djvu | 575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45

General

Target

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
Size

826KB
MD5

9036ae5ba754bdacf08a02401473d338
SHA1

615df36cf7e06a853d170d7a68c6b652e8cc7688
SHA256

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45
SHA512

30b2861d10c65fdc7884b3a42e1836209f0b2d2c69ab826708944a609faf3e9a59d9ac0164144fdea4affb19168017e1dd9e8af410fa57f964c72e82133094d6

Score

10^/10

djvu discovery persistence ransomware suricata

Malware Config

Extracted

Family

djvu

C2

http://tzgl.org/fhsgtsspen6/get.php

Attributes

extension
.wnlu
offline_id
gYuqQ5GsAaJom08TivUVhlPzZDKd916x4NcXrWt1
payload_url
http://kotob.top/dl/build2.exe

http://tzgl.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-m8LBBi8x8F Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0357Sigrj

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2716-116-0x00000000021C0000-0x00000000022DB000-memory.dmp	family_djvu
behavioral1/memory/3684-118-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/3684-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3684-119-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1248-125-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1248-130-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3376 icacls.exe

pid	process
3376	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\eadaf380-f65a-4b96-8c5e-af48950a141b\\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe\" --AutoStart"	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.2ip.ua
11 api.2ip.ua
28 api.2ip.ua

flow	ioc
10	api.2ip.ua
11	api.2ip.ua
28	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

description	pid	process	target process
PID 2716 set thread context of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 set thread context of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

pid	process
3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
1248	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
1248	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
"C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
  "C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\eadaf380-f65a-4b96-8c5e-af48950a141b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3376
- - C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
    "C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
      "C:\Users\Admin\AppData\Local\Temp\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5
1c63500df0b57e29edd1a5867d9f0e9b

SHA1
0475a0611ac4d171e90b46303b96317fc186b15d

SHA256
c8f7c1bd12b80996707a806866379d91dc3008d5d2b0eeeb6d97d418aeeb7914

SHA512
29b914ffe63496d98e8ffb76afde49702888743c88bd0fc6aabdf3e8855e3a5389d933a29ccb4564e8d3198c159a1debfb56d6f39f428689f8eb4d497b341bde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9

MD5
4658bb40df1d2668f2337c7943a22ebb

SHA1
0332e16d3c36292dc43da18f05d42cfdcd4dbde4

SHA256
af5e788fbce7a25ea5f2ef384e39a652619910c101c63fbbcbc8c20204322e74

SHA512
398208de3a7f824b5911189eb82b7184b40248c5bc42d5abc9564fdc7702cb7f2e83fdfb09601600260eeb8b2b3d5520b2d36aa6252cd67ebd56f755deff8846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5
a4d977654867ed9025d3d2d46a16e1e4

SHA1
788c0e1ad79ce435f04c1bc5b4d8374037df8385

SHA256
2d72b608c30f1b523b88e51a70ac9a6c130315f6b1c5df8872ddf7b3d1a00e1d

SHA512
7a444633c6fb2026808d38feef38f6877d780db1541c10975b9e632d12f081d7959d417d9c84045ae2579b46056b5b4aecaa043b7b776af1dcd5773fd0c1439c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9

MD5
cd256eacec8f3bad0f4f60675f64de93

SHA1
073c5877b6cec81f58b2c5449e6f5e849c0a4ca5

SHA256
4af362f94336791b38a8141ddde8697ab6705f3ab3ab2a305909e7fde0a8ef9b

SHA512
c5835ba0065d15a29895abe44dae59cd299d3a13daf582c96259e98a71cf12000436b094b44637b91e6d880b667cca210b034fde90d607a364f17a1a1b1a8329

Download Submit
C:\Users\Admin\AppData\Local\eadaf380-f65a-4b96-8c5e-af48950a141b\575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

MD5
9036ae5ba754bdacf08a02401473d338

SHA1
615df36cf7e06a853d170d7a68c6b652e8cc7688

SHA256
575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45

SHA512
30b2861d10c65fdc7884b3a42e1836209f0b2d2c69ab826708944a609faf3e9a59d9ac0164144fdea4affb19168017e1dd9e8af410fa57f964c72e82133094d6

Download Submit
memory/1248-125-0x0000000000424141-mapping.dmp

Download
memory/1248-130-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-115-0x0000000002127000-0x00000000021B8000-memory.dmp

Filesize
580KB

Download
memory/2716-116-0x00000000021C0000-0x00000000022DB000-memory.dmp

Filesize
1.1MB

Download
memory/3376-120-0x0000000000000000-mapping.dmp

Download
memory/3480-122-0x0000000000000000-mapping.dmp

Download
memory/3480-123-0x000000000212A000-0x00000000021BB000-memory.dmp

Filesize
580KB

Download
memory/3684-119-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3684-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3684-118-0x0000000000424141-mapping.dmp

Download

description	pid	process	target process
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 2716 wrote to memory of 3684	2716	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3684 wrote to memory of 3376	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	icacls.exe
PID 3684 wrote to memory of 3376	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	icacls.exe
PID 3684 wrote to memory of 3376	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	icacls.exe
PID 3684 wrote to memory of 3480	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3684 wrote to memory of 3480	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3684 wrote to memory of 3480	3684	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe
PID 3480 wrote to memory of 1248	3480	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe	575655d5dbd1aa7b8f84d970dd1ee7fab3bd93e86b7e2f8cba3cf562f4a5de45.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads