neshta | fe7c7abae0e36d9582e6189d6405a221924a3006805c5768f9244cf56fe20e53

General

Target

2d57a1af420a6840d8361b9cd76be267.exe
Size

136KB
MD5

2d57a1af420a6840d8361b9cd76be267
SHA1

5282d8171a4f994ae56f291bc51462a9a2bb5daa
SHA256

fe7c7abae0e36d9582e6189d6405a221924a3006805c5768f9244cf56fe20e53
SHA512

6bc2ccf373779937486a7c66a6d51e67043f9defa8ef28cfb8e8271a105c6a0b40478bc68d13f19e8a19b8c9234954e7bbe93e1f63a0e93fb488f64c7add060d
SSDEEP

1536:9xqjQ+P04wsmJCmzi0Zb78ivombfexv0ujXyyed2n3tmulgS6p8li1qqsCbqDylI:wr85Cmzi0ZbYe1g0ujyzdX8iYEwiYjV

Score

10^/10

neshta redline cheat discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

51.120.250.153:62563

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-61-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral1/memory/1912-64-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta
behavioral1/memory/1912-66-0x0000000000400000-0x000000000042B000-memory.dmp	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2d57a1af420a6840d8361b9cd76be267.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe	family_redline
behavioral1/memory/1144-59-0x0000000000310000-0x000000000032E000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

pid process

1144 2d57a1af420a6840d8361b9cd76be267.exe
Loads dropped DLL 2 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

pid process

1912 2d57a1af420a6840d8361b9cd76be267.exe
1912 2d57a1af420a6840d8361b9cd76be267.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1144	2d57a1af420a6840d8361b9cd76be267.exe

pid	process
1912	2d57a1af420a6840d8361b9cd76be267.exe
1912	2d57a1af420a6840d8361b9cd76be267.exe

Drops file in Program Files directory 64 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	2d57a1af420a6840d8361b9cd76be267.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	2d57a1af420a6840d8361b9cd76be267.exe

Drops file in Windows directory 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description ioc process

File opened for modification C:\Windows\svchost.com 2d57a1af420a6840d8361b9cd76be267.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	2d57a1af420a6840d8361b9cd76be267.exe

Modifies registry class 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2d57a1af420a6840d8361b9cd76be267.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	2d57a1af420a6840d8361b9cd76be267.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	2d57a1af420a6840d8361b9cd76be267.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

pid process

1144 2d57a1af420a6840d8361b9cd76be267.exe
1144 2d57a1af420a6840d8361b9cd76be267.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description pid process

Token: SeDebugPrivilege 1144 2d57a1af420a6840d8361b9cd76be267.exe

pid	process
1144	2d57a1af420a6840d8361b9cd76be267.exe
1144	2d57a1af420a6840d8361b9cd76be267.exe

description	pid	process
Token: SeDebugPrivilege	1144	2d57a1af420a6840d8361b9cd76be267.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2d57a1af420a6840d8361b9cd76be267.exe

description	pid	process	target process
PID 1912 wrote to memory of 1144	1912	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe
PID 1912 wrote to memory of 1144	1912	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe
PID 1912 wrote to memory of 1144	1912	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe
PID 1912 wrote to memory of 1144	1912	2d57a1af420a6840d8361b9cd76be267.exe	2d57a1af420a6840d8361b9cd76be267.exe

C:\Users\Admin\AppData\Local\Temp\2d57a1af420a6840d8361b9cd76be267.exe
"C:\Users\Admin\AppData\Local\Temp\2d57a1af420a6840d8361b9cd76be267.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe

Filesize
95KB

MD5
228d532a3184e5cdd4f6691d0b4b7d54

SHA1
fe5873bb99e05f3f3d335611fd008e230110b5dc

SHA256
38ceabb776214507969c4381db87f69dee76c0dc457ab4550ca739fd5649415f

SHA512
b56b80f5865a0e716350acee5da3cfae6d368f83d0c2221df0807c70c19b346280723295e1db55f0253d109a5205241a0a0788cdd631d6a0190b5b97b31c3ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe

Filesize
95KB

MD5
228d532a3184e5cdd4f6691d0b4b7d54

SHA1
fe5873bb99e05f3f3d335611fd008e230110b5dc

SHA256
38ceabb776214507969c4381db87f69dee76c0dc457ab4550ca739fd5649415f

SHA512
b56b80f5865a0e716350acee5da3cfae6d368f83d0c2221df0807c70c19b346280723295e1db55f0253d109a5205241a0a0788cdd631d6a0190b5b97b31c3ca9

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\2d57a1af420a6840d8361b9cd76be267.exe

Filesize
95KB

MD5
228d532a3184e5cdd4f6691d0b4b7d54

SHA1
fe5873bb99e05f3f3d335611fd008e230110b5dc

SHA256
38ceabb776214507969c4381db87f69dee76c0dc457ab4550ca739fd5649415f

SHA512
b56b80f5865a0e716350acee5da3cfae6d368f83d0c2221df0807c70c19b346280723295e1db55f0253d109a5205241a0a0788cdd631d6a0190b5b97b31c3ca9

Download Submit
memory/1144-56-0x0000000000000000-mapping.dmp

Download
memory/1144-59-0x0000000000310000-0x000000000032E000-memory.dmp

Filesize
120KB

Download
memory/1912-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1912-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1912-62-0x0000000002090000-0x00000000020A0000-memory.dmp

Filesize
64KB

Download
memory/1912-64-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1912-65-0x0000000002090000-0x00000000020A0000-memory.dmp

Filesize
64KB

Download
memory/1912-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads