locky | 3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311

General

Target

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
Size

251KB
MD5

3b522c3e3fc6cf29a2c8c65a80f14a08
SHA1

91d0554ae2d347a98a695b4ee9aea4061794bb38
SHA256

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311
SHA512

a1dba2dd77ae3637b0809aece3ffb8827e21498d3127b56d6390ced34444ccf10c56a2741b4c52cf53efa5ab0dcdcfc52e68561322dab74d975e9e15b6d545aa

Score

10^/10

locky ransomware suricata

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
suricata: ET MALWARE Self-Signed Cert Observed in Various Zbot Strains
suricata: ET MALWARE Self-Signed Cert Observed in Various Zbot Strains
suricata

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

description	ioc	process
File opened for modification	\??\c:\Users\Admin\Pictures\SearchResume.tiff	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SuspendTrace.tiff	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

864 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

pid process

304 3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

pid	process
864	cmd.exe

pid	process
304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\_HELP_instructions.bmp"	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

description	pid	process	target process
PID 304 set thread context of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\WallpaperStyle = "0"	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\TileWallpaper = "0"	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000009aa78e8b8dbd203a5922b2f86d62444d3914c9f0168f4f6ee1938cfc237ba7db000000000e8000000002000020000000c347060d9959ae63f04e9a0a7bb234977af33779091afe4e288569dc3bdd94af900000007fb4e0405315b40ee372bf964d3c79ff4c2c5d78ceb93466d3f04352f5289cb63990867fd663d095877a04e11e44097f162132495e68b66dd84306ac7aa3dfec5dab965ea91be6400cc8b766f7ab063a5d13351183b3abc5dffee3d24115cdb1e94bde43c932d8524be906f9cc758ee49f37c8fdd49e283b15c2ec1fa0224ee54cb736c6577b659315a6bb27c64c197340000000aff773681e26851f50277d7866c13634246f531337c216bfd0fa2e9ed0aa18572b470176384e960b1faf4dfb31db9801b5e603ab4fb26a56c1041e2dad78980c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{445BCB01-F70E-11EC-9D77-66DE0394A5F7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408dcf191b8bd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "363205094"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c0000000002000000000010660000000100002000000090e11a57d24c0165c9b4fffff1546ffb27328b98c5b063affafd74e3d3e00e10000000000e8000000002000020000000b77569d8f90f5a2c8af0f7e821d6049c3ef2811a322f58d8eb54dc13f74feb50200000003964dd8a45ba8cdeea456b4cab9b89558b6bb20d2e7f9cc59fc3437dcb84175b4000000029332234ff27d8a4a5d5e1f1d9962f22f2fdeff4bb03e57c9781f4bf19a0f726b11b7baff324453b5de7308d6cec441ca9328f644e75f6110abf44665e91ee33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

pid process

304 3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

972 iexplore.exe
784 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

972 iexplore.exe
972 iexplore.exe
1700 IEXPLORE.EXE
1700 IEXPLORE.EXE

pid	process
304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe

pid	process
972	iexplore.exe
784	DllHost.exe

pid	process
972	iexplore.exe
972	iexplore.exe
1700	IEXPLORE.EXE
1700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exeiexplore.exe

description	pid	process	target process
PID 304 wrote to memory of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
PID 304 wrote to memory of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
PID 304 wrote to memory of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
PID 304 wrote to memory of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
PID 304 wrote to memory of 1900	304	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
PID 1900 wrote to memory of 972	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	iexplore.exe
PID 1900 wrote to memory of 972	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	iexplore.exe
PID 1900 wrote to memory of 972	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	iexplore.exe
PID 1900 wrote to memory of 972	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	iexplore.exe
PID 972 wrote to memory of 1700	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1700	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1700	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1700	972	iexplore.exe	IEXPLORE.EXE
PID 1900 wrote to memory of 864	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	cmd.exe
PID 1900 wrote to memory of 864	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	cmd.exe
PID 1900 wrote to memory of 864	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	cmd.exe
PID 1900 wrote to memory of 864	1900	3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
"C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe
"C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe"
2⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_HELP_instructions.html
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\3924b012439ef8ce1946af7e7f8396ecb97e4c564cffa6d18b9cfccd5645c311.exe"
3⤵
- Deletes itself
PID:864

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
308336e7f515478969b24c13ded11ede

SHA1
8fb0cf42b77dbbef224a1e5fc38abc2486320775

SHA256
889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9

SHA512
61ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b08566d679ac683b812e071b9eaf4625

SHA1
d84a0c31674b21404f2a1cb5ac7a1a3b2b1a1693

SHA256
bf4863e07f5bd4328b0fbd24cdf2526322fd02f9a6ad8b71567a41896a9c46d7

SHA512
299a7b57399e57f3f30c0c4cc81e827d6fd9cf39d79ce80062e0c863e4022735104ee1383c82a2f40b1a22a4805d8cda352a490d8c4d38aa6d739eed9173f753

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FQ7CCS06.txt
Filesize
599B

MD5
60d371c36f91fd02a1928a47ea17445a

SHA1
c3ecd9713bf644885dc8b103b9626e89572130bb

SHA256
85032141ecdbdd11e8bf8572e57c0da87c9b38e9d04bcec94445355e360f1c9c

SHA512
905220228d16356c8a25fd4ca235b7cb9280652d2c710f1bfc37ec73f79f27722eed708823f28913f4cc7a036aa0839054500d291bd0158216bac1c440a40882

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.bmp
Filesize
3.5MB

MD5
2f52128003c21d3f93d6b99fabcb65f6

SHA1
851c0052bd759812664426d771cc60a422722423

SHA256
ed370120793955d8127ce84824fe62e285b06bed38922843924398a5289c311a

SHA512
1e5b9d7607cb33880f1d3eb8d2c474c4db59363813c408704f320ca5431a9e1ba387df6c88656b7faf8f8d02b292a95e05ddf25e864c11da24a4b1f38aafce3f

Download Submit
C:\Users\Admin\Desktop\_HELP_instructions.html
Filesize
9KB

MD5
a03db2c8d24f594c682bb26921d86aa6

SHA1
261900251d936aedb6bde9d780eb10594e88e84c

SHA256
cfef3317a7fdd39e293585962b75a0eb730bcf46267162d1ba24757c9610d8b0

SHA512
693011254d35be6ee078f7c41fdf5b942802dea3d5f4970a442d64cd7c2c5c99fc26fd2ba598f7a13378e7b6e444c9cb1853bd14f82ceadc1d8afdf40a700aeb

Download Submit
\Users\Admin\AppData\Local\Temp\nsj6386.tmp\System.dll
Filesize
11KB

MD5
3e6bf00b3ac976122f982ae2aadb1c51

SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

Download Submit
memory/304-56-0x0000000000340000-0x0000000000344000-memory.dmp

Filesize
16KB

Download
memory/304-59-0x0000000000340000-0x0000000000344000-memory.dmp

Filesize
16KB

Download
memory/304-54-0x0000000075311000-0x0000000075313000-memory.dmp

Filesize
8KB

Download
memory/864-64-0x0000000000000000-mapping.dmp

Download
memory/1900-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1900-65-0x00000000005C0000-0x00000000005E6000-memory.dmp

Filesize
152KB

Download
memory/1900-62-0x00000000005C0000-0x00000000005E6000-memory.dmp

Filesize
152KB

Download
memory/1900-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1900-57-0x000000000040560B-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads