	ichader.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.execmd.exeichader.exe

description	pid	process	target process
PID 944 wrote to memory of 3148	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	svchost.exe
PID 944 wrote to memory of 3148	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	svchost.exe
PID 944 wrote to memory of 3148	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	svchost.exe
PID 944 wrote to memory of 3148	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	svchost.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 944 wrote to memory of 2796	944	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
PID 2796 wrote to memory of 668	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	cmd.exe
PID 2796 wrote to memory of 668	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	cmd.exe
PID 2796 wrote to memory of 668	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	cmd.exe
PID 668 wrote to memory of 3796	668	cmd.exe	reg.exe
PID 668 wrote to memory of 3796	668	cmd.exe	reg.exe
PID 668 wrote to memory of 3796	668	cmd.exe	reg.exe
PID 2796 wrote to memory of 2116	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	ichader.exe
PID 2796 wrote to memory of 2116	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	ichader.exe
PID 2796 wrote to memory of 2116	2796	8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe	ichader.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2140	2116	ichader.exe	svchost.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 2084	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe
PID 2116 wrote to memory of 636	2116	ichader.exe	ichader.exe

C:\Users\Admin\AppData\Local\Temp\8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
"C:\Users\Admin\AppData\Local\Temp\8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 100
3⤵
- Program crash
PID:852

C:\Users\Admin\AppData\Local\Temp\8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe
"C:\Users\Admin\AppData\Local\Temp\8a7df8323dc4eee4c43a0e0fa761af9ed98274b0923066aa82dbfa977c1e4f50.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QOMRE.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "java" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDM\ichader.exe" /f
4⤵
- Adds Run key to start application
PID:3796

C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
"C:\Users\Admin\AppData\Roaming\IDM\ichader.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\QOMRE.bat
MD5
92353035f01403e26aa2ff51c3963238

SHA1
d13f167c73bfce23a2deab8ce7c4ce9f78759ff4

SHA256
2e72a8542f8f809bfb1e4adfb481c7c5e6dc00dda7970c74692ba8d83ea0a870

SHA512
74560e33477caae3c7bc13914e4ae3c6911bbcfe257b2833155c236a158db0aca17478beb9d97f648ff1ea566005260f511361771c74203195107f4e82cce7df

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
MD5
188354ea53b4a68a5842676461f7d30c

SHA1
9543729c1516f6c4572e59f6d190705dee8c964c

SHA256
71e003fade1c08b8957e5d003c47734d0242e49cd7f7f157de49d7b88e9b0c01

SHA512
2e2a48e55d561b9c5a44d646ff1422660dc1158cd227be2ceaceaa6428e2f45b46efdd20f063df51e23609648c4319e9f331ffe72cc83136083841b76e80949d

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
MD5
188354ea53b4a68a5842676461f7d30c

SHA1
9543729c1516f6c4572e59f6d190705dee8c964c

SHA256
71e003fade1c08b8957e5d003c47734d0242e49cd7f7f157de49d7b88e9b0c01

SHA512
2e2a48e55d561b9c5a44d646ff1422660dc1158cd227be2ceaceaa6428e2f45b46efdd20f063df51e23609648c4319e9f331ffe72cc83136083841b76e80949d

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
MD5
188354ea53b4a68a5842676461f7d30c

SHA1
9543729c1516f6c4572e59f6d190705dee8c964c

SHA256
71e003fade1c08b8957e5d003c47734d0242e49cd7f7f157de49d7b88e9b0c01

SHA512
2e2a48e55d561b9c5a44d646ff1422660dc1158cd227be2ceaceaa6428e2f45b46efdd20f063df51e23609648c4319e9f331ffe72cc83136083841b76e80949d

Download Submit
C:\Users\Admin\AppData\Roaming\IDM\ichader.exe
MD5
188354ea53b4a68a5842676461f7d30c

SHA1
9543729c1516f6c4572e59f6d190705dee8c964c

SHA256
71e003fade1c08b8957e5d003c47734d0242e49cd7f7f157de49d7b88e9b0c01

SHA512
2e2a48e55d561b9c5a44d646ff1422660dc1158cd227be2ceaceaa6428e2f45b46efdd20f063df51e23609648c4319e9f331ffe72cc83136083841b76e80949d

Download Submit
memory/636-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/636-38-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/636-33-0x0000000072FA0000-0x0000000073033000-memory.dmp

Filesize
588KB

Download
memory/636-29-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/636-31-0x00000000004B5210-mapping.dmp

Download
memory/668-11-0x0000000000000000-mapping.dmp

Download
memory/852-10-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/2084-30-0x0000000072FA0000-0x0000000073033000-memory.dmp

Filesize
588KB

Download
memory/2084-26-0x00000000004085D0-mapping.dmp

Download
memory/2116-14-0x0000000000000000-mapping.dmp

Download
memory/2116-17-0x0000000072FA0000-0x0000000073033000-memory.dmp

Filesize
588KB

Download
memory/2140-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2140-22-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2140-23-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2140-21-0x000000000040B000-mapping.dmp

Download
memory/2796-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2796-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2796-5-0x00000000004085D0-mapping.dmp

Download
memory/2796-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3148-3-0x000000000040B000-mapping.dmp

Download
memory/3796-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads