hawkeye_reborn | 28a9efaa0066284841bb50868b5fd270511bea6321aa99b9eb338fdbc8b77194

General

Target

purchase order.msi
Size

2.3MB
MD5

c5d5542f35dff3d7f92dbc4c6a0ec56c
SHA1

6c37078b59c85448605ee96888ac00cb0b5f0654
SHA256

39f9b4647bb119e34deeff137af960448be14dd80f0443270739c02d450b8ecf
SHA512

110ddbdb35e2319f2d1939b40e0e950f129d46b51b985c56edb8e23c8e5ee29f76a03ea6ab5001f6a697aa94769856d74145f3b8f6122ea9f09d68db45120efa

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Mutex

ca8b7835-2ac0-4a33-a17c-532dfc1a88cf

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:3 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPort:0 _EmailSSL:false _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ca8b7835-2ac0-4a33-a17c-532dfc1a88cf _PanelSecret:c9c9179f-8536-c2ed-1aa7-87bff231f0ce _PanelURL:http://patrogabon.com/jayjayman2 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger Payload 4 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1320-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1320-68-0x000000000048B2FE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1320-70-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1320-69-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

Executes dropped EXE 1 IoCs

Processes:

MSI532.tmp

pid process

1912 MSI532.tmp
Drops startup file 1 IoCs

Processes:

MSI532.tmp

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MaxxAudioMeters64.url MSI532.tmp

pid	process
1912	MSI532.tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MaxxAudioMeters64.url	MSI532.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Windows\Installer\MSI532.tmp	autoit_exe
C:\Windows\Installer\MSI532.tmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

MSI532.tmp

description pid process target process

PID 1912 set thread context of 1320 1912 MSI532.tmp RegAsm.exe

description	pid	process	target process
PID 1912 set thread context of 1320	1912	MSI532.tmp	RegAsm.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6df8d1.msi	msiexec.exe
File created	C:\Windows\Installer\6df8d3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI532.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6df8d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6df8d3.ipi	msiexec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

952 msiexec.exe
952 msiexec.exe

pid	process
952	msiexec.exe
952	msiexec.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1280	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeSecurityPrivilege	952	msiexec.exe
Token: SeCreateTokenPrivilege	1280	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1280	msiexec.exe
Token: SeLockMemoryPrivilege	1280	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1280	msiexec.exe
Token: SeMachineAccountPrivilege	1280	msiexec.exe
Token: SeTcbPrivilege	1280	msiexec.exe
Token: SeSecurityPrivilege	1280	msiexec.exe
Token: SeTakeOwnershipPrivilege	1280	msiexec.exe
Token: SeLoadDriverPrivilege	1280	msiexec.exe
Token: SeSystemProfilePrivilege	1280	msiexec.exe
Token: SeSystemtimePrivilege	1280	msiexec.exe
Token: SeProfSingleProcessPrivilege	1280	msiexec.exe
Token: SeIncBasePriorityPrivilege	1280	msiexec.exe
Token: SeCreatePagefilePrivilege	1280	msiexec.exe
Token: SeCreatePermanentPrivilege	1280	msiexec.exe
Token: SeBackupPrivilege	1280	msiexec.exe
Token: SeRestorePrivilege	1280	msiexec.exe
Token: SeShutdownPrivilege	1280	msiexec.exe
Token: SeDebugPrivilege	1280	msiexec.exe
Token: SeAuditPrivilege	1280	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1280	msiexec.exe
Token: SeChangeNotifyPrivilege	1280	msiexec.exe
Token: SeRemoteShutdownPrivilege	1280	msiexec.exe
Token: SeUndockPrivilege	1280	msiexec.exe
Token: SeSyncAgentPrivilege	1280	msiexec.exe
Token: SeEnableDelegationPrivilege	1280	msiexec.exe
Token: SeManageVolumePrivilege	1280	msiexec.exe
Token: SeImpersonatePrivilege	1280	msiexec.exe
Token: SeCreateGlobalPrivilege	1280	msiexec.exe
Token: SeBackupPrivilege	1452	vssvc.exe
Token: SeRestorePrivilege	1452	vssvc.exe
Token: SeAuditPrivilege	1452	vssvc.exe
Token: SeBackupPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	1600	DrvInst.exe
Token: SeLoadDriverPrivilege	1600	DrvInst.exe
Token: SeLoadDriverPrivilege	1600	DrvInst.exe
Token: SeLoadDriverPrivilege	1600	DrvInst.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe
Token: SeRestorePrivilege	952	msiexec.exe
Token: SeTakeOwnershipPrivilege	952	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1280 msiexec.exe
1280 msiexec.exe

pid	process
1280	msiexec.exe
1280	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

msiexec.exeMSI532.tmp

description	pid	process	target process
PID 952 wrote to memory of 1912	952	msiexec.exe	MSI532.tmp
PID 952 wrote to memory of 1912	952	msiexec.exe	MSI532.tmp
PID 952 wrote to memory of 1912	952	msiexec.exe	MSI532.tmp
PID 952 wrote to memory of 1912	952	msiexec.exe	MSI532.tmp
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe
PID 1912 wrote to memory of 1320	1912	MSI532.tmp	RegAsm.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\purchase order.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1280

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\Installer\MSI532.tmp
"C:\Windows\Installer\MSI532.tmp"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
3⤵
PID:1320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000494" "0000000000000570"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1600

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI532.tmp
Filesize
2.3MB

MD5
6ed84ffdf8184258763731cd34f6d4d3

SHA1
015bae0bc0ab2bf4730fa81c6a2b0d5d28a607db

SHA256
9cebc436acc05d484b4b50067704e089aab8353c17faefbed887aecf92caf472

SHA512
7f44c3f945f5790275ebaf37131788d05791029155b1c044ae68737b6357a090e7c6a28fc77b9c2d608c699e399e90be02b0ea1ec64541ad774b90a4ab7a7b61

Download Submit
C:\Windows\Installer\MSI532.tmp
Filesize
2.3MB

MD5
6ed84ffdf8184258763731cd34f6d4d3

SHA1
015bae0bc0ab2bf4730fa81c6a2b0d5d28a607db

SHA256
9cebc436acc05d484b4b50067704e089aab8353c17faefbed887aecf92caf472

SHA512
7f44c3f945f5790275ebaf37131788d05791029155b1c044ae68737b6357a090e7c6a28fc77b9c2d608c699e399e90be02b0ea1ec64541ad774b90a4ab7a7b61

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1280-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Filesize
8KB

Download
memory/1320-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1320-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1320-68-0x000000000048B2FE-mapping.dmp

Download
memory/1320-70-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1320-69-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1320-72-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1320-73-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1912-59-0x00000000756E1000-0x00000000756E3000-memory.dmp

Filesize
8KB

Download
memory/1912-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads