ramnit | ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37

General

Target

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
Size

355KB
MD5

b04f67e5770cdf247ee3f6312a1036d8
SHA1

1224c2590382c68c8a2d6a5f60649db1e4cdb958
SHA256

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37
SHA512

fddb000825716688d9610b72ac144ccc5bea69b13a086f4da3ed13908c63f9dab1e050b0fd0d3a8d58bb7d338849b6625f5b0905a3f4ef324297c15ee20c0667

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe

pid process

1740 ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe

pid	process
1740	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe	upx
C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe	upx
behavioral1/memory/1740-66-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

pid process

1472 ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

Drops file in Program Files directory 3 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px5551.tmp	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

pid process

1472 ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

pid	process
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

description pid process

Token: SeDebugPrivilege 1472 ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

description	pid	process
Token: SeDebugPrivilege	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe

description	pid	process	target process
PID 1472 wrote to memory of 1740	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
PID 1472 wrote to memory of 1740	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
PID 1472 wrote to memory of 1740	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
PID 1472 wrote to memory of 1740	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 380	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	wininit.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 388	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	csrss.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 420	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	winlogon.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 472	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	services.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 488	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsass.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 496	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	lsm.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 592	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 668	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 736	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 736	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 736	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe
PID 1472 wrote to memory of 736	1472	ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:488

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:592

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1108

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1096

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:876

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:496

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe
"C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1740

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
\Users\Admin\AppData\Local\Temp\ab147a1987b15dbd897ee3f13eac610cb5a1edd445c08a669f16eefa632ecb37Srv.exe
MD5
d8ce8e59dc1b438493939ab9753807d0

SHA1
fa3ec7549a6f496749762cbed1038a2cb1951dca

SHA256
61c6b349fe8f639b7d9d56a81b005a2f86b05c5cad20225ff6ba3aa24e592c24

SHA512
7ff83c93e3b9f17a2fae2a14a5a0ddfc498cc3d7cec5dffda45936383b3c2c2ee2aa62719b2165d74b1bf676a71b55191e45702b576cc059fa6af24ba74ae954

Download Submit
memory/1472-59-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1472-68-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1740-61-0x0000000000000000-mapping.dmp

Download
memory/1740-67-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

Filesize
48KB

Download
memory/1740-66-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1740-65-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads