qakbot | 30bef9a5f75a235e9823beb54267c1bb7faacc9e067bcb4bea367df702ce997e

General

Target

019338921.dll
Size

1.4MB
MD5

7bbeafc1ab9f9d1a48a99338ffec561c
SHA1

a4ce6de223addbdc66e747d3abd00b9f190fb5cb
SHA256

fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c
SHA512

a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263

Score

10^/10

qakbot obama186 1654596660 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.694

Botnet

obama186

Campaign

1654596660

C2

67.165.206.193:993

63.143.92.99:995

74.14.5.179:2222

182.191.92.203:995

197.89.8.51:443

89.101.97.139:443

86.97.9.190:443

124.40.244.115:2222

80.11.74.81:2222

41.215.153.104:995

179.100.20.32:32101

31.35.28.29:443

202.134.152.2:2222

109.12.111.14:443

93.48.80.198:995

120.150.218.241:995

41.38.167.179:995

177.94.57.126:32101

173.174.216.62:443

1.161.101.20:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Okuwg = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eeuzb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1844 regsvr32.exe

pid	process
1844	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe

pid	process
2040	schtasks.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\1b9b86c5 = b53ee059b0c906b7a46f96cdf9f479f3fffa9b8e6df4dd96fabca1c87cf4dd9febb3e8ac47f0a917102b0617e64f0a64962ea7d65dd2f98bda9413c6dfc80f792d7ba5789a1cac2c008815f58f92f69cd3deb7c30de1e8427ac890e2b4cb99b83d188d11bf18a8efd39d0dd1ad33d9e5350baf20d6e9180ded8d49f44c1967d54a1ce6e3b2185734b906	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}\WpadNetworkName = "Network 2"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\a327e1a0 = e46207fcd0d414dc02a90bb9a7201bcf70b58f2c85e3dca8391bd510ae634fa96b0064f69b96f0b2205db0fdf89c231ce0c1b9	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-c6-18-7d-84-6e\WpadDecisionTime = 50679d330db3d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\2e04568b = b6e9624727f135b013b2a13e61af800e345a2245e4c471a17e2e4945c287224f1c64836ccbbf2004dcebffc6fe8b69a1e0b51630ddf860f52d5a0c09b2827db626308eb5a92867f35924566c49e8f86d77511bbd890f357089a01217600f312750bb70924833045bc55e032ced2023dc937b7e61e60d894001	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}\WpadDecision = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-c6-18-7d-84-6e\WpadDecisionReason = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-c6-18-7d-84-6e\WpadDecision = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\19daa6b9 = a43ed49c9bea431c3ac30b6b73629d0ee2efeacc44462f75f473995c1f34e86f52d3e86b63970be1a1959321b06708ea4d321026f4bd4f4b980fcf1d0373178f1ad8	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\a166c1dc = f8d83fd7b92d6ae9f09dd196897efb659dc7b6a56b8f8bd5f2b8e6c0b7	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\64d2e933 = 1e1225c1b4eb321d10b7892ff65c7791dcf16df66298819edee5abfbefc5d6069189c3e1288dd873a76a3e1a82c8b7674e0279284fba33e6b6e9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\2e04568b = b6e9624727f135b013b2a13e61af800e345a2245e4c471a276284f45c287224f1c64836ccbbf2004dcebffc6fe8b69a1e0b51630ddf860f52d5a0c09b2827db626308eb5a92867f35924566c49e8f86d77511bbd890f357089a01217600f312750bb70924833045bc55e032ced2023dc937b7e61e60d894001	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-c6-18-7d-84-6e	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\2e04568b = b6e9754727f100d08f93f2d7723421c1fb7170177dcb832e71c207222350d9322c30d7c4f7d5a91ec9c4afe1de8cc1b5f6ab491a650386a5b8d651b4a68c04006ff1772e25b0c5e519cb64a4ad632202e3ecbb02228f022fd6fd2cc0c6c23cd1dd8a1dfb	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\dc6e8e56 = fd07dce35e8c23fcd99fbf2d862d2f6744a093b5e0044533cb93c5a21c9e450df5264bbd1e9b43eb6180900f58c725d78f3c58503276923d7e724176b7de060f0063ceac4818ed76057ad9	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\2e04568b = b6e96b4727f135b013b2a07464a48a0c3d592641a8cf79a17f264e73af1a001fbb7611cd3510977adbd7e8a7d04a42c3e36bc5e602e02bde6eff28e02ded5ea53496745c5627b250f56495c69a2ac70a7cf0c21cca04c7ffa66e916eac55d717cb17b5efe2ba58cde97e6c62e73f24dc9dae420a17444bb52b49291b6500eca903b1	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Dtubhpu\514d397d = a78a02b1d518101a56072136ddd82902d5502cd05e423c2f2c7e21b3d3c9b8d58801648ece27f4827107165b47a7d3c357bb8dfc71e82d0cbd92769349bddedcf1dd159ad0f69a3222541dda85173ae1358b26cd8ffcc1e968c2ed	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}\WpadDecisionReason = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}\WpadDecisionTime = 50679d330db3d801	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DA85E74-A8A4-45C8-B96C-171C5272707F}\52-c6-18-7d-84-6e	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeexplorer.exeregsvr32.exe

pid	process
768	rundll32.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
1844	regsvr32.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe
2016	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

rundll32.exeregsvr32.exe

pid process

768 rundll32.exe
1844 regsvr32.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exetaskeng.exeregsvr32.exeregsvr32.exeexplorer.exe

description	pid	process	target process
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 1092 wrote to memory of 768	1092	rundll32.exe	rundll32.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 768 wrote to memory of 2016	768	rundll32.exe	explorer.exe
PID 2016 wrote to memory of 2040	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2040	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2040	2016	explorer.exe	schtasks.exe
PID 2016 wrote to memory of 2040	2016	explorer.exe	schtasks.exe
PID 1692 wrote to memory of 560	1692	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 560	1692	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 560	1692	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 560	1692	taskeng.exe	regsvr32.exe
PID 1692 wrote to memory of 560	1692	taskeng.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 1844	560	regsvr32.exe	regsvr32.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1844 wrote to memory of 1088	1844	regsvr32.exe	explorer.exe
PID 1088 wrote to memory of 1716	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1716	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1716	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1716	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1908	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1908	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1908	1088	explorer.exe	reg.exe
PID 1088 wrote to memory of 1908	1088	explorer.exe	reg.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\019338921.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn qjtjkddzd /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\019338921.dll\"" /SC ONCE /Z /ST 14:10 /ET 14:22
4⤵
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\taskeng.exe
taskeng.exe {A79CC1B1-6761-459D-8DE0-A3D00887EA9C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\regsvr32.exe
-s "C:\Users\Admin\AppData\Local\Temp\019338921.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Okuwg" /d "0"
5⤵
- Windows security bypass
PID:1716

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eeuzb" /d "0"
5⤵
- Windows security bypass
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\019338921.dll
Filesize
1.4MB

MD5
7bbeafc1ab9f9d1a48a99338ffec561c

SHA1
a4ce6de223addbdc66e747d3abd00b9f190fb5cb

SHA256
fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c

SHA512
a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\019338921.dll
Filesize
1.4MB

MD5
7bbeafc1ab9f9d1a48a99338ffec561c

SHA1
a4ce6de223addbdc66e747d3abd00b9f190fb5cb

SHA256
fca807ab91e7328195cafebe5761402f4d7066aef4c766c78a37f2c27fcf812c

SHA512
a32b34d9c03b6a1eaa1d409968d6d211a22320cc8b46955f8cda156f4956ea4a3d2e6d0a5fd8578e274e67db36e2696a7e8722647313333d3b7825d3e3a2c263

Download Submit
memory/560-70-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download
memory/560-69-0x0000000000000000-mapping.dmp

Download
memory/768-58-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/768-60-0x00000000001F0000-0x000000000021D000-memory.dmp

Filesize
180KB

Download
memory/768-61-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/768-65-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/768-59-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/768-57-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/768-56-0x0000000000910000-0x0000000000A75000-memory.dmp

Filesize
1.4MB

Download
memory/768-55-0x00000000768D1000-0x00000000768D3000-memory.dmp

Filesize
8KB

Download
memory/768-54-0x0000000000000000-mapping.dmp

Download
memory/1088-89-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1088-87-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/1088-81-0x0000000000000000-mapping.dmp

Download
memory/1716-86-0x0000000000000000-mapping.dmp

Download
memory/1844-80-0x0000000000F40000-0x0000000000F62000-memory.dmp

Filesize
136KB

Download
memory/1844-85-0x0000000000F40000-0x0000000000F62000-memory.dmp

Filesize
136KB

Download
memory/1844-76-0x0000000000F40000-0x0000000000F62000-memory.dmp

Filesize
136KB

Download
memory/1844-78-0x0000000000F40000-0x0000000000F62000-memory.dmp

Filesize
136KB

Download
memory/1844-77-0x0000000000F40000-0x0000000000F62000-memory.dmp

Filesize
136KB

Download
memory/1844-79-0x0000000000980000-0x00000000009AD000-memory.dmp

Filesize
180KB

Download
memory/1844-72-0x0000000000000000-mapping.dmp

Download
memory/1844-75-0x0000000000A00000-0x0000000000B65000-memory.dmp

Filesize
1.4MB

Download
memory/1908-88-0x0000000000000000-mapping.dmp

Download
memory/2016-68-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2016-66-0x0000000000080000-0x00000000000A2000-memory.dmp

Filesize
136KB

Download
memory/2016-64-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download
memory/2016-62-0x0000000000000000-mapping.dmp

Download
memory/2040-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads