remcos | a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

General

Target

185rms.exe
Size

2.8MB
MD5

6cfceeb676d49151e8c2fec9c4209789
SHA1

42c87894f183c3612e1662f531003bbe7478f875
SHA256

a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e
SHA512

a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Score

10^/10

remcos rh1 evasion persistence rat themida trojan

Malware Config

Extracted

Family

remcos

Botnet

RH1

C2

185.29.9.125:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
itunes.exe
copy_folder
RMS
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Jd1985-XODZWD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Rms
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

185rms.exeitunes.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	185rms.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	itunes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

itunes.exe

pid process

456 itunes.exe

pid	process
456	itunes.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe185rms.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	185rms.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	itunes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Deletes itself 1 IoCs

Processes:

WScript.exe

pid process

1312 WScript.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

912 cmd.exe
912 cmd.exe

pid	process
1312	WScript.exe

pid	process
912	cmd.exe
912	cmd.exe

Themida packer 43 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1884-55-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-56-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-57-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-58-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-60-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-61-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
behavioral1/memory/1884-65-0x0000000000330000-0x0000000000A4F000-memory.dmp	themida
\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe	themida
behavioral1/memory/456-76-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/456-77-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/456-78-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/456-79-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/456-80-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/980-84-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-87-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-89-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-90-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-91-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-92-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-94-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-96-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-97-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-98-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-100-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-102-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-103-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-107-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-108-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-109-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-110-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-111-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-113-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-114-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-115-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-116-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-117-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-118-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/980-119-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida
behavioral1/memory/456-122-0x0000000000990000-0x00000000010AF000-memory.dmp	themida
behavioral1/memory/980-124-0x0000000000400000-0x0000000000B1F000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

185rms.exeitunes.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\	185rms.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	185rms.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\	itunes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rms = "\"C:\\Users\\Admin\\AppData\\Roaming\\RMS\\itunes.exe\""	itunes.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

185rms.exeitunes.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	185rms.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	itunes.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

185rms.exeitunes.exesvchost.exe

pid process

1884 185rms.exe
456 itunes.exe
980 svchost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

itunes.exe

description pid process target process

PID 456 set thread context of 980 456 itunes.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

620 reg.exe
996 reg.exe

pid	process
1884	185rms.exe
456	itunes.exe
980	svchost.exe

description	pid	process	target process
PID 456 set thread context of 980	456	itunes.exe	svchost.exe

pid	process
620	reg.exe
996	reg.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

185rms.execmd.exeWScript.execmd.exeitunes.execmd.exe

description	pid	process	target process
PID 1884 wrote to memory of 1260	1884	185rms.exe	cmd.exe
PID 1884 wrote to memory of 1260	1884	185rms.exe	cmd.exe
PID 1884 wrote to memory of 1260	1884	185rms.exe	cmd.exe
PID 1884 wrote to memory of 1260	1884	185rms.exe	cmd.exe
PID 1260 wrote to memory of 620	1260	cmd.exe	reg.exe
PID 1260 wrote to memory of 620	1260	cmd.exe	reg.exe
PID 1260 wrote to memory of 620	1260	cmd.exe	reg.exe
PID 1260 wrote to memory of 620	1260	cmd.exe	reg.exe
PID 1884 wrote to memory of 1312	1884	185rms.exe	WScript.exe
PID 1884 wrote to memory of 1312	1884	185rms.exe	WScript.exe
PID 1884 wrote to memory of 1312	1884	185rms.exe	WScript.exe
PID 1884 wrote to memory of 1312	1884	185rms.exe	WScript.exe
PID 1312 wrote to memory of 912	1312	WScript.exe	cmd.exe
PID 1312 wrote to memory of 912	1312	WScript.exe	cmd.exe
PID 1312 wrote to memory of 912	1312	WScript.exe	cmd.exe
PID 1312 wrote to memory of 912	1312	WScript.exe	cmd.exe
PID 912 wrote to memory of 456	912	cmd.exe	itunes.exe
PID 912 wrote to memory of 456	912	cmd.exe	itunes.exe
PID 912 wrote to memory of 456	912	cmd.exe	itunes.exe
PID 912 wrote to memory of 456	912	cmd.exe	itunes.exe
PID 456 wrote to memory of 1088	456	itunes.exe	cmd.exe
PID 456 wrote to memory of 1088	456	itunes.exe	cmd.exe
PID 456 wrote to memory of 1088	456	itunes.exe	cmd.exe
PID 456 wrote to memory of 1088	456	itunes.exe	cmd.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 1088 wrote to memory of 996	1088	cmd.exe	reg.exe
PID 1088 wrote to memory of 996	1088	cmd.exe	reg.exe
PID 1088 wrote to memory of 996	1088	cmd.exe	reg.exe
PID 1088 wrote to memory of 996	1088	cmd.exe	reg.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe
PID 456 wrote to memory of 980	456	itunes.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\185rms.exe
"C:\Users\Admin\AppData\Local\Temp\185rms.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- UAC bypass
- Modifies registry key
PID:620

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\RMS\itunes.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:456

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
6⤵
- UAC bypass
- Modifies registry key
PID:996

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
536B

MD5
9f75de802bf74aeb51ff665f8d009420

SHA1
16bf08edffd90ff78e409e8461cc9b6b12ceb93b

SHA256
753ec32a971c16ea202a0f8ebb7bce551b5ff8d8c546f26bdf4a3069a5c50c48

SHA512
bf1df2ce961e0ddd2a741228cc9dafed88ffc447145e553a49f101e475cd99910c7d114c8cdd18d6ce05eb9684d28666d44ca2800d9f5d64e553372663f0242f

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
C:\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
\Users\Admin\AppData\Roaming\RMS\itunes.exe
Filesize
2.8MB

MD5
6cfceeb676d49151e8c2fec9c4209789

SHA1
42c87894f183c3612e1662f531003bbe7478f875

SHA256
a2fad2958e6dd09d0d980d4e5d158c2a2eb18963d47fc95779c22bc2d203cb8e

SHA512
a371d0b6f4bed336e01b6025cc584f27f939f0fea9f92e36aa63295164e31eebccf24cdae24e04fcbdb0545169454d3b9944630c2cfde49dd8681496005cac89

Download Submit
memory/456-77-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-79-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-78-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-76-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-80-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-73-0x0000000000000000-mapping.dmp

Download
memory/456-122-0x0000000000990000-0x00000000010AF000-memory.dmp

Filesize
7.1MB

Download
memory/456-123-0x0000000077600000-0x0000000077780000-memory.dmp

Filesize
1.5MB

Download
memory/620-63-0x0000000000000000-mapping.dmp

Download
memory/912-81-0x00000000020F0000-0x000000000280F000-memory.dmp

Filesize
7.1MB

Download
memory/912-121-0x00000000020F0000-0x000000000280F000-memory.dmp

Filesize
7.1MB

Download
memory/912-69-0x0000000000000000-mapping.dmp

Download
memory/980-89-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-112-0x0000000077600000-0x0000000077780000-memory.dmp

Filesize
1.5MB

Download
memory/980-125-0x0000000077600000-0x0000000077780000-memory.dmp

Filesize
1.5MB

Download
memory/980-124-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-120-0x0000000000401000-0x0000000000454000-memory.dmp

Filesize
332KB

Download
memory/980-119-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-118-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-117-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-116-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-115-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-84-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-114-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-87-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-113-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-90-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-91-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-92-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-94-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-96-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-97-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-98-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-100-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-102-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-103-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-104-0x000000000089B058-mapping.dmp

Download
memory/980-107-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-108-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-109-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-110-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/980-111-0x0000000000400000-0x0000000000B1F000-memory.dmp

Filesize
7.1MB

Download
memory/996-85-0x0000000000000000-mapping.dmp

Download
memory/1088-82-0x0000000000000000-mapping.dmp

Download
memory/1260-62-0x0000000000000000-mapping.dmp

Download
memory/1312-64-0x0000000000000000-mapping.dmp

Download
memory/1884-60-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-59-0x0000000077600000-0x0000000077780000-memory.dmp

Filesize
1.5MB

Download
memory/1884-54-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download
memory/1884-61-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-58-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-57-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-56-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-55-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download
memory/1884-66-0x0000000077600000-0x0000000077780000-memory.dmp

Filesize
1.5MB

Download
memory/1884-65-0x0000000000330000-0x0000000000A4F000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads