sakula | 0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a

General

Target

0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe
Size

216KB
MD5

05ca66dec76c5526bc20373065ce9330
SHA1

dfefaf0cc12c268606d23b271b60e1a13eeba9ea
SHA256

0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a
SHA512

60619def19ee88803af58fd8520982cf8e7749f251f8f085f97884fbd30760b52e01f25124372f77632c9d2eac4ac1d28c6a33e487aeda89f1c26063f8ab503e

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/3192-132-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/memory/1620-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1620 MediaCenter.exe

pid	process
1620	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe

Drops file in Windows directory 3 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.173625"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "33.366077"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4024"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4300"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4072"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.453268"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893096023782057"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

484 PING.EXE

pid	process
484	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe
Token: SeRestorePrivilege	2312	TiWorker.exe
Token: SeSecurityPrivilege	2312	TiWorker.exe
Token: SeBackupPrivilege	2312	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.execmd.exe

description	pid	process	target process
PID 3192 wrote to memory of 1620	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	MediaCenter.exe
PID 3192 wrote to memory of 1620	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	MediaCenter.exe
PID 3192 wrote to memory of 1620	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	MediaCenter.exe
PID 3192 wrote to memory of 2464	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	cmd.exe
PID 3192 wrote to memory of 2464	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	cmd.exe
PID 3192 wrote to memory of 2464	3192	0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe	cmd.exe
PID 2464 wrote to memory of 484	2464	cmd.exe	PING.EXE
PID 2464 wrote to memory of 484	2464	cmd.exe	PING.EXE
PID 2464 wrote to memory of 484	2464	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe
"C:\Users\Admin\AppData\Local\Temp\0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3192

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0917dbaab9e1ee6e1bf2d9cedcfac3913f33ed821b50daa81ac3fff45fe91b8a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:484

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:384

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
e74c523eedb543703f49a6f431475a03

SHA1
67263cf8e399efdd0fdc97aac8ae447c1f703ce6

SHA256
3f3096d4e6e1af7947a352f2ac5f1d603e1b7382115a540a723cfa2f9d0b7bc2

SHA512
d184401bd1d3484f5a9334852193e0bff66064543fb1fcc3b455c21aea4cd6b91e5745c7476bb05b1073682c9e1e8150a2c7f81d5a6372d76c992380a57dfe4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
e74c523eedb543703f49a6f431475a03

SHA1
67263cf8e399efdd0fdc97aac8ae447c1f703ce6

SHA256
3f3096d4e6e1af7947a352f2ac5f1d603e1b7382115a540a723cfa2f9d0b7bc2

SHA512
d184401bd1d3484f5a9334852193e0bff66064543fb1fcc3b455c21aea4cd6b91e5745c7476bb05b1073682c9e1e8150a2c7f81d5a6372d76c992380a57dfe4e

Download Submit
memory/1620-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3192-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads