teslacrypt | 61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f

General

Target

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
Size

344KB
MD5

2bba3e4d34098cc1ffbb8ddd8cd64086
SHA1

e353968444ce29d8a23a24506ed9f68604c6ad15
SHA256

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f
SHA512

35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e

Score

10^/10

teslacrypt persistence ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3762437355-3468409815-1164039494-1000\Recovery+fhanx.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4D553F50B1428D 2. http://tes543berda73i48fsdfsd.keratadze.at/4D553F50B1428D 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4D553F50B1428D If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/4D553F50B1428D 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4D553F50B1428D http://tes543berda73i48fsdfsd.keratadze.at/4D553F50B1428D http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4D553F50B1428D *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/4D553F50B1428D

URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/4D553F50B1428D

http://tes543berda73i48fsdfsd.keratadze.at/4D553F50B1428D

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4D553F50B1428D

http://xlowfznrg4wf7dli.ONION/4D553F50B1428D

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

ydximfumafhs.exeydximfumafhs.exe

pid process

1516 ydximfumafhs.exe
1420 ydximfumafhs.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

272 cmd.exe

pid	process
1516	ydximfumafhs.exe
1420	ydximfumafhs.exe

pid	process
272	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ydximfumafhs.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run	ydximfumafhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\kncphxlbjufy = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ydximfumafhs.exe\""	ydximfumafhs.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exeydximfumafhs.exe

description	pid	process	target process
PID 1212 set thread context of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1516 set thread context of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe

Drops file in Program Files directory 18 IoCs

Processes:

ydximfumafhs.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ydximfumafhs.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	ydximfumafhs.exe

Drops file in Windows directory 2 IoCs

Processes:

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe

description	ioc	process
File created	C:\Windows\ydximfumafhs.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
File opened for modification	C:\Windows\ydximfumafhs.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

ydximfumafhs.exe

pid	process
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe
1420	ydximfumafhs.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exeydximfumafhs.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
Token: SeDebugPrivilege	1420	ydximfumafhs.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: SeBackupPrivilege	1800	vssvc.exe
Token: SeRestorePrivilege	1800	vssvc.exe
Token: SeAuditPrivilege	1800	vssvc.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exeydximfumafhs.exeydximfumafhs.exe

description	pid	process	target process
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1212 wrote to memory of 1612	1212	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
PID 1612 wrote to memory of 1516	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	ydximfumafhs.exe
PID 1612 wrote to memory of 1516	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	ydximfumafhs.exe
PID 1612 wrote to memory of 1516	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	ydximfumafhs.exe
PID 1612 wrote to memory of 1516	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	ydximfumafhs.exe
PID 1612 wrote to memory of 272	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	cmd.exe
PID 1612 wrote to memory of 272	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	cmd.exe
PID 1612 wrote to memory of 272	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	cmd.exe
PID 1612 wrote to memory of 272	1612	61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe	cmd.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1516 wrote to memory of 1420	1516	ydximfumafhs.exe	ydximfumafhs.exe
PID 1420 wrote to memory of 1128	1420	ydximfumafhs.exe	WMIC.exe
PID 1420 wrote to memory of 1128	1420	ydximfumafhs.exe	WMIC.exe
PID 1420 wrote to memory of 1128	1420	ydximfumafhs.exe	WMIC.exe
PID 1420 wrote to memory of 1128	1420	ydximfumafhs.exe	WMIC.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

ydximfumafhs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ydximfumafhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ydximfumafhs.exe

C:\Users\Admin\AppData\Local\Temp\61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
"C:\Users\Admin\AppData\Local\Temp\61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe
  "C:\Users\Admin\AppData\Local\Temp\61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\ydximfumafhs.exe
    C:\Windows\ydximfumafhs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\ydximfumafhs.exe
      C:\Windows\ydximfumafhs.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1420
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\61CC8C~1.EXE
    3⤵
    - Deletes itself
    PID:272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ydximfumafhs.exe

Filesize
344KB

MD5
2bba3e4d34098cc1ffbb8ddd8cd64086

SHA1
e353968444ce29d8a23a24506ed9f68604c6ad15

SHA256
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f

SHA512
35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e

Download Submit
C:\Windows\ydximfumafhs.exe

Filesize
344KB

MD5
2bba3e4d34098cc1ffbb8ddd8cd64086

SHA1
e353968444ce29d8a23a24506ed9f68604c6ad15

SHA256
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f

SHA512
35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e

Download Submit
C:\Windows\ydximfumafhs.exe

Filesize
344KB

MD5
2bba3e4d34098cc1ffbb8ddd8cd64086

SHA1
e353968444ce29d8a23a24506ed9f68604c6ad15

SHA256
61cc8c36085bc4a140f74d11b99ef047877d8f9d4107418627a3f978c495095f

SHA512
35a9a77d93070a60ee8dfb4150754da61b59641df4b619f44ce94933ddb43d6d88ab1ad612a50541d15e7dc5711922d42b31a5accaf33ab8b9f8dad2eee4cc0e

Download Submit
memory/272-73-0x0000000000000000-mapping.dmp

Download
memory/1128-93-0x0000000000000000-mapping.dmp

Download
memory/1212-67-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/1212-54-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/1420-92-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1420-91-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1420-90-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1420-86-0x000000000042807A-mapping.dmp

Download
memory/1516-71-0x0000000000000000-mapping.dmp

Download
memory/1612-69-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-70-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-68-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1612-74-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-65-0x000000000042807A-mapping.dmp

Download
memory/1612-64-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-62-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-60-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-58-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-56-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1612-55-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads