servhelper | 82285ac0988c68f9b9ecc7649cb9c6a3f3ecb242dd198465dbd4236d7fa6a59c

General

Target

748b112881047820f530c202bb59488e.exe
Size

4.0MB
MD5

748b112881047820f530c202bb59488e
SHA1

edf77f969bf54a47b21e6179cbcabb4651706d7c
SHA256

82285ac0988c68f9b9ecc7649cb9c6a3f3ecb242dd198465dbd4236d7fa6a59c
SHA512

252640d935ce3c7885fa48496b1b9c405f5dc9e719eda9c965d5fec46f877c00a7d96b14acf7410fbef9dbbfa9723932b54cdc75084fdd54e492eaa8d6f37ad6

Score

10^/10

servhelper xmrig backdoor miner persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1164 reg.exe
Runs net.exe

pid	process
1164	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe
3680	powershell.exe
3680	powershell.exe
3680	powershell.exe
3784	powershell.exe
3784	powershell.exe
3784	powershell.exe
1044	powershell.exe
1044	powershell.exe
1044	powershell.exe
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

624

pid	process
624

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	3784	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

748b112881047820f530c202bb59488e.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.exe

description	pid	process	target process
PID 1840 wrote to memory of 3188	1840	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 1840 wrote to memory of 3188	1840	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 1840 wrote to memory of 3188	1840	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 3188 wrote to memory of 648	3188	powershell.exe	csc.exe
PID 3188 wrote to memory of 648	3188	powershell.exe	csc.exe
PID 3188 wrote to memory of 648	3188	powershell.exe	csc.exe
PID 648 wrote to memory of 940	648	csc.exe	cvtres.exe
PID 648 wrote to memory of 940	648	csc.exe	cvtres.exe
PID 648 wrote to memory of 940	648	csc.exe	cvtres.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3784	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3784	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3784	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 1044	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 1044	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 1044	3188	powershell.exe	powershell.exe
PID 3188 wrote to memory of 3980	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 3980	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 3980	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1164	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1164	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1164	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1812	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1812	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 1812	3188	powershell.exe	reg.exe
PID 3188 wrote to memory of 2040	3188	powershell.exe	net.exe
PID 3188 wrote to memory of 2040	3188	powershell.exe	net.exe
PID 3188 wrote to memory of 2040	3188	powershell.exe	net.exe
PID 2040 wrote to memory of 864	2040	net.exe	net1.exe
PID 2040 wrote to memory of 864	2040	net.exe	net1.exe
PID 2040 wrote to memory of 864	2040	net.exe	net1.exe
PID 3188 wrote to memory of 1428	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 1428	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 1428	3188	powershell.exe	cmd.exe
PID 1428 wrote to memory of 640	1428	cmd.exe	cmd.exe
PID 1428 wrote to memory of 640	1428	cmd.exe	cmd.exe
PID 1428 wrote to memory of 640	1428	cmd.exe	cmd.exe
PID 640 wrote to memory of 3112	640	cmd.exe	net.exe
PID 640 wrote to memory of 3112	640	cmd.exe	net.exe
PID 640 wrote to memory of 3112	640	cmd.exe	net.exe
PID 3112 wrote to memory of 2356	3112	net.exe	net1.exe
PID 3112 wrote to memory of 2356	3112	net.exe	net1.exe
PID 3112 wrote to memory of 2356	3112	net.exe	net1.exe
PID 3188 wrote to memory of 656	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 656	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 656	3188	powershell.exe	cmd.exe
PID 656 wrote to memory of 3292	656	cmd.exe	cmd.exe
PID 656 wrote to memory of 3292	656	cmd.exe	cmd.exe
PID 656 wrote to memory of 3292	656	cmd.exe	cmd.exe
PID 3292 wrote to memory of 3160	3292	cmd.exe	net.exe
PID 3292 wrote to memory of 3160	3292	cmd.exe	net.exe
PID 3292 wrote to memory of 3160	3292	cmd.exe	net.exe
PID 3160 wrote to memory of 3508	3160	net.exe	net1.exe
PID 3160 wrote to memory of 3508	3160	net.exe	net1.exe
PID 3160 wrote to memory of 3508	3160	net.exe	net1.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 3680	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 3712	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 3712	3188	powershell.exe	cmd.exe
PID 3188 wrote to memory of 3712	3188	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\748b112881047820f530c202bb59488e.exe
"C:\Users\Admin\AppData\Local\Temp\748b112881047820f530c202bb59488e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zea4ipco\zea4ipco.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14A2.tmp" "c:\Users\Admin\AppData\Local\Temp\zea4ipco\CSC3DC7E20752B24731AA2DA089C7149AA5.TMP"
4⤵
PID:940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:3980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies registry key
PID:1164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:1812

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
4⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\net.exe
net start TermService
5⤵
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:3508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:3680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:3712

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1

T1098

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
f3068198b62b4b70404ec46694d632be

SHA1
7b0b31ae227cf2a78cb751573a9d07f755104ea0

SHA256
bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

SHA512
ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES14A2.tmp
MD5
084ddb1c6737f163e50540ecefc58a13

SHA1
8e0f284bb0dd09c6019ecb926978b736c06c55a6

SHA256
4d13695df14961657d82bed239e007674e5553ecd3a91109bf226734fba4663a

SHA512
0cf33d8b9724336121e422ca79bad387c986daa5c6076e149eb1d040930f087142fff26235ffc1d7031c35512996b4dc0691d21cde397af3eaef120b7ade3fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1
MD5
9cc8773f50008a3bce99c9d5e6cf4635

SHA1
855d5ab66b3d0735e73008659c4a199d4492c8cb

SHA256
d3c9d4a6db3fcee8b9af72fa8cc0b776264357a9f55498852a5e0792aed8603c

SHA512
959ad4270b888ae45fd0ebc12fa2fbb3f695eb26012337dfdf136add2e1bcdcb470266c2fcdb747617dde5eaeb682cf8034f5b5907ff6f17c95135fb0d343d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\zea4ipco\zea4ipco.dll
MD5
61e2da191a1420181a0c6a7624447407

SHA1
4d381f4322dfb38d794682379b05431597dd91d1

SHA256
71f57996319f11749daea57bdf6199d0a5121600277fc3e23ba705d285c94284

SHA512
2c4b3943fbf4aafbd7cfb115d553fec7f15902c734258b54c13bd67ff6841c50980638ec56337b0f20ab49df0897ac757bd90fb7cd2bff07bd19d9df5946a019

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zea4ipco\CSC3DC7E20752B24731AA2DA089C7149AA5.TMP
MD5
7914094daddde29392f7295dc5b22d57

SHA1
434a51b7daeedeff245801e3c72b39a72eca4720

SHA256
1cf98526b529778dad21509bc14f2a4f669aca3e449f15056bf7561438b0069b

SHA512
a2ae83665ff0b59c2faa60658e80376f522ccd69ca73e378cd3d529012f6ab1a02f67e3fdffd9a42d851af69c1560cc69d21e51400767b8f12285d56a544419a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zea4ipco\zea4ipco.0.cs
MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zea4ipco\zea4ipco.cmdline
MD5
3a637a6d4efef754a180e656538430b8

SHA1
b9bc1b5ff604bd766e031afe311c1eea7b7314a8

SHA256
a1c57343e12e1415e863e022a1e4b27e2c45c2c887b4dd2bf5c77ff1da9b6ca4

SHA512
39d7d4a694325546c8eed60cf5fa4a1ebadc800254c519443da0ed22895bace94e93aa4944c51684140e1ae0e9ec3ff5962b8d29faad1ede1fc4de1a36704801

Download Submit
memory/640-1006-0x0000000000000000-mapping.dmp

Download
memory/648-146-0x0000000000000000-mapping.dmp

Download
memory/656-1009-0x0000000000000000-mapping.dmp

Download
memory/864-1002-0x0000000000000000-mapping.dmp

Download
memory/940-149-0x0000000000000000-mapping.dmp

Download
memory/1044-698-0x0000000004812000-0x0000000004813000-memory.dmp

Filesize
4KB

Download
memory/1044-684-0x0000000000000000-mapping.dmp

Download
memory/1044-697-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1044-742-0x000000007EE70000-0x000000007EE71000-memory.dmp

Filesize
4KB

Download
memory/1164-963-0x0000000000000000-mapping.dmp

Download
memory/1428-1005-0x0000000000000000-mapping.dmp

Download
memory/1812-964-0x0000000000000000-mapping.dmp

Download
memory/1840-124-0x0000000007D40000-0x0000000007D41000-memory.dmp

Filesize
4KB

Download
memory/1840-115-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/1840-123-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1840-122-0x0000000000FB4000-0x0000000000FB5000-memory.dmp

Filesize
4KB

Download
memory/1840-121-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/1840-120-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/1840-118-0x0000000000FB2000-0x0000000000FB3000-memory.dmp

Filesize
4KB

Download
memory/1840-119-0x0000000000FB3000-0x0000000000FB4000-memory.dmp

Filesize
4KB

Download
memory/1840-116-0x00000000052E0000-0x00000000056DF000-memory.dmp

Filesize
4.0MB

Download
memory/2040-1001-0x0000000000000000-mapping.dmp

Download
memory/2356-1008-0x0000000000000000-mapping.dmp

Download
memory/3112-1007-0x0000000000000000-mapping.dmp

Download
memory/3160-1011-0x0000000000000000-mapping.dmp

Download
memory/3188-136-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download
memory/3188-132-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/3188-1052-0x000000007EB50000-0x000000007EB51000-memory.dmp

Filesize
4KB

Download
memory/3188-125-0x0000000000000000-mapping.dmp

Download
memory/3188-128-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/3188-129-0x0000000007080000-0x0000000007081000-memory.dmp

Filesize
4KB

Download
memory/3188-130-0x0000000007082000-0x0000000007083000-memory.dmp

Filesize
4KB

Download
memory/3188-131-0x00000000076C0000-0x00000000076C1000-memory.dmp

Filesize
4KB

Download
memory/3188-133-0x0000000007600000-0x0000000007601000-memory.dmp

Filesize
4KB

Download
memory/3188-135-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/3188-137-0x00000000086A0000-0x00000000086A1000-memory.dmp

Filesize
4KB

Download
memory/3188-138-0x0000000008600000-0x0000000008601000-memory.dmp

Filesize
4KB

Download
memory/3188-144-0x0000000009C60000-0x0000000009C61000-memory.dmp

Filesize
4KB

Download
memory/3188-145-0x0000000009320000-0x0000000009321000-memory.dmp

Filesize
4KB

Download
memory/3188-176-0x0000000009610000-0x0000000009611000-memory.dmp

Filesize
4KB

Download
memory/3188-153-0x0000000009280000-0x0000000009281000-memory.dmp

Filesize
4KB

Download
memory/3188-155-0x0000000007083000-0x0000000007084000-memory.dmp

Filesize
4KB

Download
memory/3292-1010-0x0000000000000000-mapping.dmp

Download
memory/3508-1012-0x0000000000000000-mapping.dmp

Download
memory/3680-198-0x0000000009220000-0x0000000009253000-memory.dmp

Filesize
204KB

Download
memory/3680-206-0x0000000009200000-0x0000000009201000-memory.dmp

Filesize
4KB

Download
memory/3680-186-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/3680-412-0x0000000008E70000-0x0000000008E71000-memory.dmp

Filesize
4KB

Download
memory/3680-406-0x0000000009430000-0x0000000009431000-memory.dmp

Filesize
4KB

Download
memory/3680-213-0x0000000009550000-0x0000000009551000-memory.dmp

Filesize
4KB

Download
memory/3680-177-0x0000000000000000-mapping.dmp

Download
memory/3680-212-0x0000000009360000-0x0000000009361000-memory.dmp

Filesize
4KB

Download
memory/3680-211-0x000000007F600000-0x000000007F601000-memory.dmp

Filesize
4KB

Download
memory/3680-1025-0x0000000000000000-mapping.dmp

Download
memory/3680-187-0x00000000052F2000-0x00000000052F3000-memory.dmp

Filesize
4KB

Download
memory/3712-1026-0x0000000000000000-mapping.dmp

Download
memory/3784-441-0x00000000072E0000-0x00000000072E1000-memory.dmp

Filesize
4KB

Download
memory/3784-468-0x000000007F560000-0x000000007F561000-memory.dmp

Filesize
4KB

Download
memory/3784-442-0x00000000072E2000-0x00000000072E3000-memory.dmp

Filesize
4KB

Download
memory/3784-432-0x0000000000000000-mapping.dmp

Download
memory/3980-962-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads