ramnit | 562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef

General

Target

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
Size

1.7MB
MD5

a975d2b0d2e26f4fcf6d9f8be249318d
SHA1

c88688c1e23dfe20b6f82eb45b35995834d56e95
SHA256

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef
SHA512

6559492f58cc31c71e3c49905a5b26d19cd078935d91ba7f88f0ee2504618119b93b65e62469e2a1dc684bbf15c341222224b7a671a11bc48c8cab1544432af0

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exeDesktopLayer.exe

pid process

1256 562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
1480 DesktopLayer.exe

pid	process
1256	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
1480	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe	upx
behavioral2/memory/1256-124-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe

pid	process
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe

Drops file in Program Files directory 3 IoCs

Processes:

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px2792.tmp	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886248"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327882515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886248"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886248"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B80B530-B55B-11EB-A11C-E62B3DD6123B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "811408401"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327833930"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "811408401"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "816253258"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327850523"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid	process
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe
1480	DesktopLayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1828 iexplore.exe

pid	process
1828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exeiexplore.exeIEXPLORE.EXE

pid	process
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
1828	iexplore.exe
1828	iexplore.exe
3996	IEXPLORE.EXE
3996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 3680 wrote to memory of 1256	3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
PID 3680 wrote to memory of 1256	3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
PID 3680 wrote to memory of 1256	3680	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
PID 1256 wrote to memory of 1480	1256	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe	DesktopLayer.exe
PID 1256 wrote to memory of 1480	1256	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe	DesktopLayer.exe
PID 1256 wrote to memory of 1480	1256	562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe	DesktopLayer.exe
PID 1480 wrote to memory of 1828	1480	DesktopLayer.exe	iexplore.exe
PID 1480 wrote to memory of 1828	1480	DesktopLayer.exe	iexplore.exe
PID 1828 wrote to memory of 3996	1828	iexplore.exe	IEXPLORE.EXE
PID 1828 wrote to memory of 3996	1828	iexplore.exe	IEXPLORE.EXE
PID 1828 wrote to memory of 3996	1828	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe
"C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cef.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680

C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:82945 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
57010df1ded674ce061f8af29a2e6fbb

SHA1
83e50ef272059dc3fab93e694d5e220dc48bf0c4

SHA256
68492169f14b36562d813f4ae7506f4b324b85f0e6aec352a37faba29b289616

SHA512
211ecb686dec8e8dd57cc8aeebdb8953f81aa56eebec9b463df4d41d98942317ed001ae5ffc9cc0c3ce5c542317cd0838447b885016697411b99f68190bd430b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
3739d8e2e791e462a87070cabf25b4d6

SHA1
464b7f716e3e03ba43917645de9a4d95278ac5b9

SHA256
a1f5649be811e10b078447e9c58b975849cf8c47c704e9648843601b8a3ed90f

SHA512
cb17c35ed4d9e7ecc2a34caf32ae450033172580f7ced8d813b6097330ba9e03f0b47054f762d58f82b0cc40c53657cc6bc2ea1ce97298a57b72790607a7d3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JDQ034IR.cookie
MD5
03335362744445f30b3cb98f55ea0d4a

SHA1
7a7ac9e2206a422126fad8cd975788cb5252902f

SHA256
7e2c9155400424fb698dae630fde9bbf1fca542d7d8e6517adad531ce60e9fd9

SHA512
1f4c4725c042cde364d81e834dd828641624b3133e011ddbab225c1dfcc089015cafb54476cd9ed02ef4c9b6851393f2f468503e7f16ae47d44ce1d27cf9f2bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\VR2SS0YB.cookie
MD5
c2c90f512002b916166d978359ae912a

SHA1
fae7e21a40cdf0a975e13add38d6ba884cd7460a

SHA256
6b20180bad23063fe348353aa615c695e9d1d7a523509a76a51b5ffb529d4af3

SHA512
eff1138fd7fb32ecf364989f157054196be36fd0379e75b3782c0bd416f2d5b31e2d9d6641dd903ad2cffdb6e517f2ec3352e831660a95e75e22733cd6228578

Download Submit
C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\562f7ea89d02b702bd9d4c890fa087bafcb6b6650c05a8883661e59d7e9e9cefSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/1256-123-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/1256-114-0x0000000000000000-mapping.dmp

Download
memory/1256-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1480-120-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1480-117-0x0000000000000000-mapping.dmp

Download
memory/1828-125-0x00007FF891510000-0x00007FF89157B000-memory.dmp

Filesize
428KB

Download
memory/1828-122-0x0000000000000000-mapping.dmp

Download
memory/3680-121-0x0000000000400000-0x00000000008E0000-memory.dmp

Filesize
4.9MB

Download
memory/3680-126-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3996-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads