sakula | 07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179

General

Target

07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe
Size

216KB
MD5

5081422133a9bc64ca4fa1f6fb6a2679
SHA1

2915d248a24b8da1fb86cc5d4039fe707e0414e6
SHA256

07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179
SHA512

50f8f600ce03702842a9c5ff43d97de1356f614fbf954676640bb7adfd1e7ccb34e5b689b36da32ac43f00199b6e625a3a2ae209648b7f66f8f546d574a197e0

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/2172-132-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3192 MediaCenter.exe

pid	process
3192	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe

Drops file in Windows directory 3 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3856"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893115771141962"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4224"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.714278"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4016"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.175439"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2532 PING.EXE

pid	process
2532	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe

description	pid	process
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeIncBasePriorityPrivilege	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe
Token: SeBackupPrivilege	3116	TiWorker.exe
Token: SeRestorePrivilege	3116	TiWorker.exe
Token: SeSecurityPrivilege	3116	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.execmd.exe

description	pid	process	target process
PID 2172 wrote to memory of 3192	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	MediaCenter.exe
PID 2172 wrote to memory of 3192	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	MediaCenter.exe
PID 2172 wrote to memory of 3192	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	MediaCenter.exe
PID 2172 wrote to memory of 636	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	cmd.exe
PID 2172 wrote to memory of 636	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	cmd.exe
PID 2172 wrote to memory of 636	2172	07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe	cmd.exe
PID 636 wrote to memory of 2532	636	cmd.exe	PING.EXE
PID 636 wrote to memory of 2532	636	cmd.exe	PING.EXE
PID 636 wrote to memory of 2532	636	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe
"C:\Users\Admin\AppData\Local\Temp\07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07dc2a7c5cb79e5d36bddefccc90adaae2a9e4bf38fe0f25b23375af6ec1e179.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:636

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2532

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3096

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7837b6e924e590ff3e14f3d8e5fb87d5

SHA1
acd13af015eba6033b0ef44478222f8f2bea76ad

SHA256
7e43174571da0758b135b7427d025f7b29ef97e04363a63f4640732506b46691

SHA512
9339050379d855b8664cc324de79f00f47bd485573f5c7d559012fd76304bcd3c08ec244243945f3594cedf3ff88cf32329f9ad2dd72d7d45e68444fd734183b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7837b6e924e590ff3e14f3d8e5fb87d5

SHA1
acd13af015eba6033b0ef44478222f8f2bea76ad

SHA256
7e43174571da0758b135b7427d025f7b29ef97e04363a63f4640732506b46691

SHA512
9339050379d855b8664cc324de79f00f47bd485573f5c7d559012fd76304bcd3c08ec244243945f3594cedf3ff88cf32329f9ad2dd72d7d45e68444fd734183b

Download Submit
memory/2172-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads