djvu | 973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe

General

Target

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
Size

853KB
MD5

b5bc04503aaeef0eae6bbde03253c6c2
SHA1

80f403dfbd793fa918efa484698493e0cfa0a371
SHA256

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe
SHA512

d9974c2a227465bb6d38d05e78c3de4905ee825bd3149f58b9586f6bfedee3c6fea5dc7ef5a29bde72d1cd6b7ba6d5ac5fe67b7da35e6e360783e0e7b2ce7e04

Score

10^/10

djvu discovery persistence ransomware suricata

Malware Config

Extracted

Family

djvu

C2

http://tzgl.org/fhsgtsspen6/get.php

Attributes

extension
.moia
offline_id
K3PMMX2aWwpnYby88Dzg7tmaIW7Tv0HMWvSyr7t1
payload_url
http://kotob.top/dl/build2.exe
http://tzgl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-rIyEiK9ekc Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0355gSd743d

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2640-116-0x00000000037F0000-0x000000000390B000-memory.dmp	family_djvu
behavioral1/memory/772-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/772-118-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/772-119-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1916-125-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1916-126-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1004 icacls.exe

pid	process
1004	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e3a23f4a-beba-4e61-9aac-e9612e58100b\\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe\" --AutoStart"	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.2ip.ua
17 api.2ip.ua
22 api.2ip.ua

flow	ioc
16	api.2ip.ua
17	api.2ip.ua
22	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

description	pid	process	target process
PID 2640 set thread context of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 set thread context of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

pid	process
772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
1916	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
1916	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
"C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
"C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\e3a23f4a-beba-4e61-9aac-e9612e58100b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1004

C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
"C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224

C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
"C:\Users\Admin\AppData\Local\Temp\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
e15da05c12224abc690b1eb313a20137

SHA1
80f6284e35fa09eda4e69a5a866f052c9077e1f1

SHA256
9708014af393827b1df1614e6d4d99de56f13fbda613e2ead63416a9c2c6e31c

SHA512
4d41f757804943d5344476747024dd94aaa6d414d9b1652f9865927234d40c271a42468cde38c2bd68f6e833783ae8ea93727d2eb9e8c24263673eb8dd6b9937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
2bef96fbf39da6a765ed4d36db41fc5a

SHA1
af8b93b370a8bfd932552f840d54da310b51c071

SHA256
9cf840b96cb69e5c7f2b93630f63e44c20ba7240ce29ffa7e5de6e648c57d3c8

SHA512
a05166997abf2f29a1867f2ed649555eb5b153448087025b0d1a77cc14f78da0052a81bfd44d360731ca8b6520646b0d3e51e8fbbc2e045b990505dd46fa24d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
8fbe3a560f521e86ea2395632a5274bd

SHA1
6bd199189efb6d2a74a9562a8605058935173ac2

SHA256
d86376a92d1cc9dfbc82649a8e17965f3745e7b4e1f4781b5039132b4fd31eee

SHA512
a1dc22fd726b775a90f497c51dcd657da5eed0cac5c4859be778e082327092faef888c826f57cf81a18c39524326193edacd81c9a7b34e379a56d49052739a40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
3cd8eae20d0aa7993c5caf7994ab06a1

SHA1
f7caab4720747d9021d4a7e29388bf2debd60898

SHA256
7293065b29ccab4df9ca641451123828c66725ca6b3495b89c060f456896cd48

SHA512
c1bfb5f8c0028dd83eff7e403be944a09ecd1dad7fd4889a36c2b7e6ba1be9ef2b6f13427d7a2f92eb4893ea91e08bd9ccee2439da26dc81e536cb7d07623576

Download Submit
C:\Users\Admin\AppData\Local\e3a23f4a-beba-4e61-9aac-e9612e58100b\973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
MD5
b5bc04503aaeef0eae6bbde03253c6c2

SHA1
80f403dfbd793fa918efa484698493e0cfa0a371

SHA256
973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe

SHA512
d9974c2a227465bb6d38d05e78c3de4905ee825bd3149f58b9586f6bfedee3c6fea5dc7ef5a29bde72d1cd6b7ba6d5ac5fe67b7da35e6e360783e0e7b2ce7e04

Download Submit
memory/772-118-0x0000000000424141-mapping.dmp

Download
memory/772-119-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/772-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1004-120-0x0000000000000000-mapping.dmp

Download
memory/1916-125-0x0000000000424141-mapping.dmp

Download
memory/1916-126-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2640-115-0x0000000003751000-0x00000000037E3000-memory.dmp

Filesize
584KB

Download
memory/2640-116-0x00000000037F0000-0x000000000390B000-memory.dmp

Filesize
1.1MB

Download
memory/3224-122-0x0000000000000000-mapping.dmp

Download
memory/3224-123-0x000000000365B000-0x00000000036ED000-memory.dmp

Filesize
584KB

Download

description	pid	process	target process
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 2640 wrote to memory of 772	2640	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 772 wrote to memory of 1004	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	icacls.exe
PID 772 wrote to memory of 1004	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	icacls.exe
PID 772 wrote to memory of 1004	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	icacls.exe
PID 772 wrote to memory of 3224	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 772 wrote to memory of 3224	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 772 wrote to memory of 3224	772	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe
PID 3224 wrote to memory of 1916	3224	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe	973b8fb7b2555ddefbf2dc761f64f4ac74d161260f4c24118e6b1e6c04bc9efe.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads