agenttesla | 0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046

General

Target

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Size

274KB
MD5

78d10b686503f8b21b0fa517e17fa39e
SHA1

3b2f329b207365d4d1eb69a75bb9a43ae5bf3c12
SHA256

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046
SHA512

d3924caee3cb5e962703f019edd2c14dfc82360e882c67af38181bbdabadd53843cc41507f13eee64d9ddcff729f466531efcfa80f39922fc8c731a4b6a10737

Score

10^/10

agenttesla lokibot collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

lokibot

C2

http://iykl.xyz/Spartan3/w2/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.suissajoiers.com
Port:
587
Username:
[email protected]
Password:
suissajoiers.

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\OGUnWq6.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\OGUnWq6.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\vB1GO3F.exe	family_agenttesla
C:\Users\Admin\AppData\Roaming\vB1GO3F.exe	family_agenttesla

Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

uxZ4z3u.exeOGUnWq6.exevB1GO3F.exe

pid process

1284 uxZ4z3u.exe
1488 OGUnWq6.exe
1804 vB1GO3F.exe

pid	process
1284	uxZ4z3u.exe
1488	OGUnWq6.exe
1804	vB1GO3F.exe

Drops startup file 2 IoCs

Processes:

PowerShell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%	PowerShell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%	PowerShell.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs

collection

Email Collection

T1114

Processes:

uxZ4z3u.exeOGUnWq6.exevB1GO3F.exe0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	uxZ4z3u.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OGUnWq6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	uxZ4z3u.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	uxZ4z3u.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OGUnWq6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OGUnWq6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vB1GO3F.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vB1GO3F.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vB1GO3F.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

description	pid	process	target process
PID 3320 set thread context of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

PowerShell.exeuxZ4z3u.exeOGUnWq6.exevB1GO3F.exe

pid	process
3508	PowerShell.exe
3508	PowerShell.exe
3508	PowerShell.exe
1284	uxZ4z3u.exe
1284	uxZ4z3u.exe
1488	OGUnWq6.exe
1488	OGUnWq6.exe
1804	vB1GO3F.exe
1804	vB1GO3F.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

pid process

364 0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

OGUnWq6.exevB1GO3F.exe

pid process

1488 OGUnWq6.exe
1804 vB1GO3F.exe

pid	process
364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

pid	process
1488	OGUnWq6.exe
1804	vB1GO3F.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

PowerShell.exe0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exeuxZ4z3u.exeOGUnWq6.exevB1GO3F.exe

description	pid	process
Token: SeDebugPrivilege	3508	PowerShell.exe
Token: SeDebugPrivilege	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Token: SeDebugPrivilege	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
Token: SeDebugPrivilege	1284	uxZ4z3u.exe
Token: SeDebugPrivilege	1488	OGUnWq6.exe
Token: SeDebugPrivilege	1804	vB1GO3F.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

OGUnWq6.exevB1GO3F.exeuxZ4z3u.exe

pid process

1488 OGUnWq6.exe
1804 vB1GO3F.exe
1284 uxZ4z3u.exe

pid	process
1488	OGUnWq6.exe
1804	vB1GO3F.exe
1284	uxZ4z3u.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe

description	pid	process	target process
PID 3320 wrote to memory of 3508	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	PowerShell.exe
PID 3320 wrote to memory of 3508	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	PowerShell.exe
PID 3320 wrote to memory of 3508	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	PowerShell.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 3320 wrote to memory of 364	3320	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
PID 364 wrote to memory of 1284	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	uxZ4z3u.exe
PID 364 wrote to memory of 1284	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	uxZ4z3u.exe
PID 364 wrote to memory of 1284	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	uxZ4z3u.exe
PID 364 wrote to memory of 1488	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	OGUnWq6.exe
PID 364 wrote to memory of 1488	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	OGUnWq6.exe
PID 364 wrote to memory of 1488	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	OGUnWq6.exe
PID 364 wrote to memory of 1804	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	vB1GO3F.exe
PID 364 wrote to memory of 1804	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	vB1GO3F.exe
PID 364 wrote to memory of 1804	364	0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe	vB1GO3F.exe

outlook_office_path 1 IoCs

Processes:

uxZ4z3u.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	uxZ4z3u.exe

outlook_win_path 1 IoCs

Processes:

uxZ4z3u.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	uxZ4z3u.exe

C:\Users\Admin\AppData\Local\Temp\0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
"C:\Users\Admin\AppData\Local\Temp\0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Users\Admin\AppData\Local\Temp\0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe
"C:\Users\Admin\AppData\Local\Temp\0ec2ceee372761b8ea8d21d37d8bd859b8ffaaf0faec999dda54e5bfb2dfe046.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe
"C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1284

C:\Users\Admin\AppData\Roaming\OGUnWq6.exe
"C:\Users\Admin\AppData\Roaming\OGUnWq6.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Users\Admin\AppData\Roaming\vB1GO3F.exe
"C:\Users\Admin\AppData\Roaming\vB1GO3F.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\OGUnWq6.exe
MD5
ff6a62c5f7b65a3c8a193dad5705c563

SHA1
270d74889562149eefc3870137919ecfb57f5762

SHA256
3bd5ed099801c09edb997b5513673854e87db3e1e4f92cf8f01e97a588254aca

SHA512
990da579e23008710a6f0586e0d9b7752d66337103d5b57c44ce473e73190a2656016ed3db27084c011fdfebdc034c0dd018580c3debbae55455bcaa976b2a21

Download Submit
C:\Users\Admin\AppData\Roaming\OGUnWq6.exe
MD5
ff6a62c5f7b65a3c8a193dad5705c563

SHA1
270d74889562149eefc3870137919ecfb57f5762

SHA256
3bd5ed099801c09edb997b5513673854e87db3e1e4f92cf8f01e97a588254aca

SHA512
990da579e23008710a6f0586e0d9b7752d66337103d5b57c44ce473e73190a2656016ed3db27084c011fdfebdc034c0dd018580c3debbae55455bcaa976b2a21

Download Submit
C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe
MD5
11b360256d049349f51a67e92fd49ae4

SHA1
550bd52a6f33a0e083dbb6a5d4e442f5a0fb946a

SHA256
2ee8012f04eaf2b32b84a2608959935479823b5f9878b48df44ca3605c98919b

SHA512
5c38aa791c1348693713ee48d4fd2b2a944a1c850f575d9ec37a6e1a1c024fc3afb367fa287b6d049809a02538786658499aef1d910675ccf39e892215ee6888

Download Submit
C:\Users\Admin\AppData\Roaming\uxZ4z3u.exe
MD5
11b360256d049349f51a67e92fd49ae4

SHA1
550bd52a6f33a0e083dbb6a5d4e442f5a0fb946a

SHA256
2ee8012f04eaf2b32b84a2608959935479823b5f9878b48df44ca3605c98919b

SHA512
5c38aa791c1348693713ee48d4fd2b2a944a1c850f575d9ec37a6e1a1c024fc3afb367fa287b6d049809a02538786658499aef1d910675ccf39e892215ee6888

Download Submit
C:\Users\Admin\AppData\Roaming\vB1GO3F.exe
MD5
ff6a62c5f7b65a3c8a193dad5705c563

SHA1
270d74889562149eefc3870137919ecfb57f5762

SHA256
3bd5ed099801c09edb997b5513673854e87db3e1e4f92cf8f01e97a588254aca

SHA512
990da579e23008710a6f0586e0d9b7752d66337103d5b57c44ce473e73190a2656016ed3db27084c011fdfebdc034c0dd018580c3debbae55455bcaa976b2a21

Download Submit
C:\Users\Admin\AppData\Roaming\vB1GO3F.exe
MD5
ff6a62c5f7b65a3c8a193dad5705c563

SHA1
270d74889562149eefc3870137919ecfb57f5762

SHA256
3bd5ed099801c09edb997b5513673854e87db3e1e4f92cf8f01e97a588254aca

SHA512
990da579e23008710a6f0586e0d9b7752d66337103d5b57c44ce473e73190a2656016ed3db27084c011fdfebdc034c0dd018580c3debbae55455bcaa976b2a21

Download Submit
memory/364-145-0x00000000004139DE-mapping.dmp

Download
memory/364-148-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/364-144-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1284-180-0x0000000001380000-0x000000000142E000-memory.dmp

Filesize
696KB

Download
memory/1284-165-0x0000000001380000-0x000000000142E000-memory.dmp

Filesize
696KB

Download
memory/1284-173-0x0000000001380000-0x000000000142E000-memory.dmp

Filesize
696KB

Download
memory/1284-149-0x0000000000000000-mapping.dmp

Download
memory/1488-155-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/1488-152-0x0000000000000000-mapping.dmp

Download
memory/1488-176-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/1488-178-0x0000000005520000-0x0000000005A1E000-memory.dmp

Filesize
5.0MB

Download
memory/1488-174-0x00000000065E0000-0x00000000065E1000-memory.dmp

Filesize
4KB

Download
memory/1488-166-0x0000000005520000-0x0000000005A1E000-memory.dmp

Filesize
5.0MB

Download
memory/1488-169-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/1804-158-0x0000000000000000-mapping.dmp

Download
memory/1804-179-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/1804-168-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/3320-115-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/3320-117-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/3320-143-0x0000000005820000-0x0000000005835000-memory.dmp

Filesize
84KB

Download
memory/3320-118-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Filesize
4KB

Download
memory/3320-147-0x00000000058E0000-0x0000000005DDE000-memory.dmp

Filesize
5.0MB

Download
memory/3320-146-0x00000000058E0000-0x0000000005DDE000-memory.dmp

Filesize
5.0MB

Download
memory/3508-127-0x0000000007A60000-0x0000000007A61000-memory.dmp

Filesize
4KB

Download
memory/3508-125-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/3508-131-0x0000000008010000-0x0000000008011000-memory.dmp

Filesize
4KB

Download
memory/3508-130-0x0000000007800000-0x0000000007801000-memory.dmp

Filesize
4KB

Download
memory/3508-129-0x0000000000B32000-0x0000000000B33000-memory.dmp

Filesize
4KB

Download
memory/3508-128-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/3508-141-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3508-133-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3508-126-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3508-132-0x0000000008160000-0x0000000008161000-memory.dmp

Filesize
4KB

Download
memory/3508-124-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/3508-123-0x00000000070A0000-0x00000000070A1000-memory.dmp

Filesize
4KB

Download
memory/3508-137-0x0000000008EA0000-0x0000000008EA1000-memory.dmp

Filesize
4KB

Download
memory/3508-122-0x0000000004600000-0x0000000004601000-memory.dmp

Filesize
4KB

Download
memory/3508-121-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3508-120-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/3508-119-0x0000000000000000-mapping.dmp

Download
memory/3508-138-0x0000000008E00000-0x0000000008E01000-memory.dmp

Filesize
4KB

Download
memory/3508-139-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download
memory/3508-142-0x0000000000B33000-0x0000000000B34000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads