neshta | 23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e

General

Target

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
Size

178KB
MD5

41203c855ad40eb8f2805b6d07330170
SHA1

ff052d48fdae4a0fa2f0ea3ae6ad5a80396f0412
SHA256

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e
SHA512

96c4e5183f372cee9f334264c528c45e9a6f2fff811559c676dc40736434a17f883e8858c0fde8841e35d799fac18e303c439c807ce71cccc82f198c4000623b
SSDEEP

3072:sr85CsCY4MS+d6c0Q3p37DauwpkJrQ4gS8Qatcwdba:k9HY6+ddlDaTStaFba

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

pid process

4984 23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

pid	process
4984	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Drops file in Windows directory 1 IoCs

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description ioc process

File opened for modification C:\Windows\svchost.com 23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 4984 WerFault.exe 23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

pid	pid_target	process	target process
5104	4984	WerFault.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Modifies registry class 1 IoCs

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

description	pid	process	target process
PID 4960 wrote to memory of 4984	4960	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
PID 4960 wrote to memory of 4984	4960	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe	23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

C:\Users\Admin\AppData\Local\Temp\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
"C:\Users\Admin\AppData\Local\Temp\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\3582-490\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe"
2⤵
- Executes dropped EXE
PID:4984

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4984 -s 392
3⤵
- Program crash
PID:5104

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 4984 -ip 4984
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Filesize
138KB

MD5
de381a33319c952d815b791064e65685

SHA1
178f5d718d515e27ff17ccf3886914b1f586d969

SHA256
77b5ede735710506ef1fb4cbd0fc0c799136d0c579f510ed944f71dce6694dc8

SHA512
1fea5c1576d6c5db5d0f04e1e207093813e87542b148443596d2c001aad34c584b2bab18861f10024395195728bcfcc54fbbdcf0fb77b78c225ffd0cd22cb3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\23c6008e50c0b6a655d9f61c8f7f6e5f0bc1410cfe5bf279ca4ee4d67fe4d09e.exe

Filesize
138KB

MD5
de381a33319c952d815b791064e65685

SHA1
178f5d718d515e27ff17ccf3886914b1f586d969

SHA256
77b5ede735710506ef1fb4cbd0fc0c799136d0c579f510ed944f71dce6694dc8

SHA512
1fea5c1576d6c5db5d0f04e1e207093813e87542b148443596d2c001aad34c584b2bab18861f10024395195728bcfcc54fbbdcf0fb77b78c225ffd0cd22cb3b0

Download Submit
memory/4984-132-0x0000000000000000-mapping.dmp

Download
memory/4984-135-0x0000000140000000-0x000000014004C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads