njrat | 6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df

General

Target

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
Size

2.3MB
MD5

751be7e898d61998e52402b813e391bf
SHA1

6b8572889dbac9938e8552f05bf57496b6ab0367
SHA256

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df
SHA512

baa23385c716c6fc682fad2ba963b55c957101d7545143c804b5a846b4bba1fa64761e26e77f225f56961fc63cc956023173ea9cd558c08f31b31541a88ab84e

Score

10^/10

njrat suricata trojan upx

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 4 IoCs

Processes:

LastFudCy.exeLastFudCy.exeLastFudCy.exeLastFudCy.exe

pid process

2472 LastFudCy.exe
3176 LastFudCy.exe
3488 LastFudCy.exe
3124 LastFudCy.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3124-121-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/3124-131-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exeLastFudCy.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\advpack.url	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RAVBg64.url	LastFudCy.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

LastFudCy.exe6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe

description	pid	process	target process
PID 2472 set thread context of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 1864 set thread context of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe

autoit_exe 5 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

LastFudCy.exe6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe

pid	process
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe
Token: 33	3696	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3696	RegSvcs.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exeLastFudCy.exe

pid	process
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exeLastFudCy.exe

pid	process
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
2472	LastFudCy.exe
2472	LastFudCy.exe
2472	LastFudCy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LastFudCy.exe

pid process

3124 LastFudCy.exe

pid	process
3124	LastFudCy.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exeLastFudCy.exe

description	pid	process	target process
PID 1864 wrote to memory of 2472	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	LastFudCy.exe
PID 1864 wrote to memory of 2472	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	LastFudCy.exe
PID 1864 wrote to memory of 2472	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	LastFudCy.exe
PID 2472 wrote to memory of 3176	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3176	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3176	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3488	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3488	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3488	2472	LastFudCy.exe	LastFudCy.exe
PID 1864 wrote to memory of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe
PID 1864 wrote to memory of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe
PID 1864 wrote to memory of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe
PID 1864 wrote to memory of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe
PID 2472 wrote to memory of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 2472 wrote to memory of 3124	2472	LastFudCy.exe	LastFudCy.exe
PID 1864 wrote to memory of 3696	1864	6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe
"C:\Users\Admin\AppData\Local\Temp\6d2f1a98b77181cb675c0f3cd3ae6824fdd90e150c46d6fcee0ed16f7cd855df.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
"C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
"C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe"
3⤵
- Executes dropped EXE
PID:3176

C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
"C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe"
3⤵
- Executes dropped EXE
PID:3488

C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
"C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3124

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
MD5
0a236522a4053835ac2093099e535fcb

SHA1
3f039b58ff3db3f597cff65e9dcaa80b15fee28c

SHA256
1ea5ebe3eac08648aa427c9a864e9c98407366981c6547281e134573c86074d7

SHA512
2972be7422a82030e9dde987233cd1d1db8516c28c410c8c03d38acb68d9783a5bd6aa93f182129b0830223523b95633c1f3eee9869bd779bbd7b8de2ff9472f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
MD5
0a236522a4053835ac2093099e535fcb

SHA1
3f039b58ff3db3f597cff65e9dcaa80b15fee28c

SHA256
1ea5ebe3eac08648aa427c9a864e9c98407366981c6547281e134573c86074d7

SHA512
2972be7422a82030e9dde987233cd1d1db8516c28c410c8c03d38acb68d9783a5bd6aa93f182129b0830223523b95633c1f3eee9869bd779bbd7b8de2ff9472f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
MD5
0a236522a4053835ac2093099e535fcb

SHA1
3f039b58ff3db3f597cff65e9dcaa80b15fee28c

SHA256
1ea5ebe3eac08648aa427c9a864e9c98407366981c6547281e134573c86074d7

SHA512
2972be7422a82030e9dde987233cd1d1db8516c28c410c8c03d38acb68d9783a5bd6aa93f182129b0830223523b95633c1f3eee9869bd779bbd7b8de2ff9472f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
MD5
0a236522a4053835ac2093099e535fcb

SHA1
3f039b58ff3db3f597cff65e9dcaa80b15fee28c

SHA256
1ea5ebe3eac08648aa427c9a864e9c98407366981c6547281e134573c86074d7

SHA512
2972be7422a82030e9dde987233cd1d1db8516c28c410c8c03d38acb68d9783a5bd6aa93f182129b0830223523b95633c1f3eee9869bd779bbd7b8de2ff9472f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LastFudCy.exe
MD5
0a236522a4053835ac2093099e535fcb

SHA1
3f039b58ff3db3f597cff65e9dcaa80b15fee28c

SHA256
1ea5ebe3eac08648aa427c9a864e9c98407366981c6547281e134573c86074d7

SHA512
2972be7422a82030e9dde987233cd1d1db8516c28c410c8c03d38acb68d9783a5bd6aa93f182129b0830223523b95633c1f3eee9869bd779bbd7b8de2ff9472f

Download Submit
memory/2472-115-0x0000000000000000-mapping.dmp

Download
memory/2472-130-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/3124-121-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3124-125-0x0000000000423390-mapping.dmp

Download
memory/3124-131-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3696-155-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-160-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-133-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-135-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-137-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-140-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-141-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-143-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-144-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-145-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-148-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-147-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-149-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-150-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-154-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-120-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-156-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-153-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/3696-157-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-158-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-129-0x000000000042A08E-mapping.dmp

Download
memory/3696-159-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-161-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-162-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-163-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-164-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-166-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-165-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-168-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-169-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-170-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-171-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-172-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-173-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-174-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-175-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-176-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-177-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-178-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-179-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-180-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-181-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-182-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-183-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-184-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-185-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-186-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-187-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-188-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3696-189-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

pid	process
2472	LastFudCy.exe
3176	LastFudCy.exe
3488	LastFudCy.exe
3124	LastFudCy.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads