revengerat | 8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65

General

Target

Invoice.msi
Size

288KB
MD5

f959677f1823dff599d226429d95c0e6
SHA1

02b546733236c788dec7c680ec38afa03dc5960d
SHA256

8e57e91b007a4aea044f90adce393d0a78465d62df8f70a4022f5a4533c3fd65
SHA512

7e3781b42b4d2f7533523c986d0778a53ea7e995fa794c5196d49fe2229892519472cff53f6787b7a8c7f307dde0c58bd2be167b90f3c5b59a369796c3ba8547

Score

10^/10

revengerat nov333 stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Nov333

C2

80.82.68.21:3333

Mutex

RV_MUTEX-FtNHuiGGjjtnxDp

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/572-15-0x0000000000470000-0x00000000004A5000-memory.dmp	beds_protector

RevengeRat Executable 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1696-16-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1696-17-0x0000000000405DDE-mapping.dmp	revengerat
behavioral1/memory/1696-20-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat
behavioral1/memory/1696-19-0x0000000000400000-0x0000000000408000-memory.dmp	revengerat

Executes dropped EXE 2 IoCs

Processes:

MSI197C.tmpMSI197C.tmp

pid process

572 MSI197C.tmp
1696 MSI197C.tmp

pid	process
572	MSI197C.tmp
1696	MSI197C.tmp

Drops startup file 2 IoCs

Processes:

MSI197C.tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSI197C.tmp.exe	MSI197C.tmp
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSI197C.tmp.exe	MSI197C.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

MSI197C.tmp

description pid process target process

PID 572 set thread context of 1696 572 MSI197C.tmp MSI197C.tmp

description	pid	process	target process
PID 572 set thread context of 1696	572	MSI197C.tmp	MSI197C.tmp

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f74167d.msi	msiexec.exe
File created	C:\Windows\Installer\f74167f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI191C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI197C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f74167f.ipi	msiexec.exe
File created	C:\Windows\Installer\f74167d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MSI197C.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	MSI197C.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSI197C.tmp

Modifies data under HKEY_USERS 44 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

msiexec.exeMSI197C.tmp

pid	process
1524	msiexec.exe
1524	msiexec.exe
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp
572	MSI197C.tmp

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSI197C.tmpMSI197C.tmp

description	pid	process
Token: SeShutdownPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeSecurityPrivilege	1524	msiexec.exe
Token: SeCreateTokenPrivilege	1936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1936	msiexec.exe
Token: SeLockMemoryPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeMachineAccountPrivilege	1936	msiexec.exe
Token: SeTcbPrivilege	1936	msiexec.exe
Token: SeSecurityPrivilege	1936	msiexec.exe
Token: SeTakeOwnershipPrivilege	1936	msiexec.exe
Token: SeLoadDriverPrivilege	1936	msiexec.exe
Token: SeSystemProfilePrivilege	1936	msiexec.exe
Token: SeSystemtimePrivilege	1936	msiexec.exe
Token: SeProfSingleProcessPrivilege	1936	msiexec.exe
Token: SeIncBasePriorityPrivilege	1936	msiexec.exe
Token: SeCreatePagefilePrivilege	1936	msiexec.exe
Token: SeCreatePermanentPrivilege	1936	msiexec.exe
Token: SeBackupPrivilege	1936	msiexec.exe
Token: SeRestorePrivilege	1936	msiexec.exe
Token: SeShutdownPrivilege	1936	msiexec.exe
Token: SeDebugPrivilege	1936	msiexec.exe
Token: SeAuditPrivilege	1936	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1936	msiexec.exe
Token: SeChangeNotifyPrivilege	1936	msiexec.exe
Token: SeRemoteShutdownPrivilege	1936	msiexec.exe
Token: SeUndockPrivilege	1936	msiexec.exe
Token: SeSyncAgentPrivilege	1936	msiexec.exe
Token: SeEnableDelegationPrivilege	1936	msiexec.exe
Token: SeManageVolumePrivilege	1936	msiexec.exe
Token: SeImpersonatePrivilege	1936	msiexec.exe
Token: SeCreateGlobalPrivilege	1936	msiexec.exe
Token: SeBackupPrivilege	1968	vssvc.exe
Token: SeRestorePrivilege	1968	vssvc.exe
Token: SeAuditPrivilege	1968	vssvc.exe
Token: SeBackupPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1536	DrvInst.exe
Token: SeLoadDriverPrivilege	1536	DrvInst.exe
Token: SeLoadDriverPrivilege	1536	DrvInst.exe
Token: SeLoadDriverPrivilege	1536	DrvInst.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeDebugPrivilege	572	MSI197C.tmp
Token: SeDebugPrivilege	1696	MSI197C.tmp
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1936 msiexec.exe
1936 msiexec.exe

pid	process
1936	msiexec.exe
1936	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

msiexec.exeMSI197C.tmp

description	pid	process	target process
PID 1524 wrote to memory of 572	1524	msiexec.exe	MSI197C.tmp
PID 1524 wrote to memory of 572	1524	msiexec.exe	MSI197C.tmp
PID 1524 wrote to memory of 572	1524	msiexec.exe	MSI197C.tmp
PID 1524 wrote to memory of 572	1524	msiexec.exe	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp
PID 572 wrote to memory of 1696	572	MSI197C.tmp	MSI197C.tmp

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Invoice.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\Installer\MSI197C.tmp
"C:\Windows\Installer\MSI197C.tmp"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\Installer\MSI197C.tmp
"C:\Windows\Installer\MSI197C.tmp"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000003B0" "00000000000005C4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI197C.tmp
MD5
49d493901c396507a0d26065e4a75283

SHA1
0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

SHA256
c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

SHA512
a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

Download Submit
C:\Windows\Installer\MSI197C.tmp
MD5
49d493901c396507a0d26065e4a75283

SHA1
0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

SHA256
c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

SHA512
a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

Download Submit
C:\Windows\Installer\MSI197C.tmp
MD5
49d493901c396507a0d26065e4a75283

SHA1
0fa197bf3b50ca8a6b6be01283e6ba1eebcc7889

SHA256
c04888cf051d59540208dc4e13c7b32366f131d095e50bd97c2c8fbff91c07c3

SHA512
a72ed9410f8fcedd6ea63a5eab84174ad78a397155238651de35c0cd69060f1bc51219430955929753a3fe8347abc0ebdf544d55f452930deab7fa99ff2fc711

Download Submit
memory/572-9-0x0000000000000000-mapping.dmp

Download
memory/572-12-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/572-13-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/572-15-0x0000000000470000-0x00000000004A5000-memory.dmp

Filesize
212KB

Download
memory/1524-8-0x0000000001680000-0x0000000001684000-memory.dmp

Filesize
16KB

Download
memory/1524-27-0x0000000003030000-0x0000000003034000-memory.dmp

Filesize
16KB

Download
memory/1524-7-0x00000000018C0000-0x00000000018C4000-memory.dmp

Filesize
16KB

Download
memory/1524-26-0x0000000001680000-0x0000000001684000-memory.dmp

Filesize
16KB

Download
memory/1524-24-0x0000000003030000-0x0000000003034000-memory.dmp

Filesize
16KB

Download
memory/1696-17-0x0000000000405DDE-mapping.dmp

Download
memory/1696-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1696-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1696-21-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1696-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1936-3-0x00000000040E0000-0x00000000040E4000-memory.dmp

Filesize
16KB

Download
memory/1936-5-0x00000000040E0000-0x00000000040E4000-memory.dmp

Filesize
16KB

Download
memory/1936-2-0x0000000003220000-0x0000000003224000-memory.dmp

Filesize
16KB

Download
memory/1936-28-0x0000000002220000-0x0000000002224000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads