xloader | a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d

General

Target

LETTER OF INTENT.exe
Size

750KB
MD5

b3f43a58149d9058f8c39455869c2f84
SHA1

8f3d20b2f71e7331c355e2926a5fc5ce71e72eb8
SHA256

a04a4acf00f50f8b3c3bea38914813aa75ce4ba8c30c08971a6094c492d0d41d
SHA512

4aa74fa83551e3c2318f488cf2dbd0741e9b42899ad8501c0bf9d0e2c6471fee6ad0c1588ea652195de1ef813e51bc2bb03628cf5609792e7e59e1baa56b3fef

Score

10^/10

xloader uar3 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

jogoreviravolta.com

keysine.com

sami60.com

morganators.com

referral.directory

campdiscount.info

vanwah.com

jmtmjz.com

der-transformationscode.com

evangelvalormedia.com

bedsidehomecare.com

novaair.net

privilegetroissecurity.com

elsiepupz.com

yy77kk.com

nt-renewable.com

alyaqoutalabyadhautoparts.com

start-play-now.com

myskew.com

himalaya-finance.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1748-135-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1204-142-0x0000000000950000-0x0000000000979000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

LETTER OF INTENT.exeLETTER OF INTENT.exemstsc.exe

description	pid	process	target process
PID 3984 set thread context of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 1748 set thread context of 2440	1748	LETTER OF INTENT.exe	Explorer.EXE
PID 1204 set thread context of 2440	1204	mstsc.exe	Explorer.EXE

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.651239"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "25.002880"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.894585"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4012"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898475113468204"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006601"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4332"	svchost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

LETTER OF INTENT.exeLETTER OF INTENT.exemstsc.exe

pid	process
3984	LETTER OF INTENT.exe
3984	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe
1204	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2440 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

LETTER OF INTENT.exemstsc.exe

pid process

1748 LETTER OF INTENT.exe
1748 LETTER OF INTENT.exe
1748 LETTER OF INTENT.exe
1204 mstsc.exe
1204 mstsc.exe

pid	process
2440	Explorer.EXE

pid	process
1748	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1748	LETTER OF INTENT.exe
1204	mstsc.exe
1204	mstsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

TiWorker.exe

description	pid	process
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe
Token: SeRestorePrivilege	1908	TiWorker.exe
Token: SeSecurityPrivilege	1908	TiWorker.exe
Token: SeBackupPrivilege	1908	TiWorker.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LETTER OF INTENT.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 3984 wrote to memory of 1748	3984	LETTER OF INTENT.exe	LETTER OF INTENT.exe
PID 2440 wrote to memory of 1204	2440	Explorer.EXE	mstsc.exe
PID 2440 wrote to memory of 1204	2440	Explorer.EXE	mstsc.exe
PID 2440 wrote to memory of 1204	2440	Explorer.EXE	mstsc.exe
PID 1204 wrote to memory of 3248	1204	mstsc.exe	cmd.exe
PID 1204 wrote to memory of 3248	1204	mstsc.exe	cmd.exe
PID 1204 wrote to memory of 3248	1204	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\LETTER OF INTENT.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER OF INTENT.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984

C:\Users\Admin\AppData\Local\Temp\LETTER OF INTENT.exe
"C:\Users\Admin\AppData\Local\Temp\LETTER OF INTENT.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1748

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\LETTER OF INTENT.exe"
3⤵
PID:3248

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3424

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-144-0x0000000004B10000-0x0000000004BA0000-memory.dmp

Filesize
576KB

Download
memory/1204-143-0x0000000004BC0000-0x0000000004F0A000-memory.dmp

Filesize
3.3MB

Download
memory/1204-142-0x0000000000950000-0x0000000000979000-memory.dmp

Filesize
164KB

Download
memory/1204-141-0x0000000000DE0000-0x0000000000F1A000-memory.dmp

Filesize
1.2MB

Download
memory/1748-139-0x00000000017A0000-0x00000000017B1000-memory.dmp

Filesize
68KB

Download
memory/1748-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1748-138-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1748-137-0x00000000017F0000-0x0000000001B3A000-memory.dmp

Filesize
3.3MB

Download
memory/2440-140-0x0000000002C00000-0x0000000002CB8000-memory.dmp

Filesize
736KB

Download
memory/2440-145-0x00000000080D0000-0x0000000008218000-memory.dmp

Filesize
1.3MB

Download
memory/3984-130-0x00000000748FE000-0x00000000748FF000-memory.dmp

Filesize
4KB

Download
memory/3984-134-0x0000000005180000-0x000000000521C000-memory.dmp

Filesize
624KB

Download
memory/3984-133-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Filesize
584KB

Download
memory/3984-132-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3984-131-0x0000000000240000-0x0000000000302000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads