ramnit | 1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e

General

Target

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
Size

1.3MB
MD5

1aab0bc42e16efbbe769dd65414c848d
SHA1

8e3c247de2459f9ed4885999678a8dcc15b54881
SHA256

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e
SHA512

c10e307dc85467ba2dbd955f6387f44a3a67476afc5e8f8c98e695dca12fc452eed41b76a9f087b5db7b2ab1db4f390048059e1ca0664f78a08a07fcd078c248

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

Executes dropped EXE 3 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exeDesktopLayer.exe

pid	process
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
3452	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
4320	DesktopLayer.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral2/memory/3452-139-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/4320-142-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral2/memory/4668-144-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

pid	process
3460	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Drops file in Program Files directory 3 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\px222E.tmp	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1649371706"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30965412"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1649371706"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30965412"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361834709"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84DD33DE-EA97-11EC-B274-66F9B3FFC396} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

DesktopLayer.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

pid	process
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4320	DesktopLayer.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4248 iexplore.exe

pid	process
4248	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeiexplore.exeIEXPLORE.EXE

pid	process
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4248	iexplore.exe
4248	iexplore.exe
4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
4804	IEXPLORE.EXE
4804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exeÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 3460 wrote to memory of 4668	3460	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 3460 wrote to memory of 4668	3460	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 3460 wrote to memory of 4668	3460	1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
PID 4668 wrote to memory of 3452	4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 4668 wrote to memory of 3452	4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 4668 wrote to memory of 3452	4668	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
PID 3452 wrote to memory of 4320	3452	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 3452 wrote to memory of 4320	3452	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 3452 wrote to memory of 4320	3452	ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe	DesktopLayer.exe
PID 4320 wrote to memory of 4248	4320	DesktopLayer.exe	iexplore.exe
PID 4320 wrote to memory of 4248	4320	DesktopLayer.exe	iexplore.exe
PID 4248 wrote to memory of 4804	4248	iexplore.exe	IEXPLORE.EXE
PID 4248 wrote to memory of 4804	4248	iexplore.exe	IEXPLORE.EXE
PID 4248 wrote to memory of 4804	4248	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe
"C:\Users\Admin\AppData\Local\Temp\1ffe5501b656c49a8c3a723834ee0da9ad2af65c780720f57d6d65f7fcdfdc1e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe
"C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3452

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4248 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscDAE.tmp\AdvSplash.dll

Filesize
6KB

MD5
a1bba35c752b36f575350cb7ddf238e4

SHA1
9603b691ae71d4fbc7a14dbb837bd97cecac8aab

SHA256
0667863d71a3021ab844069b6dd0485f874bf638af478ab11c6fb8b7d6c834b6

SHA512
eb5d3498dd994bec42a437cf91343665d3c35bfe3f6277a7393af6a0b8348772c3166d9be48955edddf6ef79fa508ec8d4f96d7d5df37ecdc52c90042e0a2967

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29.exe

Filesize
2.9MB

MD5
cb8be6ad417786404e7bab9c74da5f20

SHA1
f6a2a383b9dc0ba3c8b933e6076dcf1d45dfdab8

SHA256
01d11e02fecdaf133199c13be48296c8a3f6119c06291566eb3f8da236c62a3c

SHA512
144f06c724b3b17775adb9511ae6a10a1db60f35c91fd1b5c8fcd1a03f3df2da7e0e963e523e0e3e0c026fe14fd1a61cca9857daaa216dbb433905e2155cdb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÏÀµÁ·É³µ£ºÊ¥°²µØÁÐË¹MOD¹ÜÀí¹¤¾ß3.1.29Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/3452-134-0x0000000000000000-mapping.dmp

Download
memory/3452-139-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4320-137-0x0000000000000000-mapping.dmp

Download
memory/4320-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4668-141-0x0000000000400000-0x0000000000737000-memory.dmp

Filesize
3.2MB

Download
memory/4668-131-0x0000000000000000-mapping.dmp

Download
memory/4668-144-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4668-145-0x0000000000400000-0x0000000000737000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads