formbook | bde0129799ae332ca620e04afb99a7292548d4486c1b07b26254f781c2777b67

General

Target

LENG EAV GROUP-pdf-scan-copy.exe
Size

518KB
MD5

c5356c7eec60fb77f7538a743cc82e61
SHA1

2fe7d2b6c0c0198e44c935675929e44a1085b5bf
SHA256

99e367c5442ec49f144c330f6518e8648c266cb53a9c903e5829ce658cf6ce0a
SHA512

eb2010259e5172e6000c7ea316663d372c157b5d03c32bc69cf238f4252ef44bff3faa589b08064c7be64602eb7bc75d8226bd65420adc13ed561b38b6590778

Score

10^/10

formbook m17y persistence rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

m17y

Decoy

dental-implants-us-prices.site

eolegends.online

drskinstudio.com

miamivideomapping.com

cqytwater.com

fesfe.net

dlautostore.com

wwwpledge.com

trynutiliti.com

551milesoak.com

jemmetalfab.com

teamtrinitysellsncarolina.com

injurypersonallawyer.com

r3qcf2.xyz

djellaba-boutique.com

t6fwagd.xyz

lm-upto100.com

shyashijz.com

classicbasilicata.com

exactias.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1848-143-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1848-163-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1828-169-0x0000000003360000-0x000000000338F000-memory.dmp	formbook

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LENG EAV GROUP-pdf-scan-copy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	LENG EAV GROUP-pdf-scan-copy.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

LENG EAV GROUP-pdf-scan-copy.exeLENG EAV GROUP-pdf-scan-copy.execscript.exe

description	pid	process	target process
PID 536 set thread context of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 1848 set thread context of 2520	1848	LENG EAV GROUP-pdf-scan-copy.exe	Explorer.EXE
PID 1848 set thread context of 2520	1848	LENG EAV GROUP-pdf-scan-copy.exe	Explorer.EXE
PID 1828 set thread context of 2520	1828	cscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1676 schtasks.exe

pid	process
1676	schtasks.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

LENG EAV GROUP-pdf-scan-copy.exepowershell.exeLENG EAV GROUP-pdf-scan-copy.execscript.exe

pid	process
536	LENG EAV GROUP-pdf-scan-copy.exe
536	LENG EAV GROUP-pdf-scan-copy.exe
536	LENG EAV GROUP-pdf-scan-copy.exe
536	LENG EAV GROUP-pdf-scan-copy.exe
536	LENG EAV GROUP-pdf-scan-copy.exe
536	LENG EAV GROUP-pdf-scan-copy.exe
3548	powershell.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
3548	powershell.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe
1828	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2520 Explorer.EXE

pid	process
2520	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

LENG EAV GROUP-pdf-scan-copy.execscript.exe

pid	process
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1848	LENG EAV GROUP-pdf-scan-copy.exe
1828	cscript.exe
1828	cscript.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

LENG EAV GROUP-pdf-scan-copy.exepowershell.exeLENG EAV GROUP-pdf-scan-copy.exeExplorer.EXEcscript.exe

description	pid	process
Token: SeDebugPrivilege	536	LENG EAV GROUP-pdf-scan-copy.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	1848	LENG EAV GROUP-pdf-scan-copy.exe
Token: SeShutdownPrivilege	2520	Explorer.EXE
Token: SeCreatePagefilePrivilege	2520	Explorer.EXE
Token: SeDebugPrivilege	1828	cscript.exe
Token: SeShutdownPrivilege	2520	Explorer.EXE
Token: SeCreatePagefilePrivilege	2520	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

LENG EAV GROUP-pdf-scan-copy.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 536 wrote to memory of 3548	536	LENG EAV GROUP-pdf-scan-copy.exe	powershell.exe
PID 536 wrote to memory of 3548	536	LENG EAV GROUP-pdf-scan-copy.exe	powershell.exe
PID 536 wrote to memory of 3548	536	LENG EAV GROUP-pdf-scan-copy.exe	powershell.exe
PID 536 wrote to memory of 1676	536	LENG EAV GROUP-pdf-scan-copy.exe	schtasks.exe
PID 536 wrote to memory of 1676	536	LENG EAV GROUP-pdf-scan-copy.exe	schtasks.exe
PID 536 wrote to memory of 1676	536	LENG EAV GROUP-pdf-scan-copy.exe	schtasks.exe
PID 536 wrote to memory of 868	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 868	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 868	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3024	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3024	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3024	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3720	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3720	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 3720	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 536 wrote to memory of 1848	536	LENG EAV GROUP-pdf-scan-copy.exe	LENG EAV GROUP-pdf-scan-copy.exe
PID 2520 wrote to memory of 1828	2520	Explorer.EXE	cscript.exe
PID 2520 wrote to memory of 1828	2520	Explorer.EXE	cscript.exe
PID 2520 wrote to memory of 1828	2520	Explorer.EXE	cscript.exe
PID 1828 wrote to memory of 3136	1828	cscript.exe	cmd.exe
PID 1828 wrote to memory of 3136	1828	cscript.exe	cmd.exe
PID 1828 wrote to memory of 3136	1828	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520

C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe
"C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVXkgTTYkF.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVXkgTTYkF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp504B.tmp"
3⤵
- Creates scheduled task(s)
PID:1676

C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe
"C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
3⤵
PID:868

C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe
"C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
3⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe
"C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
3⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe
"C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LENG EAV GROUP-pdf-scan-copy.exe"
3⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:796

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 3cacfd0b08fbc2efaea9a199478b78f5 omc2//L2GE+ip2xL58nQkA.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:1864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp504B.tmp
MD5
42178ba426c2f905565122f6364233b6

SHA1
f71be6006b956cf45b4614ed7a693758072191e2

SHA256
a98a4269439a9d169695dc6bdf3d5355e8d4491519ce16a13b7d4ecf59e7763e

SHA512
51a7d6e4c92de0b573a0661f4906acaa7acbe69d3f8d7fc82fb496432acaec9707eca727bca371dba115c9e20db1d8d06d1552de3d3e55a87827a56305300268

Download Submit
memory/536-131-0x0000000005F90000-0x0000000006534000-memory.dmp

Filesize
5.6MB

Download
memory/536-132-0x0000000005A80000-0x0000000005B12000-memory.dmp

Filesize
584KB

Download
memory/536-133-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/536-134-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/536-135-0x0000000007F30000-0x0000000007FCC000-memory.dmp

Filesize
624KB

Download
memory/536-130-0x0000000000FC0000-0x0000000001048000-memory.dmp

Filesize
544KB

Download
memory/1828-171-0x0000000005290000-0x0000000005324000-memory.dmp

Filesize
592KB

Download
memory/1828-170-0x0000000005400000-0x000000000574A000-memory.dmp

Filesize
3.3MB

Download
memory/1828-169-0x0000000003360000-0x000000000338F000-memory.dmp

Filesize
188KB

Download
memory/1828-168-0x0000000000C70000-0x0000000000C97000-memory.dmp

Filesize
156KB

Download
memory/1848-163-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-165-0x0000000003140000-0x0000000003155000-memory.dmp

Filesize
84KB

Download
memory/1848-148-0x0000000000FF0000-0x00000000017AA000-memory.dmp

Filesize
7.7MB

Download
memory/1848-149-0x00000000017D0000-0x00000000017E5000-memory.dmp

Filesize
84KB

Download
memory/2520-166-0x0000000008440000-0x00000000085A8000-memory.dmp

Filesize
1.4MB

Download
memory/2520-150-0x0000000003440000-0x0000000003523000-memory.dmp

Filesize
908KB

Download
memory/2520-172-0x00000000085B0000-0x0000000008672000-memory.dmp

Filesize
776KB

Download
memory/3548-151-0x00000000080E0000-0x00000000080FE000-memory.dmp

Filesize
120KB

Download
memory/3548-161-0x0000000009620000-0x000000000962E000-memory.dmp

Filesize
56KB

Download
memory/3548-154-0x00000000711D0000-0x000000007121C000-memory.dmp

Filesize
304KB

Download
memory/3548-155-0x00000000086B0000-0x00000000086CE000-memory.dmp

Filesize
120KB

Download
memory/3548-156-0x000000007F890000-0x000000007F891000-memory.dmp

Filesize
4KB

Download
memory/3548-157-0x0000000009A40000-0x000000000A0BA000-memory.dmp

Filesize
6.5MB

Download
memory/3548-158-0x00000000093F0000-0x000000000940A000-memory.dmp

Filesize
104KB

Download
memory/3548-159-0x0000000009460000-0x000000000946A000-memory.dmp

Filesize
40KB

Download
memory/3548-160-0x0000000009670000-0x0000000009706000-memory.dmp

Filesize
600KB

Download
memory/3548-153-0x00000000086D0000-0x0000000008702000-memory.dmp

Filesize
200KB

Download
memory/3548-152-0x0000000006C35000-0x0000000006C37000-memory.dmp

Filesize
8KB

Download
memory/3548-162-0x0000000009730000-0x000000000974A000-memory.dmp

Filesize
104KB

Download
memory/3548-164-0x0000000009710000-0x0000000009718000-memory.dmp

Filesize
32KB

Download
memory/3548-146-0x0000000007AF0000-0x0000000007B56000-memory.dmp

Filesize
408KB

Download
memory/3548-145-0x0000000007A10000-0x0000000007A76000-memory.dmp

Filesize
408KB

Download
memory/3548-144-0x0000000007140000-0x0000000007162000-memory.dmp

Filesize
136KB

Download
memory/3548-140-0x0000000006C30000-0x0000000006C31000-memory.dmp

Filesize
4KB

Download
memory/3548-142-0x0000000007270000-0x0000000007898000-memory.dmp

Filesize
6.2MB

Download
memory/3548-141-0x0000000006C32000-0x0000000006C33000-memory.dmp

Filesize
4KB

Download
memory/3548-138-0x00000000047B0000-0x00000000047E6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads