gozi_ifsb | 9a752f4b373e32ef86ead4516cceb238bdef9519191922abf5141261b13c38f3

General

Target

ordine.12.20.doc
Size

91KB
MD5

d877528f01cafe6d9401c89e4c4799a5
SHA1

10836e28ae5184ae004c3b60159c2e994832c90c
SHA256

9a752f4b373e32ef86ead4516cceb238bdef9519191922abf5141261b13c38f3
SHA512

c33b67bebe288ed9718f6485fb0ac3a46bdcaf0726bf37b378b1ed8920450cabc22b7cd57b3a6dc6f9daeedca6929e899f4b49969d674ed865211dd121a02bc4

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

1608 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1580 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1608	ms.com

pid	process
1580	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 69 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXEiexplore.exeiexplore.exeIEXPLORE.EXEms.comIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0fb29837dc9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C739EB91-3570-11EB-8534-42BBC6EE9B6F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b66000000000200000000001066000000010000200000000bf1aeb2aea05bd6cfec97d09b10e9ea1973d40efc6a607fe945bf1527b66c69000000000e800000000200002000000066c11fa46b9f3143f060e0aaae9c1859bab82f5252d814efd1591383ad1293ac90000000ab3ba8fb493dd43211eaa07114bf01d2e3a6998f8032429e1dfa5b76e6851b67d588bde849dbc534dd140a575c2d5858a1dc91f83f1c178697e0a2d56394cb5f2d3b0b524a7f67d5b7eea3bcf1718f45c92fa08fb1f5a397d00ea9363f08d755e9826864d50afd189d3bfface5bad4705828d10282e66c7b140410cc6aa2ef170943a53373d5e355589839a4f8273abd400000000cb6cb613e263079e5ddb36709a83c30c8b9a6da01aadb51b65b3117309e7df6428c942cbc6955cbc7347d5f634acd220b65f76f6397db48eee8155f30123956	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94516371-3570-11EB-8534-42BBC6EE9B6F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	ms.com
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "313769296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1204 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1316 iexplore.exe
1732 iexplore.exe

pid	process
1316	iexplore.exe
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1316	iexplore.exe
1316	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1732	iexplore.exe
1732	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WINWORD.EXEms.comiexplore.exeiexplore.exe

description	pid	process	target process
PID 1204 wrote to memory of 660	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 660	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 660	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 660	1204	WINWORD.EXE	splwow64.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1608 wrote to memory of 1580	1608	ms.com	regsvr32.exe
PID 1316 wrote to memory of 1884	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1884	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1884	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1884	1316	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1612	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1612	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1612	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1612	1732	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ordine.12.20.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:660

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Loads dropped DLL
PID:1580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
e4fd73c229bb68127e4dd2e5d5f7cb31

SHA1
08b75e4c422c096e4f4b7dc44252b7dd001513e1

SHA256
db4df8d6e29ec29a7cf09512f1b7825ae7e6daa1b02d03e67d743e1e9e0eb3e3

SHA512
1e679c858b27dad6116aca0b71809dae3c2706fb7e5a976b94ab49c36f7c11debfa7416e5c20dae2470c5898f1b51e8bf9b054a08de87850cb9bbcd36446065c

Download Submit
C:\Users\Public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.html
MD5
f92fb6fe7f0536a53a813177585dcfee

SHA1
855b96cd27e0eb6f0bdff03242a7375fde19d3d7

SHA256
f2855229bb557b3abfc20e95e879c1cd4c0102fbd9fecd7c2cbfbe6cf5be3f30

SHA512
94f766077d27d8c04d69dcdabea02a01b8b396a0cefb1f5d81aa9f9baba6b03b3134dd822c6fe48839f7c8a944131f107cfbb5962bd242a922937ce884ccebd6

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
e4fd73c229bb68127e4dd2e5d5f7cb31

SHA1
08b75e4c422c096e4f4b7dc44252b7dd001513e1

SHA256
db4df8d6e29ec29a7cf09512f1b7825ae7e6daa1b02d03e67d743e1e9e0eb3e3

SHA512
1e679c858b27dad6116aca0b71809dae3c2706fb7e5a976b94ab49c36f7c11debfa7416e5c20dae2470c5898f1b51e8bf9b054a08de87850cb9bbcd36446065c

Download Submit
memory/660-8-0x0000000000000000-mapping.dmp

Download
memory/1004-10-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp

Filesize
2.5MB

Download
memory/1204-6-0x0000000004B20000-0x0000000004B85000-memory.dmp

Filesize
404KB

Download
memory/1204-2-0x000000000089C000-0x000000000089F000-memory.dmp

Filesize
12KB

Download
memory/1204-5-0x0000000004B20000-0x0000000004B85000-memory.dmp

Filesize
404KB

Download
memory/1204-4-0x0000000004B20000-0x0000000004B85000-memory.dmp

Filesize
404KB

Download
memory/1204-3-0x0000000000887000-0x0000000000890000-memory.dmp

Filesize
36KB

Download
memory/1204-15-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1580-12-0x0000000000000000-mapping.dmp

Download
memory/1612-18-0x0000000000000000-mapping.dmp

Download
memory/1884-16-0x0000000000000000-mapping.dmp

Download
memory/1884-17-0x0000000006170000-0x0000000006193000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads