smokeloader | 1c259208bdea5d896335c7a22d7a3048e4cfe0c7578a466f8faad880446f4e02

Analysis

max time kernel
59s
max time network
60s
platform
windows10_x64
resource
win10v20201028
submitted
29-03-2021 07:05

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

874bcf36482b83f3df470655e985e29b.exe
Size

162KB
MD5

874bcf36482b83f3df470655e985e29b
SHA1

bbcfeea3e3b437680cbf14c8016b3954cac1398a
SHA256

1c259208bdea5d896335c7a22d7a3048e4cfe0c7578a466f8faad880446f4e02
SHA512

688cd7b19786c7c41079a1867a394ade9ed1201f10f38c408d52bae8da9edcd42b433ae979de6b68ed4bbf628201228c45ec4d9a03987851782265c19b0da8c6

Score

10^/10

smokeloader tofsee backdoor bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://xsss99.icu/upload/

http://bingooodsg.icu/upload/

http://junntd.xyz/upload/

http://ginessa11.xyz/upload/

http://overplayninsx.xyz/upload/

http://bananinze.com/upload/

http://daunimlas.com/upload/

rc4.i32

Signatures

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 9 IoCs

pid	Process
3308	E47A.exe
3644	ED83.exe
1312	E47A.exe
720	updatewin.exe
2504	5.exe
2816	FB5F.exe
2756	wwxideck.exe
2084	161C.exe
3288	1CB4.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	161C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	161C.exe

Deletes itself 1 IoCs

pid	Process
3016	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
496	874bcf36482b83f3df470655e985e29b.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2600	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\88f60da4-d0da-4e37-89b8-c779aa247322\\E47A.exe\" --AutoStart"	E47A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	161C.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	api.2ip.ua
31	api.2ip.ua
46	api.2ip.ua

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	1CB4.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2084	161C.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 3808	2756	wwxideck.exe	103

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	874bcf36482b83f3df470655e985e29b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	874bcf36482b83f3df470655e985e29b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	874bcf36482b83f3df470655e985e29b.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
200	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 34e8473e26b54f0524edb47d450dd49d084297dce82e72baa46d34fdc48d541d64da6a5785cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda5691ddd834a7c3ce0af644490bdbc7a23e8945d02cef78d3c74bbc4103d31fbad6b14d8834d7c0db8f2054991cfdb2470dd976d5d8dc4bf662fd39a460b37f9942e569beb092d60b19d5519cc85b07427ef9d553491abee3571bbd91d5061cda5691ddd834a7c3ce0ab64c9d40b866e6c06fc6d34fdc48c541de4da1b4f6f92e72f52edb47d440dd49d64a73b090c0814dda46d3731d68e541de4ac450531e3a66810c385447423e6ac5c2df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad953c04cd	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	E47A.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	E47A.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
496	874bcf36482b83f3df470655e985e29b.exe
496	874bcf36482b83f3df470655e985e29b.exe
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found
3016	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
496	874bcf36482b83f3df470655e985e29b.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3016	Process not Found
Token: SeCreatePagefilePrivilege	3016	Process not Found
Token: SeShutdownPrivilege	3288	1CB4.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3308	3016	Process not Found	78
PID 3016 wrote to memory of 3308	3016	Process not Found	78
PID 3016 wrote to memory of 3308	3016	Process not Found	78
PID 3308 wrote to memory of 2600	3308	E47A.exe	79
PID 3308 wrote to memory of 2600	3308	E47A.exe	79
PID 3308 wrote to memory of 2600	3308	E47A.exe	79
PID 3016 wrote to memory of 3644	3016	Process not Found	80
PID 3016 wrote to memory of 3644	3016	Process not Found	80
PID 3016 wrote to memory of 3644	3016	Process not Found	80
PID 3308 wrote to memory of 1312	3308	E47A.exe	81
PID 3308 wrote to memory of 1312	3308	E47A.exe	81
PID 3308 wrote to memory of 1312	3308	E47A.exe	81
PID 1312 wrote to memory of 720	1312	E47A.exe	83
PID 1312 wrote to memory of 720	1312	E47A.exe	83
PID 1312 wrote to memory of 720	1312	E47A.exe	83
PID 1312 wrote to memory of 2504	1312	E47A.exe	84
PID 1312 wrote to memory of 2504	1312	E47A.exe	84
PID 1312 wrote to memory of 2504	1312	E47A.exe	84
PID 3016 wrote to memory of 2816	3016	Process not Found	85
PID 3016 wrote to memory of 2816	3016	Process not Found	85
PID 3016 wrote to memory of 2816	3016	Process not Found	85
PID 2816 wrote to memory of 3456	2816	FB5F.exe	86
PID 2816 wrote to memory of 3456	2816	FB5F.exe	86
PID 2816 wrote to memory of 3456	2816	FB5F.exe	86
PID 2816 wrote to memory of 1180	2816	FB5F.exe	88
PID 2816 wrote to memory of 1180	2816	FB5F.exe	88
PID 2816 wrote to memory of 1180	2816	FB5F.exe	88
PID 2816 wrote to memory of 2160	2816	FB5F.exe	90
PID 2816 wrote to memory of 2160	2816	FB5F.exe	90
PID 2816 wrote to memory of 2160	2816	FB5F.exe	90
PID 2816 wrote to memory of 2268	2816	FB5F.exe	92
PID 2816 wrote to memory of 2268	2816	FB5F.exe	92
PID 2816 wrote to memory of 2268	2816	FB5F.exe	92
PID 2816 wrote to memory of 2340	2816	FB5F.exe	94
PID 2816 wrote to memory of 2340	2816	FB5F.exe	94
PID 2816 wrote to memory of 2340	2816	FB5F.exe	94
PID 2816 wrote to memory of 356	2816	FB5F.exe	97
PID 2816 wrote to memory of 356	2816	FB5F.exe	97
PID 2816 wrote to memory of 356	2816	FB5F.exe	97
PID 3016 wrote to memory of 2084	3016	Process not Found	99
PID 3016 wrote to memory of 2084	3016	Process not Found	99
PID 3016 wrote to memory of 2084	3016	Process not Found	99
PID 720 wrote to memory of 3400	720	updatewin.exe	100
PID 720 wrote to memory of 3400	720	updatewin.exe	100
PID 720 wrote to memory of 3400	720	updatewin.exe	100
PID 3016 wrote to memory of 3288	3016	Process not Found	102
PID 3016 wrote to memory of 3288	3016	Process not Found	102
PID 3016 wrote to memory of 3288	3016	Process not Found	102
PID 3400 wrote to memory of 200	3400	cmd.exe	104
PID 3400 wrote to memory of 200	3400	cmd.exe	104
PID 3400 wrote to memory of 200	3400	cmd.exe	104
PID 2756 wrote to memory of 3808	2756	wwxideck.exe	103
PID 2756 wrote to memory of 3808	2756	wwxideck.exe	103
PID 2756 wrote to memory of 3808	2756	wwxideck.exe	103
PID 2756 wrote to memory of 3808	2756	wwxideck.exe	103
PID 2756 wrote to memory of 3808	2756	wwxideck.exe	103

C:\Users\Admin\AppData\Local\Temp\874bcf36482b83f3df470655e985e29b.exe
"C:\Users\Admin\AppData\Local\Temp\874bcf36482b83f3df470655e985e29b.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:496

C:\Users\Admin\AppData\Local\Temp\E47A.exe
C:\Users\Admin\AppData\Local\Temp\E47A.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\88f60da4-d0da-4e37-89b8-c779aa247322" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:2600
- C:\Users\Admin\AppData\Local\Temp\E47A.exe
  "C:\Users\Admin\AppData\Local\Temp\E47A.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\e048c6e3-baae-4250-a06b-05b803d58de9\updatewin.exe
    "C:\Users\Admin\AppData\Local\e048c6e3-baae-4250-a06b-05b803d58de9\updatewin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\SysWOW64\cmd.exe
      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\e048c6e3-baae-4250-a06b-05b803d58de9\updatewin.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        5⤵
        Delays execution with timeout.exe
        
        PID:200
- - C:\Users\Admin\AppData\Local\e048c6e3-baae-4250-a06b-05b803d58de9\5.exe
    "C:\Users\Admin\AppData\Local\e048c6e3-baae-4250-a06b-05b803d58de9\5.exe"
    3⤵
    - Executes dropped EXE
    PID:2504

C:\Users\Admin\AppData\Local\Temp\ED83.exe
C:\Users\Admin\AppData\Local\Temp\ED83.exe
1⤵
- Executes dropped EXE
PID:3644

C:\Users\Admin\AppData\Local\Temp\FB5F.exe
C:\Users\Admin\AppData\Local\Temp\FB5F.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wzkwstev\
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wwxideck.exe" C:\Windows\SysWOW64\wzkwstev\
  2⤵
  PID:1180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wzkwstev binPath= "C:\Windows\SysWOW64\wzkwstev\wwxideck.exe /d\"C:\Users\Admin\AppData\Local\Temp\FB5F.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:2160
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wzkwstev "wifi internet conection"
  2⤵
  PID:2268
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wzkwstev
  2⤵
  PID:2340
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:356

C:\Windows\SysWOW64\wzkwstev\wwxideck.exe
C:\Windows\SysWOW64\wzkwstev\wwxideck.exe /d"C:\Users\Admin\AppData\Local\Temp\FB5F.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3808

C:\Users\Admin\AppData\Local\Temp\161C.exe
C:\Users\Admin\AppData\Local\Temp\161C.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2084

C:\Users\Admin\AppData\Local\Temp\1CB4.exe
C:\Users\Admin\AppData\Local\Temp\1CB4.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:3288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/496-3-0x0000000000950000-0x0000000000959000-memory.dmp

Filesize
36KB

Download
memory/496-2-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/496-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/720-43-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/720-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/720-55-0x0000000002430000-0x0000000002466000-memory.dmp

Filesize
216KB

Download
memory/1312-20-0x0000000001C80000-0x0000000001C81000-memory.dmp

Filesize
4KB

Download
memory/2084-71-0x0000000000400000-0x0000000000BDD000-memory.dmp

Filesize
7.9MB

Download
memory/2084-92-0x0000000003310000-0x000000000333B000-memory.dmp

Filesize
172KB

Download
memory/2084-88-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/2084-87-0x0000000002F10000-0x0000000002F3D000-memory.dmp

Filesize
180KB

Download
memory/2084-89-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2084-90-0x0000000005572000-0x0000000005573000-memory.dmp

Filesize
4KB

Download
memory/2084-73-0x0000000077354000-0x0000000077355000-memory.dmp

Filesize
4KB

Download
memory/2084-74-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/2084-91-0x0000000005573000-0x0000000005574000-memory.dmp

Filesize
4KB

Download
memory/2084-94-0x0000000005574000-0x0000000005576000-memory.dmp

Filesize
8KB

Download
memory/2084-83-0x0000000070DD0000-0x00000000714BE000-memory.dmp

Filesize
6.9MB

Download
memory/2084-93-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/2504-44-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/2504-59-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2504-58-0x0000000002500000-0x0000000002595000-memory.dmp

Filesize
596KB

Download
memory/2504-47-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/2756-78-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/2756-85-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2816-49-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2816-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2816-51-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2816-60-0x0000000000840000-0x0000000000853000-memory.dmp

Filesize
76KB

Download
memory/3016-6-0x0000000000E30000-0x0000000000E46000-memory.dmp

Filesize
88KB

Download
memory/3288-95-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/3288-96-0x00000000008F0000-0x000000000095B000-memory.dmp

Filesize
428KB

Download
memory/3288-97-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3308-12-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3308-10-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/3308-11-0x0000000001AA0000-0x0000000001BBA000-memory.dmp

Filesize
1.1MB

Download
memory/3644-38-0x00000000024C0000-0x0000000002555000-memory.dmp

Filesize
596KB

Download
memory/3644-39-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3644-28-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3808-81-0x0000000002B50000-0x0000000002B65000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads