qakbot | b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205

General

Target

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Size

339KB
MD5

4ee0de553b53387ad4a758c954579341
SHA1

0c35e5fda2a434da6bb675503580363a2a4e4818
SHA256

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205
SHA512

f264f9ce8bc1307d0963944899a703660a04693cff9eed9407753c6cedff033342fc888adad90640253dd6f7fa7539ca29e3004e92daa1dcc38cdb27975d1493

Score

10^/10

qakbot abc027 1604574287 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.59

Botnet

abc027

Campaign

1604574287

C2

93.86.252.177:995

184.98.97.227:995

188.25.24.21:2222

1.54.190.204:443

89.137.211.239:443

78.101.234.58:443

41.206.131.166:443

87.27.110.90:2222

47.44.217.98:443

197.45.110.165:995

217.133.54.140:32100

41.97.170.119:443

185.246.9.69:995

90.53.232.130:2222

72.186.1.237:443

144.139.230.139:443

86.164.27.33:2222

185.105.131.233:443

90.146.209.224:2222

108.46.145.30:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{79617091-B747-43F6-9084-D0E98D98FB8E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A5AD485A-A83C-49B8-AEA8-08E882FDB9FE}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00184006553B79F9 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000a7719eaf1b034680ef8723876969dcd3b9268cd2d6d79d171af518c7888576d6000000000e80000000020000200000005ff19d484afd5bcbfd145653f6dc1f4b310e338a67fd40c2caa5fe47caac684c800000004cbee03b1cab9d8856e7c9fa2b43708b346efbc283a1cc25bccbc11f8cb1d7e52017c3af74237b14e41cd5cdff095aa7ed944966e95fbe3ab02bb5f2204e9b4f5441e6ea002ed15d3e4eb876b8461422eece77a71c0696aeac7956b34175179239f3e7fce0424301d962c7e1ef953ffa31ab71637dd7a69561c560828e997dbb4000000040b92e77b2ba208392b8f1563dfb3562527a1a8d8431a5f4ece171c8091960773238f45c9aeb4c1041fbce612e9c5d2612f27a211bcb07dc3bd29a0fb87bd869	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000096738a2921fa2411fee183a510a94dc8f308bea29e4c6dba18973b49bb14bb31000000000e80000000020000200000003aa342eb913621d5ec67258fa47e7dee927b8374c4e4c457c40f16ab09e6be9d100d0000bda9e5410bc2d5d51dffcbb9e3270263f4523690c1775bc8621cb8c0c6b5c16739cc3805ec58589a01ed52c168db3c3b2dbdc01b67792cdf38b4144b3d6a89e4b85f8eb790f27a87fa363636a12cce6a7e6930217cc20c0f887dba09fee2634c989e1dec080848db551c78ae16d9d1e7908858b8e2c37b8f943022402fc3cf18f1977b1d76c931e78130cd301a3225b68b94e073344d5fd7fbf961f01ae5289f4997a81553f9a9ae4639cf44b0d9459e0e82d6850c05acc00affa0221b8477e0b57fd92c0c863857e5af53231b98f948d7c6bab5660824feb6ff3b85f465070fb05a7160776cc8c3b85ac6ee3c7d6f412c5fb2bcaf1df8e2fd3408c7a23f852cdda7394aea89e4faf25e5a45a3e0c93faf30aefbab0cd30663da19e208a4142a64f137ee771c1b0667f5f36d9fbd06e39883ec611dcf86af1bdd916b99a0318e2c58033d76757f7b745628eb4740fbf6832898e69962c2805a54a1e016f3f67611ea0103aa34293ba45cd81d0934f14d1bc41e8410178c38bb81c9e77557897b7c358a76fff982c35f4e365fa526b352618419f6679ebcfe665c7db2667149abcca668b773f6ea4cfede37decc26307c1aafb9ff7be8e1b2d77e45ceb4d5259d34ddc34ab3434ad4379e798dbfc3aaab781c4757a63d5e561152e17d3978115b201fed1f72a7a25af5d6b6239f371b730c95e1251f4d618e76e01a0b7577dbb735a9a3f1eac820ee49ed58418e1094f3ed2bbffa9f20a6431bddac2a9f8c0f516d158878ee124842a947ea00120e26531a82153721f4947f32a6a2d964d75cfcd66a00cf32c5d2a4b30fffdb3ee8c47b27eb876e5438d36d71ee28bc651035fe23020a11f41b3a2884fde112ac2f37046f7115fde3d9918f4825f714d98684bf305d9ce01c4b9a1fe120e48e3eb9133b6b7fd4d10bc7757cbc12a384a3339c820b013ca975ada162244f4cae6287f7ef15ac5ad0faca2df2239d9e006e4885fb0f854180aaf5d375be8520208bdf7ae1d81ffd07e6f613469d342ec732a2cf75b3e57c9f92a4ed492d165bea64d88c1c18d42c927df9bd91a96b3fa4e9fc118563e8dfe4e335a10625adbb3c538b322f91f0960046722009270f44757910ef097896813b13f8040a646a3d6e5a7b60f232c4b5cd6bc7fe96871f2540e83e029bedfc272d542cdd808b00aa869eaa591fedc491a382eed15322fa0f70182907eaf774528fa8ceb43479aea3199bdd971cb8afdb0b8d5035c65b067012571565c1e97add2f68eb8694d5e6be15caf9aa6fe2c7a9b6304b0ce6b3ddc6bdbbd926f7c983a91fa4d1c75703a22805c9957a5c5a668993ba0c29af5a1e4a21a8a95e450ecabc77cd69c57d5ff5a6d79333e15d4f01907b27a58bbda5f60f6effbb99305e3ff69dbe4f055be62d68a63360f76854c8c409c721b01cd27099866d6fc1357640d191a9cffc5e415c455f0df17ebac0761ed43176e00f141bc0d07f5c0c6a93a5e5acf9d1c9e4309154bea3bbf34180f5c03d9d526fb9b04234624f46247f7c1eac6212143b5c22c6a60fd159e794ddfc3e62c387e8910742a6eb711f3b7229dec28ab16ac1d7a5e7ebea6ab802ad9d74c8fbb8e1d950d369ebf68bedc9fc38ab5e57e0854337b6cef92086fb2a685b80415d9a067a22d1de284ddfa3d8b0b274660f945ab7977ec0b3f9d90c74b873cfeeeb2f2b61f1b7c27575eed264516102db55fb41557eb4e4db570f95e95f9d2fe9c2dd4f50a48a0ea14542309c7c7675441722c0a0f3e03c7af8c841610269f18d873f912d5b5c335176055d1fc4acd15947bf1511ce15ef8eb229d1e1a006c002b895d578e75f2183871dffacd9798112b7149ee769cb20ec02193d429e741fdf5eca7364a26d7e2cabf9998014d01e43c25a7a782224b835cf7b9a3c539bd92f7130785695fc4e1ce9e9b2958d7934656227f7e313b72e86a63cd83bf5422875dab2e3e48558c58b2109ab8a7eb311ccad508b1f67c3107a30e3a648d15ff58fdde01eb24c8eefcf08d78bdc75a4570f774488f699c98a180b921fc7cb92fc26e3a09c1fc525c2ccb3c2776b006048f8dba5f3b9e113cfc21755765e6f8e81e64105452f81bce7e7ccefafaf199047c44dc9b3f83745fca472a5bfc4bd5b9c546b6f911128526293859c5492b227e14747fbe5d7486a9db6931047ab76dc52c6152cfb75e8eb797dcfc8cf4c8cade4f5469141943d420bd78dd7c38f8b372f8689a3d099d5dc7c66df5a7604a04b713b6f9255b584598eadad356ff58ba7c9011d49ed6ea574bf812e25d859b52b042634b1c63bb5ee11121e631e6285de22960f6072a4bdadb45f9257b36af5df0915129549080500c930c95ce36f0cc9c5c76cb8b37312f8276d14ea2f83b6d86ecd7aacf10fea1b72b99e5c43c4c59498a70cf256b4d2b7fb185b742ba0e208deb76ca8cceea449e1601ad1cc416d5d83f9f2f96de9b5cf3702d19d2931265b8455a5ec049eb26df6289ef6c15096785f6ea390e4921447d55d0d753bf34d9699a6612c4406bdd99be3cc350d17e9a21a6d578ef0a2b7b84dec15f53c1e8835ce287ad7d3bfea53f44328899f7373143794c12b1a581ba5b83430cbba847d7b366e7951c0e692164f00a6fe183678f64e7c2d30214dd34b9c5a817db3e73a988691801db65c40658cb7f47849bfe51642b0d1127d81f50bfb0e2088f7e8d47f3df63a31a94b82dac51d6dcf9fd8df3f422e39d89ff9c251997e4c4a32c771f39798dbbcc305f6893ad315179f22e70e20eb17b6f638a9fac8d4175cea7b3c798191f39ef27e884f2741e019d34de9485178195be6cd94b48e11e0292b61fe1481d05fa1cff3d6d978197ac7d514b8931252e0668a6260480b42afdb8ab7df0b82d0608e33966907f5b1b3f53e24d938369ac80993e9d0fa7e474dce6271b8f5a8747e7b4b1aadf1815652272d742b98610b89910d17411cc42baaf751c2e5a03bf5fcba72f5ee3af7d49fdff3454a9a8a308e4f30a309e00a0431881064ece75d64d3e250abd1ac3ca95f8a55b72960b0a9888299f414793593ec205b658611da61ac787d3e74ee5a3c16b569b20dc17024d8287c89942f83c61a52005b742c44e9a8c9be74ec7de9bdbc90b0efbd7902cce93ce85cb5e34c40d7bfeab6c2c869eb2f03799e35dfa884fd7a5e6eca2c5f8f1be224d8144ee2e5498670e12ff14fedfd444361a69da77dccf0852b6d0cfed2047338f26dde412802f29c551060e0cbdc6e66eba292f07f24b5eb7be0b9718488f86d465f09ce76f2c7545003fbc88be6090279b01e2d7a0166617930739b7bdac57be367f2fbf057aff7b0125d044478a5c8ffeeb5ab430816e6cf280452991f9bcc81bd99f886d8b59da4b7522e85b6bbdd8fec9e529153a63a6d466762f616b224bd20ba125c89694d896041cae54fa6d972bf2c360e3d839f985c6cad17cff9966839b0f47b989d735d73f7eb14a0548c3f696e31d9f073728e354df1b8a40fcf3332095d44d477832c656d1d6cc4476ed3a99772c87ca8d8e23dea993920b8c3d9efe6b1136fdf5680db00a178bad1ed8afc93eb8642ddfc27cc883a3d8ce77662fcda01cbd01e611777701de6da3313c3b000f7687d52d02193c0cd1921bdc2633c0e5a656d1d00b592a1e4136e66323ce3f161dc5d1e6e9659916edfc9ee64984794c51a60ddde9104c8a6fcecf29633d2f43f57575e50347197cef36ad9e764ce1b8853380f92781eac398b95c7068787f734658610c2c7491bba9320c51220e462cd2d98b3a63b02d3fc6548a51c3b0e403d9dd8b11f586086b79b58ab2a3af87f926e78cdf5bdbff25ac855bd11d03ba7d8b48367ab615de3e1cce5275b97da2f6e52fff1b944b3ea5451004a87f9de081d95f12adc729bb9165ab318d8102e0e71712a3c36ec58ad236a6615d0ee8518346479a0f612344f0ba78e7cdbb5ea651eede6f9039a9491af778140582f6e3c5d6c996196233a8822b1621fd89b2aaebd910881698db730de0d0e6e970d0092f5558b1a25224c5b255d0beb8c6aca57a4bae18ffa0774e91bf3f20255c20d26f09d84e33b592e5a2c3f5a38dc90b5d59d8ade5546ca538edc9ab753707df7d023cedfb5c64f6406a40de4aad37d7bb470483847c7a1e5db511d999c02d9cdfec6eb7bed33e4eabb8f444aa0013c694516d89c1a59e399f9cb68dd931368091c5a4cc7a9e606d8283edeac861f294c716829904ace4bbe05059b0e7c8dfe00bb1184ae99e6ade4d2eb05560bc45d2cdb66048afcc27e7d668507ba7de8f4b9bb36de4fcad5d01143257125aececf5ab01458ca783dbdb1c934bb2dcab186526b6a38ea4ff1f81c0bb2ebdc7d79c31a4e5659f52e0e2bb16a9cfe78bfae17f9764ddbd99b12d80b8f7143e009f42d1568d8ffe4b59ba14f01d070d8d4258ec9d5171a5a2768ab724a5de45d761925576f4ebdb7782e6a9c165056a8876cadec88b5009c2f359018fb71e9cb561e785c874759aa26a7a0f3ca7bb30221e6916736dbf834bff17a06b77f1c07c3aabe6744e475adbc1c68a6fa665bca183ef9d189b3f6d8ee561d600b8eb1049ab074e5c48f05c7b639b863bf744d9acb38688d53d74410e6afbfb3bbe30bdbc33af6f032b2c60186f0a7df1b0ec4550703b632fb4d45f319427806cbc807477a7e00c7df0cf4858a86040ba4982c7e510aacb1c08897ec4353787040000000780d7670aeb61687120409725731f9515549470d713da6985fe8639e7e1d7957d343ff428768ea5f6c22d8093995b1f39d11330db0f70f4866a6a3da1147d873	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00184006553B79F9"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1092 PING.EXE

pid	process
1092	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exeb878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

pid	process
2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
4372	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
4372	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
4372	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
4372	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.execmd.exe

description	pid	process	target process
PID 2700 wrote to memory of 4372	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
PID 2700 wrote to memory of 4372	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
PID 2700 wrote to memory of 4372	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
PID 2700 wrote to memory of 772	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	cmd.exe
PID 2700 wrote to memory of 772	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	cmd.exe
PID 2700 wrote to memory of 772	2700	b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe	cmd.exe
PID 772 wrote to memory of 1092	772	cmd.exe	PING.EXE
PID 772 wrote to memory of 1092	772	cmd.exe	PING.EXE
PID 772 wrote to memory of 1092	772	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
"C:\Users\Admin\AppData\Local\Temp\b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe
C:\Users\Admin\AppData\Local\Temp\b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\b878bd80fd1a99dddf1ffb934bd9250b058197eb7f9c726078c38aa296f13205.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

Peripheral Device Discovery

1

T1120

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-134-0x00000000021D0000-0x000000000222A000-memory.dmp

Filesize
360KB

Download
memory/2700-135-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4372-136-0x00000000004E0000-0x000000000053A000-memory.dmp

Filesize
360KB

Download
memory/4372-137-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads