djvu | 8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08

General

Target

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
Size

854KB
MD5

0234906bd8c79cc6ada2772c00620879
SHA1

f7d456fec5c1b14ba4b7ff37401b1993ef692e6d
SHA256

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08
SHA512

ef4282941ebff2b40b0071f22d3e51ef669f95c0f9388f9c132ef83d937882d10681a74f91c3a1c4fd2d33a53472d0a459d253ea88a077f776382b2b9aaa3a63

Score

10^/10

djvu discovery persistence ransomware suricata

Malware Config

Extracted

Family

djvu

C2

http://pqkl.org/fhsgtsspen6/get.php

Attributes

extension
.qdla
offline_id
mGOVYjwKN5zpBZyRsr2Nqza9xnxDzO1NGhAl47t1
payload_url
http://kotob.top/dl/build2.exe
http://pqkl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-W7mpKFSSv2 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0347gSd743d

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/820-120-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/820-119-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4088-121-0x0000000004880000-0x000000000499B000-memory.dmp	family_djvu
behavioral1/memory/820-124-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/800-128-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/800-129-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3852 icacls.exe

pid	process
3852	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\fe2a5342-1622-4196-b02b-e08b84bbd1e6\\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe\" --AutoStart"	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.2ip.ua
23 api.2ip.ua
28 api.2ip.ua

flow	ioc
22	api.2ip.ua
23	api.2ip.ua
28	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

description	pid	process	target process
PID 4088 set thread context of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 set thread context of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

pid	process
820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
800	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
800	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
"C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
"C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\fe2a5342-1622-4196-b02b-e08b84bbd1e6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3852

C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
"C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
"C:\Users\Admin\AppData\Local\Temp\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
d8ec7917c33f103a7288af33cae7de14

SHA1
285babb225e06e84a4050f140d21970ecd9d39ee

SHA256
467d7ceb2f929daba1e910064fad42123bb2ecd65f57423900bb3777e88b7e89

SHA512
9accf32dbfd9260dbfee95982c6487882828f86f3e090f598d6f426760c093886ba68ec664b7db942027320c1eb95029c45c98ea139308a491d0b15dab6aad79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
026c2a59b797991b8379df56c6ea513a

SHA1
266a2e055410708de4db7e704b4ed449006a1f2b

SHA256
21ed5e42cf0d63dffeb9e5d3711e6b760f84d8c8c1715d5f8bf9ea047a1dbabe

SHA512
809116817fd88a722ccaa7703a850e103e034aa20b351f50f5b29ee198352568a6aa06cd78b75c19e03757230d30058366f3c25aa043c02d9f7d5301f457cb80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
f00c2b4bf786c0d6b13eb366c22e7bc4

SHA1
973a5037a282b96e7680f11e128565fc48456e25

SHA256
1b66f275d87f088e8ff39ffd00f332829aaaae9b37e310596e96a0eb511bd4ad

SHA512
51e1c542335f6778431ab025196a042a45645a37f9d5a20c7405ec4a0dc04c5da1263c6fa99b4548cf1f79251d0aeece34124870dd9227400c929e6bbcd5ace8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
071bfe264706744dfab2bf5005a291c6

SHA1
2461a132440fe99e36b970e4a91975733d8cf93e

SHA256
ecdf82cb9fa06753ba5472b4b3595e0f562c8803bd56b2f5610648727c88361c

SHA512
d06bce698c5bc94ad4b1f26e01afd02a8ea4956e7f6dad18331c42cbd3f205f1815f5a410594e0dc7f027d140c25d9c78871e1e38316a1da1cb385970dc9b919

Download Submit
C:\Users\Admin\AppData\Local\fe2a5342-1622-4196-b02b-e08b84bbd1e6\8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
MD5
0234906bd8c79cc6ada2772c00620879

SHA1
f7d456fec5c1b14ba4b7ff37401b1993ef692e6d

SHA256
8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08

SHA512
ef4282941ebff2b40b0071f22d3e51ef669f95c0f9388f9c132ef83d937882d10681a74f91c3a1c4fd2d33a53472d0a459d253ea88a077f776382b2b9aaa3a63

Download Submit
memory/756-125-0x0000000000000000-mapping.dmp

Download
memory/756-126-0x0000000002E54000-0x0000000002EE5000-memory.dmp

Filesize
580KB

Download
memory/800-128-0x0000000000424141-mapping.dmp

Download
memory/800-129-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/820-124-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/820-119-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/820-120-0x0000000000424141-mapping.dmp

Download
memory/3852-122-0x0000000000000000-mapping.dmp

Download
memory/4088-118-0x00000000047EC000-0x000000000487D000-memory.dmp

Filesize
580KB

Download
memory/4088-121-0x0000000004880000-0x000000000499B000-memory.dmp

Filesize
1.1MB

Download

description	pid	process	target process
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 4088 wrote to memory of 820	4088	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 820 wrote to memory of 3852	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	icacls.exe
PID 820 wrote to memory of 3852	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	icacls.exe
PID 820 wrote to memory of 3852	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	icacls.exe
PID 820 wrote to memory of 756	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 820 wrote to memory of 756	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 820 wrote to memory of 756	820	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe
PID 756 wrote to memory of 800	756	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe	8c16365aa9c6c8b6cc03f6c01b60e680ada1f2cb5ab840df2c0ae1c305071f08.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads