gozi_ifsb | 0cdb011bfac8731aa990d921e6a4748a4ec75ec6e62e0f6d0da2c03d00955886

General

Target

documenti-12.20.doc
Size

92KB
MD5

53915ecbd649a6008ae69c0dcacf591b
SHA1

2711d278e9cf36c4924a69659157d4e7b3b05e06
SHA256

0cdb011bfac8731aa990d921e6a4748a4ec75ec6e62e0f6d0da2c03d00955886
SHA512

d67e429e6f00d60deefe1abb3f13b240dd020b486a09c136e0c0c8ebf1c5802d87c4bb0fc26248de1e069b6c007a6921dc6d3a78d72789b0eecfb078a96b5556

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

1640 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

484 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1640	ms.com

pid	process
484	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 69 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeWINWORD.EXEIEXPLORE.EXEms.comIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000a45924d0691003c1af8c82e095aefd7e0c35eb5d546614d7c51b3a5596545e22000000000e80000000020000200000001a1ba5897d715f66696b2e969d472a28755f3e7318cf3f5accff0fb6a059a20b90000000576b47a9cc0a1f73dc4c6f374830a510fa50c7e0b8768905a08baee4379e5a9d326d80aa5ad4628e900ac742cf2008c91050a7e7011358803070263145224bcedb978e941176cdcb497224530e5f0cb27c81a73f802207cf31e7a2f49c4157b65aa2ba5e86b45d7d472f483bcf366af1cb9ab1b1831177c67b77b7663cdeb2b9d6872d15f953332033eb67701060f1fe40000000da0b157bd70088f995d5f91571fd2fb066a810a144ca5d5873cc73bebede28e768c5cb88f3344da2cddc44416ad68307cbb978ee50b55cb7c01ce4478f4e8e9b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	ms.com
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2D3EE51-355D-11EB-8489-EE45CAFA0C11} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0437911-355D-11EB-8489-EE45CAFA0C11} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "313761155"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000dbe0a1a62d8944dad6c3cd190e23af36d75d6bd544ba61bf3263130fa73a8c26000000000e800000000200002000000054d61ea2e24f97a79731300b03768c896357783ccbc42cfbfd7d5138cd622e83200000002d76532f5ba8e33bcc2fb9b37dcd34295e92d787dc687cce50034d352120d4a340000000ba569cc0ac7eca1aa6e8ca16124eacf19d5ec2f16f3f6d46811db890fac2fbe5ef3f0f33ffac40e792c7341465fc4b828eb14f0ac990bc58b92992da0981b3e2	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1408 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1084 iexplore.exe
2204 iexplore.exe

pid	process
1084	iexplore.exe
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1408	WINWORD.EXE
1084	iexplore.exe
1084	iexplore.exe
360	IEXPLORE.EXE
360	IEXPLORE.EXE
1408	WINWORD.EXE
2204	iexplore.exe
2204	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WINWORD.EXEms.comiexplore.exeiexplore.exe

description	pid	process	target process
PID 1408 wrote to memory of 1448	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1448	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1448	1408	WINWORD.EXE	splwow64.exe
PID 1408 wrote to memory of 1448	1408	WINWORD.EXE	splwow64.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1640 wrote to memory of 484	1640	ms.com	regsvr32.exe
PID 1084 wrote to memory of 360	1084	iexplore.exe	IEXPLORE.EXE
PID 1084 wrote to memory of 360	1084	iexplore.exe	IEXPLORE.EXE
PID 1084 wrote to memory of 360	1084	iexplore.exe	IEXPLORE.EXE
PID 1084 wrote to memory of 360	1084	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 2260	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 2260	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 2260	2204	iexplore.exe	IEXPLORE.EXE
PID 2204 wrote to memory of 2260	2204	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\documenti-12.20.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1448

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Loads dropped DLL
PID:484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:360

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
a7c80246b4dbe1085b435c505a1c6bd1

SHA1
a156ffca06b7f42e57bfcecadd1342adcdb44a5d

SHA256
eb3d0ac3165028922860c3e8e61e051faed8bf9d884ac96a8a493312aa88fe31

SHA512
a1fab85125bfc3c9a26c5df9a303b6fcc0cb338411b4a63a4838523b78e69052c371cac0b6292451a496426f72b605970df5421acd1b6ce98b1638766fcaee5b

Download Submit
C:\Users\Public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.html
MD5
3d4c1e100159158e91a1d06c6821a7cc

SHA1
cdc3b2a3280c6f7e8a201cb485e85222d15bd2ed

SHA256
042b36a012b50fd8073f3d47670dba0cefe36b71a909f6cfdc66b2c5ef4fcdb2

SHA512
5adf16e5bb68a114ff66a26b4a5282698968ac2ca51bb0569982408c31bd20801a8693dc8abc01d0b3f10dbf41a7f52eccb3a7911bd98ddc7098be4b707c5af9

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
a7c80246b4dbe1085b435c505a1c6bd1

SHA1
a156ffca06b7f42e57bfcecadd1342adcdb44a5d

SHA256
eb3d0ac3165028922860c3e8e61e051faed8bf9d884ac96a8a493312aa88fe31

SHA512
a1fab85125bfc3c9a26c5df9a303b6fcc0cb338411b4a63a4838523b78e69052c371cac0b6292451a496426f72b605970df5421acd1b6ce98b1638766fcaee5b

Download Submit
memory/360-16-0x0000000006270000-0x0000000006293000-memory.dmp

Filesize
140KB

Download
memory/360-15-0x0000000000000000-mapping.dmp

Download
memory/484-11-0x0000000000000000-mapping.dmp

Download
memory/1408-5-0x00000000004C5000-0x00000000004C9000-memory.dmp

Filesize
16KB

Download
memory/1408-2-0x0000000004DFB000-0x0000000004E24000-memory.dmp

Filesize
164KB

Download
memory/1408-4-0x00000000004C5000-0x00000000004C9000-memory.dmp

Filesize
16KB

Download
memory/1408-3-0x00000000004C5000-0x00000000004C9000-memory.dmp

Filesize
16KB

Download
memory/1448-8-0x0000000000000000-mapping.dmp

Download
memory/1868-9-0x000007FEF6680000-0x000007FEF68FA000-memory.dmp

Filesize
2.5MB

Download
memory/2260-17-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads