qakbot | 1e7ef79feb151b4434c1d03c3729feb259de07f06fdb07efa04ff7df842ec7a6

General

Target

second_stage1.bin.dll
Size

664KB
MD5

60d10d0aa07877496fc18e82b540abdc
SHA1

b540af55ae7f5f239104a9586aa58d3288e7ac56
SHA256

1e7ef79feb151b4434c1d03c3729feb259de07f06fdb07efa04ff7df842ec7a6
SHA512

9b41be602a514b690664077d5a657604aee448ac0f4c53e56ea79866ed5359d69553e31b4d05efc090ef57487399fadb11443765b234c9f20239b1a341328351

Score

10^/10

qakbot cullinan 1640084934 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

cullinan

Campaign

1640084934

C2

95.5.133.68:995

188.159.122.122:443

140.82.49.12:443

32.221.229.7:443

24.152.219.253:995

31.35.28.29:443

96.37.113.36:993

109.12.111.14:443

14.96.72.249:61202

93.48.80.198:995

45.9.20.200:2211

24.95.61.62:443

79.167.192.206:995

37.210.226.125:61202

103.139.242.30:995

70.163.1.219:443

114.79.148.170:443

63.153.187.104:443

103.143.8.71:6881

24.53.49.240:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1476 regsvr32.exe

pid	process
1476	regsvr32.exe

Drops file in System32 directory 6 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\t4[1]	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3912 schtasks.exe

pid	process
3912	schtasks.exe

Modifies data under HKEY_USERS 63 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\6b0b1b5 = 1ec67bcf7cdf397aa0a2dbfef1d2bffe68c028dad59a16368391a1cc37f6e127a77d4cc6f96537328eb20a5147923c30e5ff3c9b2a4c4d175bc06d54201bc3cf3e7c58a842e6d879aa5a2200d9656d0b891edd58d869917dd0851e32651bd85f03d2d100f143a7f24861c85276e28ee8afdffab28d03	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\f4da6968 = 0a6622fa2fa8c629b8edfaad2149b1fb709ada7f0ab6bc4ba2270ea7b64192945276c6718b48201bba0a1658b85d08d74138c156f3f069f225f4561fbb1702c109e9c6353ba9536fd062dbf3fdf22836b2a4e322a82a09b96b4ac9	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\4c660e0d = 024dbd316b0912cdf9e29409ee478e7c4baca614326035f93e	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\6b0b1b5 = 1ec66ccf7cdf0c6be7e1a5b5db5ffe7642f702af63c0aa60f355c5dca139be65f1d420b2214bfa4a0a54062a0d31582780f8d3132b83cc14de7af13bbb58cbf722b4502008335333762efa8feec140fde273fb4b36734523657631038db73d9856	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\79f9de43 = 4b71b92c7654495980386b976111f437f6da138e53741e723a82e24d696640058e9776d6095280012c72e9ad2761df373f9e906f7ab40db5d3231b805eabeea03adaef0c80293463140d22eb6061ce	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\8b93069e = a7660719e3352c4b56e1b50b651722ae5f067d8663039e87f9e01a3237dc185ec6669efbe214a9ccd38a1c428b66f16a72261127639106bd837af39554e8ef34c887b3645bb84636c13c69f4fc5e64f73d	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\6b0b1b5 = 1ec672cf7cdf397aa0a2dab4f1d0bcf960c228da90981b368b92a2fa2eb9a85fa357cc86405e4756860a786d5062d160e9050ad7ac49b4310ab1ee2663d5cb181555d30fc8f7a14662a6a2db98a6c3137b4e5197b65df544632a418318374ccf5f2cfc569490462c4c6ed1463c12b9f5095994d90e5415db070102efd8e28e	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\316e4187 = c7d7c2210a3799659232d05fe6b8a3131646874697b43d5fa25733ac45223596281c5208471511d085ae65773354fb5670b0798a0d8391cd3b1ffcef89b2b33a7fa2500ff00441b6dd56	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\6b0b1b5 = 1ec67bcf7cdf397aa0a2dbfef1d2bffe68c028dad59a16378b9ea2cc37f6e127a77d4cc6f96537328eb20a5147923c30e5ff3c9b2a4c4d175bc06d54201bc3cf3e7c58a842e6d879aa5a2200d9656d0b891edd58d869917dd0851e32651bd85f03d2d100f143a7f24861c85276e28ee8afdffab28d03	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\332f61fb = 3bf56d164b4cce9882a5eba21fc238f780d53c8bac360e233e103291b08904ad89f181a7ada8799cca82cd6ce69fe0cbb7f105b4a5ac560d4ab9cb714281d43e9fc95469adb9a90e1c3e37813d0acb36def98fc619cd3ec38f03c651b81a37cfd50cbefbb8110b3d5f29977145bce84414c6ef7e437adac9a2c40ea0019493a170ef797e5780428ca095c90ce99f60f11bfe929868dc87a2752bf5a780d4bf465ed7000cff43d52e5117575f1b457830042049e2ec3b7830	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Ayuuxpbym\89d226e2 = 27194834595b78e8873d88be9c9c5cc15502c3f8fec427b73f6f04cc2e8e48bc78804b0d528b496157043744cc9f18bf7b15c4c080d27d15aac9f84b041266e7f6e11ecdd9df6931fee8d2e22effb4e32ef4183af7f8914c53f264b0	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid	process
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
3064	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

3064 regsvr32.exe
1476 regsvr32.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

regsvr32.exeregsvr32.exeexplorer.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 2672 wrote to memory of 3064	2672	regsvr32.exe	regsvr32.exe
PID 2672 wrote to memory of 3064	2672	regsvr32.exe	regsvr32.exe
PID 2672 wrote to memory of 3064	2672	regsvr32.exe	regsvr32.exe
PID 3064 wrote to memory of 2420	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2420	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2420	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2420	3064	regsvr32.exe	explorer.exe
PID 3064 wrote to memory of 2420	3064	regsvr32.exe	explorer.exe
PID 2420 wrote to memory of 3912	2420	explorer.exe	schtasks.exe
PID 2420 wrote to memory of 3912	2420	explorer.exe	schtasks.exe
PID 2420 wrote to memory of 3912	2420	explorer.exe	schtasks.exe
PID 1424 wrote to memory of 1476	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 1476	1424	regsvr32.exe	regsvr32.exe
PID 1424 wrote to memory of 1476	1424	regsvr32.exe	regsvr32.exe
PID 1476 wrote to memory of 3972	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 3972	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 3972	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 3972	1476	regsvr32.exe	explorer.exe
PID 1476 wrote to memory of 3972	1476	regsvr32.exe	explorer.exe
PID 3972 wrote to memory of 1156	3972	explorer.exe	reg.exe
PID 3972 wrote to memory of 1156	3972	explorer.exe	reg.exe
PID 3972 wrote to memory of 664	3972	explorer.exe	reg.exe
PID 3972 wrote to memory of 664	3972	explorer.exe	reg.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mffpbrq /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll\"" /SC ONCE /Z /ST 19:03 /ET 19:15
4⤵
- Creates scheduled task(s)
PID:3912

\??\c:\windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Ilvimh" /d "0"
4⤵
PID:1156

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Uaiymqeybj" /d "0"
4⤵
PID:664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll
MD5
60d10d0aa07877496fc18e82b540abdc

SHA1
b540af55ae7f5f239104a9586aa58d3288e7ac56

SHA256
1e7ef79feb151b4434c1d03c3729feb259de07f06fdb07efa04ff7df842ec7a6

SHA512
9b41be602a514b690664077d5a657604aee448ac0f4c53e56ea79866ed5359d69553e31b4d05efc090ef57487399fadb11443765b234c9f20239b1a341328351

Download Submit
\Users\Admin\AppData\Local\Temp\second_stage1.bin.dll
MD5
60d10d0aa07877496fc18e82b540abdc

SHA1
b540af55ae7f5f239104a9586aa58d3288e7ac56

SHA256
1e7ef79feb151b4434c1d03c3729feb259de07f06fdb07efa04ff7df842ec7a6

SHA512
9b41be602a514b690664077d5a657604aee448ac0f4c53e56ea79866ed5359d69553e31b4d05efc090ef57487399fadb11443765b234c9f20239b1a341328351

Download Submit
memory/664-130-0x0000000000000000-mapping.dmp

Download
memory/1156-129-0x0000000000000000-mapping.dmp

Download
memory/1476-126-0x0000000003B50000-0x0000000003BCB000-memory.dmp

Filesize
492KB

Download
memory/1476-124-0x0000000000000000-mapping.dmp

Download
memory/1476-127-0x0000000003BD0000-0x0000000003D5E000-memory.dmp

Filesize
1.6MB

Download
memory/2420-119-0x0000000000000000-mapping.dmp

Download
memory/2420-120-0x0000000002800000-0x0000000002821000-memory.dmp

Filesize
132KB

Download
memory/2420-122-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Filesize
4KB

Download
memory/3064-118-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/3064-115-0x0000000000000000-mapping.dmp

Download
memory/3064-116-0x0000000004400000-0x000000000447B000-memory.dmp

Filesize
492KB

Download
memory/3064-117-0x0000000004480000-0x000000000460E000-memory.dmp

Filesize
1.6MB

Download
memory/3912-121-0x0000000000000000-mapping.dmp

Download
memory/3972-128-0x0000000000000000-mapping.dmp

Download
memory/3972-131-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/3972-132-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/3972-133-0x0000000002800000-0x0000000002821000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads