blackmatter | 66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f

General

Target

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Size

78KB
MD5

feed59d9048fdc17962b71f7550388dd
SHA1

b24887db18de6b017687c2aca95cf1ccfa0d8ea3
SHA256

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f
SHA512

4fcd03ec2e73e0ce75774c21db66184bc3eab9128cac1cae9d1487a6bb8461a5641a7c3be590291f561833c22377e2f74c09084b37fda1f4d524b2607b252284

Score

10^/10

blackmatter ransomware

Malware Config

Extracted

Path

C:\1rWCqamCt.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9BEBTCZQN6BQJ94DJXJ >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/9BEBTCZQN6BQJ94DJXJ

Signatures

BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\NewFind.raw => C:\Users\Admin\Pictures\NewFind.raw.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
File opened for modification	C:\Users\Admin\Pictures\NewFind.raw.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
File renamed	C:\Users\Admin\Pictures\RedoImport.crw => C:\Users\Admin\Pictures\RedoImport.crw.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
File opened for modification	C:\Users\Admin\Pictures\RedoImport.crw.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
File renamed	C:\Users\Admin\Pictures\RenameLimit.tif => C:\Users\Admin\Pictures\RenameLimit.tif.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
File opened for modification	C:\Users\Admin\Pictures\RenameLimit.tif.1rWCqamCt	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1rWCqamCt.bmp"	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1rWCqamCt.bmp"	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

pid	process
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 3 IoCs

evasion

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10"	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

Modifies registry class 31 IoCs

Processes:

splwow64.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	splwow64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	splwow64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	splwow64.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	splwow64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	splwow64.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1612 NOTEPAD.EXE

pid	process
1612	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

pid	process
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeDebugPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: 36	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeImpersonatePrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeIncBasePriorityPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeIncreaseQuotaPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: 33	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeManageVolumePrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeProfSingleProcessPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeRestorePrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeSecurityPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeSystemProfilePrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeTakeOwnershipPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeShutdownPrivilege	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
Token: SeBackupPrivilege	1484	vssvc.exe
Token: SeRestorePrivilege	1484	vssvc.exe
Token: SeAuditPrivilege	1484	vssvc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

splwow64.exe

pid process

1780 splwow64.exe
1780 splwow64.exe
1780 splwow64.exe
1780 splwow64.exe
1780 splwow64.exe

pid	process
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe
1780	splwow64.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exeNOTEPAD.EXE

description	pid	process	target process
PID 984 wrote to memory of 1612	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe	NOTEPAD.EXE
PID 984 wrote to memory of 1612	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe	NOTEPAD.EXE
PID 984 wrote to memory of 1612	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe	NOTEPAD.EXE
PID 984 wrote to memory of 1612	984	66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe	NOTEPAD.EXE
PID 1612 wrote to memory of 1780	1612	NOTEPAD.EXE	splwow64.exe
PID 1612 wrote to memory of 1780	1612	NOTEPAD.EXE	splwow64.exe
PID 1612 wrote to memory of 1780	1612	NOTEPAD.EXE	splwow64.exe
PID 1612 wrote to memory of 1780	1612	NOTEPAD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe
"C:\Users\Admin\AppData\Local\Temp\66e6563ecef8f33b1b283a63404a2029550af9a6574b84e0fb3f2c6a8f42e89f.exe"
1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" /p C:\1rWCqamCt.README.txt
2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1rWCqamCt.README.txt
MD5
07f76e653f6d78ad8ec2fee0af5f8fd4

SHA1
4c1624e7ed2ec95e967816b44d7232aefcdf3ff5

SHA256
a44c657f4da66a742f2615c445b457589d658a806ce6d01dc37f183a601cbea3

SHA512
695f89acdcb645dea20f22c1e1a8a0ed00f7b4c76cffffb85057144ed67f124985b2eb73719429454f11944daa94e8927e314b1a5ce1b384cace59845f7caebf

Download Submit
C:\Users\Admin\Documents\GetSuspend.xps.1rWCqamCt
MD5
64ab1ac423ee8bbd47b5f6a954db7157

SHA1
08ae67e8de63841abef7a32db7b249b29550a3df

SHA256
31e3e1e72605f7a8880078790bee420ac557fc03c7c191a253092ce29b56fdca

SHA512
770f42a0efe8c8494971b9b65addfc49aeef2056db5aed5897c3e221bd4a756aea1babc0648b4d9b51fef03d3498b8cad6c545bca73b624c00925e21c9f5cf37

Download Submit
C:\Users\Admin\Documents\UnprotectCopy.xps.1rWCqamCt
MD5
7485a44bccd5f6773a11638eafe14b4f

SHA1
2ea6a68414cd61f52a376d61d0261e73a403f240

SHA256
f9b58c5911af1b5b6244306b9c1dd9801e5edf3aceb8e4ec891c9f828be1ad7d

SHA512
6e3bcb76e62a32ff339df78bb322af4d68a4cac4c3e7fcf08eb25ae7a34a1fcbefc9138efb64014a928d07da40f0de8012f27b9b3e0059281a2cea95441d463f

Download Submit
memory/984-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/984-62-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/984-61-0x0000000001D95000-0x0000000001DA6000-memory.dmp

Filesize
68KB

Download
memory/984-63-0x0000000001DA6000-0x0000000001DA7000-memory.dmp

Filesize
4KB

Download
memory/1612-64-0x0000000000000000-mapping.dmp

Download
memory/1780-67-0x0000000000000000-mapping.dmp

Download
memory/1780-68-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1780-69-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads