smokeloader | 84e8caaf836da889b6f7c4d7e53c682274d23fdfa84011efe29c1894b7b16bd3

General

Target

0di3x.bin.exe
Size

111KB
MD5

bd97f762750d0e38e38d5e8f7363f66a
SHA1

9ae3d7053246289ff908758f9d60d79586f7fc9f
SHA256

d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158
SHA512

d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

EAD3.tmp.exeECC8.tmp.exe

pid process

2292 EAD3.tmp.exe
2112 ECC8.tmp.exe
Deletes itself 1 IoCs

Processes:

pid process

3024
Loads dropped DLL 1 IoCs

Processes:

0di3x.bin.exe

pid process

1400 0di3x.bin.exe

pid	process
2292	EAD3.tmp.exe
2112	ECC8.tmp.exe

pid	process
3024

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0di3x.bin.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.bin.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.bin.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0di3x.bin.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000001997ea17e36f7469ac4783ddde04308a3a102573ba00074e94dc9ac83d22f8fe000000000e800000000200002000000034d285b45f746e9ae0f83cad055e7c8e47a3eaf53ad7136fd1b6dad99f437ea32000000028c8176d23beb7ebca735cf8823c6ecd343e0c82b74c5bfc117d2c509398bce240000000c16762a218143dc5265ba3fa8c228ded2405522ca911ad94dc5d2707a78e36f004281c2092fc0f7733d07fd5aafbdd8edbe9e2f76c2148c35bf68bf23136a3eb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3281362806"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE82CC0B-2806-11EB-B59A-5E321723808D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3281362806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30850067"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09E6B100-2807-11EB-B59A-5E321723808D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a00000000020000000000106600000001000020000000c591afe7bcc763a19ce3834e7d3d75547eb6634f190c44a6452a215d70d016d7000000000e80000000020000200000000ebe4cd1e5ca2833b9a98963d52a53b41c7771eeb21830c61bc2874a496de01520000000b10bca1a6e430a25ab55640e3dd18fd89819ef445a6feaaf3074f2bf8d2022e9400000009e3bec7391227094ed22cb0ec7eb3a9c7ce5539b337bc5d6c0b8a5f95fa001445257c6ca75b24fa61c966b083ad9b08269c23b3fd5c43e8da5e7c87fcac0e2de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f3f7c513bcd601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a00000000020000000000106600000001000020000000357b08defa759c55a38477ab2674833995f223064bd44096e091ee49b123e585000000000e8000000002000020000000365347b231f1ef597733a26d61107ed4393e937c933e75c299a2f3fc71248cab200000008df03e97c675a660ee6d6e4ca88e9d7412fe93be7a7c1d2eb5dc656e6952054740000000f73321170a205a813e8be3a2709a03eceed8f449650b21c6e1ec6b58d6a19cc55990f950d2469db1c8ecf9b0e0fa8bf59ceead3f1d18502363788d3f615aa78e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30850067"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00a12c613bcd601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0893bcd13bcd601	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1264 IoCs

Processes:

0di3x.bin.exe

pid	process
1400	0di3x.bin.exe
1400	0di3x.bin.exe
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024
3024

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3024
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

0di3x.bin.exe

pid process

1400 0di3x.bin.exe

pid	process
3024

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024
Token: SeShutdownPrivilege	3024
Token: SeCreatePagefilePrivilege	3024

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2868 iexplore.exe
1796 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid process

2868 iexplore.exe
2868 iexplore.exe
3272 IEXPLORE.EXE
3272 IEXPLORE.EXE
1796 iexplore.exe
1796 iexplore.exe
3248 IEXPLORE.EXE
3248 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3024

pid	process
2868	iexplore.exe
1796	iexplore.exe

pid	process
2868	iexplore.exe
2868	iexplore.exe
3272	IEXPLORE.EXE
3272	IEXPLORE.EXE
1796	iexplore.exe
1796	iexplore.exe
3248	IEXPLORE.EXE
3248	IEXPLORE.EXE

pid	process
3024

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

iexplore.exeiexplore.exe

description	pid	process	target process
PID 3024 wrote to memory of 2292	3024		EAD3.tmp.exe
PID 3024 wrote to memory of 2292	3024		EAD3.tmp.exe
PID 3024 wrote to memory of 2292	3024		EAD3.tmp.exe
PID 3024 wrote to memory of 2112	3024		ECC8.tmp.exe
PID 3024 wrote to memory of 2112	3024		ECC8.tmp.exe
PID 3024 wrote to memory of 2112	3024		ECC8.tmp.exe
PID 2868 wrote to memory of 3272	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 3272	2868	iexplore.exe	IEXPLORE.EXE
PID 2868 wrote to memory of 3272	2868	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 3248	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 3248	1796	iexplore.exe	IEXPLORE.EXE
PID 1796 wrote to memory of 3248	1796	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe
"C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1400

C:\Users\Admin\AppData\Local\Temp\EAD3.tmp.exe
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Users\Admin\AppData\Local\Temp\ECC8.tmp.exe
C:\Users\Admin\AppData\Local\Temp\ECC8.tmp.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EAD3.tmp.exe
MD5
b3ef69a050bf821cabe2bd39b24a7e6c

SHA1
1462324750e0657704806dbb84946a0ec4fbc49c

SHA256
302145b6f26034c16b5d317c457e1ddf3d24f057ccd25ba5ffc8465527e0ed02

SHA512
d9bb96f338badce73979be6c930809324357517b1b28cca725dd53d0a0b142ffba822f514e60e2110d116581f5cae8b57127ede635f1f7356fdd757cd9c3d4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp.exe
MD5
b3ef69a050bf821cabe2bd39b24a7e6c

SHA1
1462324750e0657704806dbb84946a0ec4fbc49c

SHA256
302145b6f26034c16b5d317c457e1ddf3d24f057ccd25ba5ffc8465527e0ed02

SHA512
d9bb96f338badce73979be6c930809324357517b1b28cca725dd53d0a0b142ffba822f514e60e2110d116581f5cae8b57127ede635f1f7356fdd757cd9c3d4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECC8.tmp.exe
MD5
63087380f529f33bd6174c18484e4e1d

SHA1
9a372d462aa3ed5014b6e5358f6955de93e7aca0

SHA256
2fb369c93cb736b07da8bf8ba7024edf0ba4c910f4a347fa02128e5702516022

SHA512
c717063748fc571d63de2bf34db67d74f3aa7c53beddd65489f7f476dcc0b75334f7ff5cf1b9f17483ed02d2d95aa92ba5d02c9172846528d2bef4a73c7df371

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECC8.tmp.exe
MD5
63087380f529f33bd6174c18484e4e1d

SHA1
9a372d462aa3ed5014b6e5358f6955de93e7aca0

SHA256
2fb369c93cb736b07da8bf8ba7024edf0ba4c910f4a347fa02128e5702516022

SHA512
c717063748fc571d63de2bf34db67d74f3aa7c53beddd65489f7f476dcc0b75334f7ff5cf1b9f17483ed02d2d95aa92ba5d02c9172846528d2bef4a73c7df371

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.txt
MD5
e20ad3bc21a807807fb504b6dd29b662

SHA1
e21eee9e84a75580b64ffb48a30aee02c5d5ebe7

SHA256
c8db2eeccf33568d0ee5cbb1315ea28297fb2698747f9d092af0e9e0f6d7cc24

SHA512
19435164fe80049029fcb5b3f5a68d2b4686b420ceb2fed38dc3b4e0386547f2c3f601a3d8a536481d6278077b608535e1df41ea67ae835d0283031a128f734b

Download Submit
\Users\Admin\AppData\Local\Temp\2F6.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/1400-0-0x00000000031C9000-0x00000000031CA000-memory.dmp

Filesize
4KB

Download
memory/1400-1-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/2112-13-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/2112-7-0x0000000000000000-mapping.dmp

Download
memory/2112-12-0x0000000003128000-0x0000000003129000-memory.dmp

Filesize
4KB

Download
memory/2292-10-0x0000000003118000-0x0000000003119000-memory.dmp

Filesize
4KB

Download
memory/2292-11-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/2292-4-0x0000000000000000-mapping.dmp

Download
memory/2656-16-0x0000000000000000-mapping.dmp

Download
memory/3024-3-0x0000000000830000-0x0000000000846000-memory.dmp

Filesize
88KB

Download
memory/3248-15-0x0000000000000000-mapping.dmp

Download
memory/3272-14-0x0000000000000000-mapping.dmp

Download
memory/3988-17-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads