smokeloader | 604ab38ce18503e51024931890ed855923bf6dbdbfa11f5e55cec03dd274bbc9

General

Target

onir0.bin.exe
Size

112KB
MD5

c989356bdc4ffc9b4752acecfddb551d
SHA1

fff0e011c492e174a3175c3ddb2ee0d6ed9d7285
SHA256

8afc2dd7267bbf83a46549f4e7731f6473610c33bc9ee41b4dd0b994c3a29473
SHA512

f51769eed207b7b0e9387c9bc13d46502f0c25086c6f1ce8d16678bbe639f06efb799959efac10aefd6d92dd08310216d2929178ebee3f2c73ecad286c89da1f

Score

10^/10

smokeloader backdoor trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 2 IoCs

Processes:

AA8E.tmp.exeACE0.tmp.exe

pid process

3548 AA8E.tmp.exe
2924 ACE0.tmp.exe
Deletes itself 1 IoCs

Processes:

pid process

3040
Loads dropped DLL 1 IoCs

Processes:

onir0.bin.exe

pid process

640 onir0.bin.exe

pid	process
3548	AA8E.tmp.exe
2924	ACE0.tmp.exe

pid	process
3040

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

onir0.bin.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	onir0.bin.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30852102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4214902880"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a0000000002000000000010660000000100002000000035661c38e548e2f10529e38c0012e418aed833670ab950752ea9bb1b78fbdbd8000000000e800000000200002000000064cbefd26d1231927b9cab236ccaafa2d780462cb1f5bb5a61fa5d1f5a54eb8720000000526d0b5daaf33c058e63a111dc792c741ffe8da08f2a47e9fa3eea2cd789a09040000000b00364beca9d0214cb78825481c89e5e670576b45876c11fca92586b2531cd250a6815bc290c0d9086aa620ca983242f0c0b465a8003accbc6b3c05b4ded1b11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000009f3eab874c4a01b66defa81ba217c75ebae7b7d6426814ab62ca267fc42409a0000000000e800000000200002000000093a0f62bc2fb053c13c3d71003322fc72c4a4a48ced0ca77116e56e8efbddffc200000003f94e10785340a5a5a55b19993ad5b28e02fa7bfa5e6c3cb14d0e320d49a6faa400000004f4a43c993872ea1d521d72bd8dc89f374dcefba188386b30daaa0fa0bba5850ded4d52fb94563b571b551e5686f9db5274f5d601bf3b26ce126c31a80622cef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a070e70407c4d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a000000000200000000001066000000010000200000004b29ada48b72f42bc7d2111149686b39e55ce68bbf5f6ce77cd0ea045245d289000000000e80000000020000200000002855ebb5bd8c0109325310aa85e2dfa68646f228d4e63d7eecb3d834c6842179200000007a4d9058dc4e76e7f32aa41522011fc6548994a5633fc4a9209e2a3e303b8d6240000000253aa981838ff04549ed2c8dc59a012b8227de21cf040a0c2ec3e4ef7ef8ea39ff8153db517f7b9eab97fbad2b5106c62601d70fe1004da83301832cc06b0952	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2616CCE8-2FFA-11EB-B59A-42BBCFED91E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a062c0fd06c4d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4214902880"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30852102"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b2a3fd06c4d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41B186F1-2FFA-11EB-B59A-42BBCFED91E6} = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1298 IoCs

Processes:

onir0.bin.exe

pid	process
640	onir0.bin.exe
640	onir0.bin.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3040
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

onir0.bin.exe

pid process

640 onir0.bin.exe

pid	process
3040

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2136 iexplore.exe
4032 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid process

2136 iexplore.exe
2136 iexplore.exe
2884 IEXPLORE.EXE
2884 IEXPLORE.EXE
4032 iexplore.exe
4032 iexplore.exe
2708 IEXPLORE.EXE
2708 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3040

pid	process
2136	iexplore.exe
4032	iexplore.exe

pid	process
2136	iexplore.exe
2136	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
4032	iexplore.exe
4032	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

pid	process
3040

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

iexplore.exeiexplore.exe

description	pid	process	target process
PID 3040 wrote to memory of 3548	3040		AA8E.tmp.exe
PID 3040 wrote to memory of 3548	3040		AA8E.tmp.exe
PID 3040 wrote to memory of 3548	3040		AA8E.tmp.exe
PID 3040 wrote to memory of 2924	3040		ACE0.tmp.exe
PID 3040 wrote to memory of 2924	3040		ACE0.tmp.exe
PID 3040 wrote to memory of 2924	3040		ACE0.tmp.exe
PID 2136 wrote to memory of 2884	2136	iexplore.exe	IEXPLORE.EXE
PID 2136 wrote to memory of 2884	2136	iexplore.exe	IEXPLORE.EXE
PID 2136 wrote to memory of 2884	2136	iexplore.exe	IEXPLORE.EXE
PID 4032 wrote to memory of 2708	4032	iexplore.exe	IEXPLORE.EXE
PID 4032 wrote to memory of 2708	4032	iexplore.exe	IEXPLORE.EXE
PID 4032 wrote to memory of 2708	4032	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\onir0.bin.exe
"C:\Users\Admin\AppData\Local\Temp\onir0.bin.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:640

C:\Users\Admin\AppData\Local\Temp\AA8E.tmp.exe
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Users\Admin\AppData\Local\Temp\ACE0.tmp.exe
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4032 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AA8E.tmp.exe
MD5
86fc9993f4fe92809513a02d907205cd

SHA1
a23217fa44754496be797902abe54aa661dc7774

SHA256
edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

SHA512
0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp.exe
MD5
86fc9993f4fe92809513a02d907205cd

SHA1
a23217fa44754496be797902abe54aa661dc7774

SHA256
edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

SHA512
0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp.exe
MD5
dd27ae12604dd29819d082e8140f4100

SHA1
6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

SHA256
c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

SHA512
5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp.exe
MD5
dd27ae12604dd29819d082e8140f4100

SHA1
6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

SHA256
c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

SHA512
5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

Download Submit
\Users\Admin\AppData\Local\Temp\2F6.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/640-0-0x00000000033B9000-0x00000000033BA000-memory.dmp

Filesize
4KB

Download
memory/640-1-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/1020-16-0x0000000000000000-mapping.dmp

Download
memory/2708-15-0x0000000000000000-mapping.dmp

Download
memory/2884-14-0x0000000000000000-mapping.dmp

Download
memory/2924-13-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/2924-12-0x00000000031E8000-0x00000000031E9000-memory.dmp

Filesize
4KB

Download
memory/2924-7-0x0000000000000000-mapping.dmp

Download
memory/3040-3-0x0000000001230000-0x0000000001246000-memory.dmp

Filesize
88KB

Download
memory/3548-10-0x0000000003118000-0x0000000003119000-memory.dmp

Filesize
4KB

Download
memory/3548-11-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/3548-4-0x0000000000000000-mapping.dmp

Download
memory/3992-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads