gozi_ifsb | 4d1c37dac45daec5880750b8499b337e6ccf3696bfd645c4e22f388001e79900

General

Target

scongiurare.12.01.2020.doc
Size

91KB
MD5

9edc856edd53b45e9c6f84c2e65e1cc7
SHA1

f16bd28f364c678054ea5c73651a668dfd68a5bc
SHA256

4d1c37dac45daec5880750b8499b337e6ccf3696bfd645c4e22f388001e79900
SHA512

1f268c6b48cf7b5771947f2803ffcf8a1156102f1be6c9305e9e18972c48fa68ad2b51ed7d9a3c723a0e48cfbb9b51daf74e9167692199e5027b04ff1c671c76

Score

10^/10

gozi_ifsb banker trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Executes dropped EXE 1 IoCs

Processes:

ms.com

pid process

1564 ms.com
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1576 regsvr32.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

pid	process
1564	ms.com

pid	process
1576	regsvr32.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 69 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeWINWORD.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEms.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A802371-3569-11EB-80C1-FE45F3F7002A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4079d32876c9d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D025071-3569-11EB-80C1-FE45F3F7002A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "313766138"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000051d60621128ce75668c98eeb7374e4c191c0ad38d76b0f1762cfa2234f3dfc1a000000000e80000000020000200000005df56bbdd28ed6dc6f3a7c520d7d79222680bfd1055c725be30e1f61077b702720000000b06a417038e8be5fbf7d0c66f9b89e5160e7390dcb6bf1d5e9187cd89da3eee7400000007389a1eefc88017acc3f0816c66d2c64e4967461b906bd91dabbdc45011eeeb0305c22895180ce6f83d40a7108b8e77cb5f802881ad3eb827a90e1ce574e84ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	ms.com
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000000a7638e63d7f30828b5c5d986e83e36eab05ed80b6ff84f12565e6a375667577000000000e80000000020000200000007131759bc7d42ef6b3ecb11ff5f47a2d64d4e7e0b1c7acb16231d01332d96874900000001ab710ef0d2903080dc60001ad8b7ba55f83498c2992acee7198ed9f1dc222aa864dd5d9e3c0f5b54d97c5c41621a01a39347f375fd7dcb2f36c27a3e5f449d903704dde1b5df5c325da59a43e4f8c37405df77c395a1020b8979f16adced6f0d2544194be77bb17aae2fe6d7cac2530e07953d7d8cacc9d1f01c5bdbfe4256d6682732095a6a7534419af8c8034832740000000b1e85ef2941e4ec1924e4e1d2177840caeb867d06fdbf91e4d60851ac3183257fd4ab8a181aaf71090331b727032b6d3015795c1f6c977e25a590fe1f3ee2366	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1204 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1920 iexplore.exe
1712 iexplore.exe

pid	process
1920	iexplore.exe
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1204	WINWORD.EXE
1920	iexplore.exe
1920	iexplore.exe
664	IEXPLORE.EXE
664	IEXPLORE.EXE
1712	iexplore.exe
1712	iexplore.exe
848	IEXPLORE.EXE
848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WINWORD.EXEms.comiexplore.exeiexplore.exe

description	pid	process	target process
PID 1204 wrote to memory of 844	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 844	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 844	1204	WINWORD.EXE	splwow64.exe
PID 1204 wrote to memory of 844	1204	WINWORD.EXE	splwow64.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1564 wrote to memory of 1576	1564	ms.com	regsvr32.exe
PID 1920 wrote to memory of 664	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 664	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 664	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 664	1920	iexplore.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 848	1712	iexplore.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 848	1712	iexplore.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 848	1712	iexplore.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 848	1712	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\scongiurare.12.01.2020.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:844

C:\users\public\ms.com
C:\users\public\ms.com C:\users\public\ms.html
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp
2⤵
- Loads dropped DLL
PID:1576

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
6d7bdc2641419e23d89a1fd659b98d53

SHA1
00b905eae0c8b80868c2f0d4355cce0ee63887f9

SHA256
2aa0e1e01910526337f940b65fe2c0fee93ac7f564cfb73151ca8cd284c487e1

SHA512
c22e94a84d0d8c8f6a4ed2baafabca4dd2b0a4fbeb0056f6ebff9b7fe40dee2ff3c8be07119a9939be018019c250dcb30f8f26d65776040ac37dcb050f69a883

Download Submit
C:\Users\Public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.com
MD5
abdfc692d9fe43e2ba8fe6cb5a8cb95a

SHA1
d4f0397f83083e1c6fb0894187cc72aebcf2f34f

SHA256
949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820

SHA512
c786bfb6a2316e43cb89901fae103157ec6b65117c292dc7570dd4685891b5afbb72064789b74bf55fe012c5936ed6468876e4d2cccdeff71b4abb2d76ff395f

Download Submit
C:\users\public\ms.html
MD5
c95ad501989d92e932c8b38d52955a9c

SHA1
19223f16652ae22baca91cb4030e7f81aa3efff1

SHA256
37ed664d7ba10c77315d7190e5b335e4ca4c46bc7255b76314ad7ab694db6ae0

SHA512
13bd20b2b890c8a03e4064da2dbe799f66c8d4fa43b0eb33b6b552155e123c2d39faff4834b4078d8b732f7ba69a8ab338924cf908d55fd5007d630641cb5c85

Download Submit
\Users\Admin\AppData\Local\Temp\temp.tmp
MD5
6d7bdc2641419e23d89a1fd659b98d53

SHA1
00b905eae0c8b80868c2f0d4355cce0ee63887f9

SHA256
2aa0e1e01910526337f940b65fe2c0fee93ac7f564cfb73151ca8cd284c487e1

SHA512
c22e94a84d0d8c8f6a4ed2baafabca4dd2b0a4fbeb0056f6ebff9b7fe40dee2ff3c8be07119a9939be018019c250dcb30f8f26d65776040ac37dcb050f69a883

Download Submit
memory/664-16-0x0000000005D10000-0x0000000005D33000-memory.dmp

Filesize
140KB

Download
memory/664-15-0x0000000000000000-mapping.dmp

Download
memory/844-8-0x0000000000000000-mapping.dmp

Download
memory/848-17-0x0000000000000000-mapping.dmp

Download
memory/1204-4-0x00000000003B5000-0x00000000003B9000-memory.dmp

Filesize
16KB

Download
memory/1204-2-0x000000000042A000-0x000000000042D000-memory.dmp

Filesize
12KB

Download
memory/1204-5-0x00000000003B5000-0x00000000003B9000-memory.dmp

Filesize
16KB

Download
memory/1204-3-0x00000000003B5000-0x00000000003B9000-memory.dmp

Filesize
16KB

Download
memory/1368-9-0x000007FEF7510000-0x000007FEF778A000-memory.dmp

Filesize
2.5MB

Download
memory/1576-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads