servhelper | 82285ac0988c68f9b9ecc7649cb9c6a3f3ecb242dd198465dbd4236d7fa6a59c

General

Target

748b112881047820f530c202bb59488e.exe
Size

4.0MB
MD5

748b112881047820f530c202bb59488e
SHA1

edf77f969bf54a47b21e6179cbcabb4651706d7c
SHA256

82285ac0988c68f9b9ecc7649cb9c6a3f3ecb242dd198465dbd4236d7fa6a59c
SHA512

252640d935ce3c7885fa48496b1b9c405f5dc9e719eda9c965d5fec46f877c00a7d96b14acf7410fbef9dbbfa9723932b54cdc75084fdd54e492eaa8d6f37ad6

Score

10^/10

servhelper xmrig backdoor miner persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3248 reg.exe
Runs net.exe

pid	process
3248	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
512	powershell.exe
512	powershell.exe
512	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

624

pid	process
624

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

748b112881047820f530c202bb59488e.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.exe

description	pid	process	target process
PID 2412 wrote to memory of 2612	2412	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 2412 wrote to memory of 2612	2412	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 2412 wrote to memory of 2612	2412	748b112881047820f530c202bb59488e.exe	powershell.exe
PID 2612 wrote to memory of 4056	2612	powershell.exe	csc.exe
PID 2612 wrote to memory of 4056	2612	powershell.exe	csc.exe
PID 2612 wrote to memory of 4056	2612	powershell.exe	csc.exe
PID 4056 wrote to memory of 2912	4056	csc.exe	cvtres.exe
PID 4056 wrote to memory of 2912	4056	csc.exe	cvtres.exe
PID 4056 wrote to memory of 2912	4056	csc.exe	cvtres.exe
PID 2612 wrote to memory of 3628	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 3628	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 3628	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 512	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 512	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 512	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 3952	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 3952	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 3952	2612	powershell.exe	powershell.exe
PID 2612 wrote to memory of 640	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 640	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 640	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 3248	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 3248	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 3248	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 1340	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 1340	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 1340	2612	powershell.exe	reg.exe
PID 2612 wrote to memory of 1676	2612	powershell.exe	net.exe
PID 2612 wrote to memory of 1676	2612	powershell.exe	net.exe
PID 2612 wrote to memory of 1676	2612	powershell.exe	net.exe
PID 1676 wrote to memory of 1796	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1796	1676	net.exe	net1.exe
PID 1676 wrote to memory of 1796	1676	net.exe	net1.exe
PID 2612 wrote to memory of 2588	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 2588	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 2588	2612	powershell.exe	cmd.exe
PID 2588 wrote to memory of 3856	2588	cmd.exe	cmd.exe
PID 2588 wrote to memory of 3856	2588	cmd.exe	cmd.exe
PID 2588 wrote to memory of 3856	2588	cmd.exe	cmd.exe
PID 3856 wrote to memory of 2636	3856	cmd.exe	net.exe
PID 3856 wrote to memory of 2636	3856	cmd.exe	net.exe
PID 3856 wrote to memory of 2636	3856	cmd.exe	net.exe
PID 2636 wrote to memory of 3052	2636	net.exe	net1.exe
PID 2636 wrote to memory of 3052	2636	net.exe	net1.exe
PID 2636 wrote to memory of 3052	2636	net.exe	net1.exe
PID 2612 wrote to memory of 2864	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 2864	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 2864	2612	powershell.exe	cmd.exe
PID 2864 wrote to memory of 3836	2864	cmd.exe	cmd.exe
PID 2864 wrote to memory of 3836	2864	cmd.exe	cmd.exe
PID 2864 wrote to memory of 3836	2864	cmd.exe	cmd.exe
PID 3836 wrote to memory of 3840	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3840	3836	cmd.exe	net.exe
PID 3836 wrote to memory of 3840	3836	cmd.exe	net.exe
PID 3840 wrote to memory of 3296	3840	net.exe	net1.exe
PID 3840 wrote to memory of 3296	3840	net.exe	net1.exe
PID 3840 wrote to memory of 3296	3840	net.exe	net1.exe
PID 2612 wrote to memory of 916	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 916	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 916	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 1312	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 1312	2612	powershell.exe	cmd.exe
PID 2612 wrote to memory of 1312	2612	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\748b112881047820f530c202bb59488e.exe
"C:\Users\Admin\AppData\Local\Temp\748b112881047820f530c202bb59488e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wgsr5gx1\wgsr5gx1.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2CB.tmp" "c:\Users\Admin\AppData\Local\Temp\wgsr5gx1\CSC25A62393E6D843C397C3F863D8835D3E.TMP"
4⤵
PID:2912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:640

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies registry key
PID:3248

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:1340

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Windows\SysWOW64\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:3052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
4⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\net.exe
net start TermService
5⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:3296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:1312

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1

T1098

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
f3068198b62b4b70404ec46694d632be

SHA1
7b0b31ae227cf2a78cb751573a9d07f755104ea0

SHA256
bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

SHA512
ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB2CB.tmp
MD5
15d441756e8415b7ee2bf247b572aa20

SHA1
51eb1b89d61f023087718656d62a5e15d4ca8c5d

SHA256
a2481e15d51bab275c0991ef3f4c4291a056dff9af8eda0fd83334997491cc35

SHA512
dfd9061b8f5f909246118858c3e456267de99f808b29c0feae72db437282337cef57dadd4e7c8a4585e49dccfd59a2c784e6bfd198f5224fb4f07a386f3723d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1
MD5
9cc8773f50008a3bce99c9d5e6cf4635

SHA1
855d5ab66b3d0735e73008659c4a199d4492c8cb

SHA256
d3c9d4a6db3fcee8b9af72fa8cc0b776264357a9f55498852a5e0792aed8603c

SHA512
959ad4270b888ae45fd0ebc12fa2fbb3f695eb26012337dfdf136add2e1bcdcb470266c2fcdb747617dde5eaeb682cf8034f5b5907ff6f17c95135fb0d343d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgsr5gx1\wgsr5gx1.dll
MD5
aeb477523fe13853ad37536a8e7e765f

SHA1
cebc4d8a98c1fda175e3658f1390f206032320a1

SHA256
4fdaf3a54355f6ca655a262f35d5195613cd375b65937b343484169e0bd844d7

SHA512
b4748d6322545e34570b9a87b15cb99f1e06e481d6576367f942ca7409d9368fa7bb1cff38de491e83ad2caf64c5a211ccb4c44d55aea95908af1d5ab3b9f59c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wgsr5gx1\CSC25A62393E6D843C397C3F863D8835D3E.TMP
MD5
54d51ab12903069c2df6c18a780d84c2

SHA1
163cf39ab2ad3a9cc942f7848bc64ffd462d2350

SHA256
579ab92cf58173e4f4bd7297de4f0194ee87c9096e85e7346a2a5aee03844c26

SHA512
7167e7945c1b9371cacfa6a8f0481d79b4ec1544683f83a2fac52176bd2549d246ba7ff18d43f5b79993a8fb257af520d002720a59545614dd71ec9607148d29

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wgsr5gx1\wgsr5gx1.0.cs
MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wgsr5gx1\wgsr5gx1.cmdline
MD5
d29b294fcd16202a617f47de773f2038

SHA1
e68df0b544e5edc2f974b61749416b82c6685da6

SHA256
f279b7c634c06923856c7a804e239254da2cccdeb0e9cc46705711cb20835639

SHA512
c5c541bb418567f311e7fbeda3661de1523697b164b82aa5504c52bd74032a484a7db298334ef996fa8e141c725875fcdd75a17efe2ccfe77b9a9d07c3386d7c

Download Submit
memory/512-442-0x0000000006722000-0x0000000006723000-memory.dmp

Filesize
4KB

Download
memory/512-432-0x0000000000000000-mapping.dmp

Download
memory/512-440-0x0000000006720000-0x0000000006721000-memory.dmp

Filesize
4KB

Download
memory/512-467-0x000000007EF60000-0x000000007EF61000-memory.dmp

Filesize
4KB

Download
memory/640-962-0x0000000000000000-mapping.dmp

Download
memory/916-1025-0x0000000000000000-mapping.dmp

Download
memory/1312-1026-0x0000000000000000-mapping.dmp

Download
memory/1340-964-0x0000000000000000-mapping.dmp

Download
memory/1676-1001-0x0000000000000000-mapping.dmp

Download
memory/1796-1002-0x0000000000000000-mapping.dmp

Download
memory/2412-121-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2412-119-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/2412-120-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/2412-123-0x0000000000303000-0x0000000000304000-memory.dmp

Filesize
4KB

Download
memory/2412-118-0x0000000000302000-0x0000000000303000-memory.dmp

Filesize
4KB

Download
memory/2412-117-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2412-122-0x0000000007CE0000-0x0000000007CE1000-memory.dmp

Filesize
4KB

Download
memory/2412-124-0x0000000000304000-0x0000000000305000-memory.dmp

Filesize
4KB

Download
memory/2412-115-0x00000000052A0000-0x000000000569F000-memory.dmp

Filesize
4.0MB

Download
memory/2588-1005-0x0000000000000000-mapping.dmp

Download
memory/2612-131-0x0000000007F80000-0x0000000007F81000-memory.dmp

Filesize
4KB

Download
memory/2612-144-0x0000000009F50000-0x0000000009F51000-memory.dmp

Filesize
4KB

Download
memory/2612-153-0x0000000007460000-0x0000000007461000-memory.dmp

Filesize
4KB

Download
memory/2612-128-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/2612-155-0x0000000005133000-0x0000000005134000-memory.dmp

Filesize
4KB

Download
memory/2612-176-0x0000000009A30000-0x0000000009A31000-memory.dmp

Filesize
4KB

Download
memory/2612-129-0x0000000007800000-0x0000000007801000-memory.dmp

Filesize
4KB

Download
memory/2612-135-0x0000000005132000-0x0000000005133000-memory.dmp

Filesize
4KB

Download
memory/2612-130-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Filesize
4KB

Download
memory/2612-136-0x0000000008050000-0x0000000008051000-memory.dmp

Filesize
4KB

Download
memory/2612-137-0x0000000008A90000-0x0000000008A91000-memory.dmp

Filesize
4KB

Download
memory/2612-138-0x0000000008930000-0x0000000008931000-memory.dmp

Filesize
4KB

Download
memory/2612-133-0x0000000008240000-0x0000000008241000-memory.dmp

Filesize
4KB

Download
memory/2612-134-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/2612-1124-0x000000007ED20000-0x000000007ED21000-memory.dmp

Filesize
4KB

Download
memory/2612-145-0x0000000009670000-0x0000000009671000-memory.dmp

Filesize
4KB

Download
memory/2612-125-0x0000000000000000-mapping.dmp

Download
memory/2636-1007-0x0000000000000000-mapping.dmp

Download
memory/2864-1009-0x0000000000000000-mapping.dmp

Download
memory/2912-149-0x0000000000000000-mapping.dmp

Download
memory/3052-1008-0x0000000000000000-mapping.dmp

Download
memory/3248-963-0x0000000000000000-mapping.dmp

Download
memory/3296-1012-0x0000000000000000-mapping.dmp

Download
memory/3628-177-0x0000000000000000-mapping.dmp

Download
memory/3628-212-0x000000007F090000-0x000000007F091000-memory.dmp

Filesize
4KB

Download
memory/3628-182-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3628-183-0x0000000005092000-0x0000000005093000-memory.dmp

Filesize
4KB

Download
memory/3628-198-0x0000000008CA0000-0x0000000008CD3000-memory.dmp

Filesize
204KB

Download
memory/3628-412-0x0000000008F20000-0x0000000008F21000-memory.dmp

Filesize
4KB

Download
memory/3628-406-0x0000000008F30000-0x0000000008F31000-memory.dmp

Filesize
4KB

Download
memory/3628-213-0x0000000008F90000-0x0000000008F91000-memory.dmp

Filesize
4KB

Download
memory/3628-206-0x0000000008C80000-0x0000000008C81000-memory.dmp

Filesize
4KB

Download
memory/3628-211-0x0000000008DE0000-0x0000000008DE1000-memory.dmp

Filesize
4KB

Download
memory/3836-1010-0x0000000000000000-mapping.dmp

Download
memory/3840-1011-0x0000000000000000-mapping.dmp

Download
memory/3856-1006-0x0000000000000000-mapping.dmp

Download
memory/3952-723-0x000000007F7B0000-0x000000007F7B1000-memory.dmp

Filesize
4KB

Download
memory/3952-683-0x0000000000000000-mapping.dmp

Download
memory/3952-699-0x0000000006C22000-0x0000000006C23000-memory.dmp

Filesize
4KB

Download
memory/3952-698-0x0000000006C20000-0x0000000006C21000-memory.dmp

Filesize
4KB

Download
memory/4056-146-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads