warzonerat | 4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641

Analysis

max time kernel
149s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ 17253536373.exe
Size

1015KB
MD5

f8a2ad4544d211df3b2698e5cecaf2dc
SHA1

b2045de3aaa3c49ebb35f25771d762cf70c5a3fa
SHA256

4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641
SHA512

fb94796b343d75d98b512e9f2f35fa17a5b33d6a382ba6188671bc232649f0428d969e37d7a2b35a427dea14c697d9ba9e27c9395770412960b2be77ee987ffd
SSDEEP

24576:XM+L74mBfNUstzoxdpt3hvMCggcrf8PAqyU9YH3r8JN:qnt3hrgde9YHI

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

74.119.192.210:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Executes dropped EXE 2 IoCs

Processes:

images.exeimages.exe

pid process

1484 images.exe
1736 images.exe

pid	process
1484	images.exe
1736	images.exe

Drops startup file 2 IoCs

Processes:

RFQ 17253536373.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	RFQ 17253536373.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	RFQ 17253536373.exe

Loads dropped DLL 1 IoCs

Processes:

RFQ 17253536373.exe

pid process

1688 RFQ 17253536373.exe

pid	process
1688	RFQ 17253536373.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

RFQ 17253536373.exeimages.exe

description	pid	process	target process
PID 1768 set thread context of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1484 set thread context of 1736	1484	images.exe	images.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1680 schtasks.exe
860 schtasks.exe
NTFS ADS 1 IoCs

Processes:

RFQ 17253536373.exe

description ioc process

File created C:\ProgramData:ApplicationData RFQ 17253536373.exe

pid	process
1680	schtasks.exe
860	schtasks.exe

description	ioc	process
File created	C:\ProgramData:ApplicationData	RFQ 17253536373.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

RFQ 17253536373.exepowershell.exepowershell.exepowershell.exeimages.exepowershell.exepowershell.exe

pid	process
1768	RFQ 17253536373.exe
1768	RFQ 17253536373.exe
1768	RFQ 17253536373.exe
1768	RFQ 17253536373.exe
1768	RFQ 17253536373.exe
1508	powershell.exe
1524	powershell.exe
1768	RFQ 17253536373.exe
828	powershell.exe
1484	images.exe
1388	powershell.exe
1968	powershell.exe
1484	images.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

RFQ 17253536373.exepowershell.exepowershell.exepowershell.exeimages.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1768	RFQ 17253536373.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	1484	images.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

RFQ 17253536373.exeRFQ 17253536373.execmd.exeimages.exe

description	pid	process	target process
PID 1768 wrote to memory of 1508	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1508	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1508	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1508	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1524	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1524	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1524	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1524	1768	RFQ 17253536373.exe	powershell.exe
PID 1768 wrote to memory of 1680	1768	RFQ 17253536373.exe	schtasks.exe
PID 1768 wrote to memory of 1680	1768	RFQ 17253536373.exe	schtasks.exe
PID 1768 wrote to memory of 1680	1768	RFQ 17253536373.exe	schtasks.exe
PID 1768 wrote to memory of 1680	1768	RFQ 17253536373.exe	schtasks.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1768 wrote to memory of 1688	1768	RFQ 17253536373.exe	RFQ 17253536373.exe
PID 1688 wrote to memory of 828	1688	RFQ 17253536373.exe	powershell.exe
PID 1688 wrote to memory of 828	1688	RFQ 17253536373.exe	powershell.exe
PID 1688 wrote to memory of 828	1688	RFQ 17253536373.exe	powershell.exe
PID 1688 wrote to memory of 828	1688	RFQ 17253536373.exe	powershell.exe
PID 1688 wrote to memory of 1536	1688	RFQ 17253536373.exe	cmd.exe
PID 1688 wrote to memory of 1536	1688	RFQ 17253536373.exe	cmd.exe
PID 1688 wrote to memory of 1536	1688	RFQ 17253536373.exe	cmd.exe
PID 1688 wrote to memory of 1536	1688	RFQ 17253536373.exe	cmd.exe
PID 1688 wrote to memory of 1484	1688	RFQ 17253536373.exe	images.exe
PID 1688 wrote to memory of 1484	1688	RFQ 17253536373.exe	images.exe
PID 1688 wrote to memory of 1484	1688	RFQ 17253536373.exe	images.exe
PID 1688 wrote to memory of 1484	1688	RFQ 17253536373.exe	images.exe
PID 1536 wrote to memory of 1716	1536	cmd.exe	reg.exe
PID 1536 wrote to memory of 1716	1536	cmd.exe	reg.exe
PID 1536 wrote to memory of 1716	1536	cmd.exe	reg.exe
PID 1536 wrote to memory of 1716	1536	cmd.exe	reg.exe
PID 1484 wrote to memory of 1388	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1388	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1388	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1388	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1968	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1968	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1968	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 1968	1484	images.exe	powershell.exe
PID 1484 wrote to memory of 860	1484	images.exe	schtasks.exe
PID 1484 wrote to memory of 860	1484	images.exe	schtasks.exe
PID 1484 wrote to memory of 860	1484	images.exe	schtasks.exe
PID 1484 wrote to memory of 860	1484	images.exe	schtasks.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe
PID 1484 wrote to memory of 1736	1484	images.exe	images.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 17253536373.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 17253536373.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ 17253536373.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yOQsDFUUU.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yOQsDFUUU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE01.tmp"
2⤵
- Creates scheduled task(s)
PID:1680

C:\Users\Admin\AppData\Local\Temp\RFQ 17253536373.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 17253536373.exe"
2⤵
- Drops startup file
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
4⤵
PID:1716

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\images.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yOQsDFUUU.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yOQsDFUUU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53CC.tmp"
4⤵
- Creates scheduled task(s)
PID:860

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
4⤵
- Executes dropped EXE
PID:1736

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\images.exe
Filesize
1015KB

MD5
f8a2ad4544d211df3b2698e5cecaf2dc

SHA1
b2045de3aaa3c49ebb35f25771d762cf70c5a3fa

SHA256
4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641

SHA512
fb94796b343d75d98b512e9f2f35fa17a5b33d6a382ba6188671bc232649f0428d969e37d7a2b35a427dea14c697d9ba9e27c9395770412960b2be77ee987ffd

Download Submit
C:\ProgramData\images.exe
Filesize
1015KB

MD5
f8a2ad4544d211df3b2698e5cecaf2dc

SHA1
b2045de3aaa3c49ebb35f25771d762cf70c5a3fa

SHA256
4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641

SHA512
fb94796b343d75d98b512e9f2f35fa17a5b33d6a382ba6188671bc232649f0428d969e37d7a2b35a427dea14c697d9ba9e27c9395770412960b2be77ee987ffd

Download Submit
C:\ProgramData\images.exe
Filesize
1015KB

MD5
f8a2ad4544d211df3b2698e5cecaf2dc

SHA1
b2045de3aaa3c49ebb35f25771d762cf70c5a3fa

SHA256
4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641

SHA512
fb94796b343d75d98b512e9f2f35fa17a5b33d6a382ba6188671bc232649f0428d969e37d7a2b35a427dea14c697d9ba9e27c9395770412960b2be77ee987ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp53CC.tmp
Filesize
1KB

MD5
d51a1092cb0792ab87b515fddf671a21

SHA1
232689e4f7e813dc3c8616b1347db9adabedc070

SHA256
ecf4e0216ed1c3c90deaf8b35a645e2533812c4e7162a078600bcf58cb6a03fa

SHA512
3c7a6ee86a291194146073d34f0f0362f5bdc517a1825fbf51820bca09459cbd08d34aeca88fde44a7dd132939dcc605f4fcbee89b6e4d1d16b183f0236880d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDE01.tmp
Filesize
1KB

MD5
d51a1092cb0792ab87b515fddf671a21

SHA1
232689e4f7e813dc3c8616b1347db9adabedc070

SHA256
ecf4e0216ed1c3c90deaf8b35a645e2533812c4e7162a078600bcf58cb6a03fa

SHA512
3c7a6ee86a291194146073d34f0f0362f5bdc517a1825fbf51820bca09459cbd08d34aeca88fde44a7dd132939dcc605f4fcbee89b6e4d1d16b183f0236880d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
7013e465723422e7062509ee61508873

SHA1
fca0074a7a3f475a63a7e0fe4cdd0c9d6cae2552

SHA256
5bee8cba33d35de7d13720f938517c375e6f339e80cbba291aafe0cb659f848d

SHA512
2f359a50765fb9dada8ac3f60dc6678b323554cb58ab350b85e772d8cff4ff746af299afc95032e0212e39557d6a83537fdd134194f69190b830f80fdd34b074

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
70dfea58f4ae12a554b72ada733aa2f0

SHA1
052430049fd392d4bef39d5285f1de82d7a5485a

SHA256
323c355c2ea444631b48a89202d8b38f2bc937e598faa7cef9e51b28565c3d18

SHA512
9bc16e57afd02db6c5488f016bf67482b9925aa821326b9dbdd6e4a26627ea1260ee9832188f82b40a43b2491e504b91983a37225acc9508244866399ab34c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
7013e465723422e7062509ee61508873

SHA1
fca0074a7a3f475a63a7e0fe4cdd0c9d6cae2552

SHA256
5bee8cba33d35de7d13720f938517c375e6f339e80cbba291aafe0cb659f848d

SHA512
2f359a50765fb9dada8ac3f60dc6678b323554cb58ab350b85e772d8cff4ff746af299afc95032e0212e39557d6a83537fdd134194f69190b830f80fdd34b074

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
70dfea58f4ae12a554b72ada733aa2f0

SHA1
052430049fd392d4bef39d5285f1de82d7a5485a

SHA256
323c355c2ea444631b48a89202d8b38f2bc937e598faa7cef9e51b28565c3d18

SHA512
9bc16e57afd02db6c5488f016bf67482b9925aa821326b9dbdd6e4a26627ea1260ee9832188f82b40a43b2491e504b91983a37225acc9508244866399ab34c9a

Download Submit
\ProgramData\images.exe
Filesize
1015KB

MD5
f8a2ad4544d211df3b2698e5cecaf2dc

SHA1
b2045de3aaa3c49ebb35f25771d762cf70c5a3fa

SHA256
4fe82d810dd80e56a8e2effdf825a9259a812bc9e14193f22193342bf5e66641

SHA512
fb94796b343d75d98b512e9f2f35fa17a5b33d6a382ba6188671bc232649f0428d969e37d7a2b35a427dea14c697d9ba9e27c9395770412960b2be77ee987ffd

Download Submit
memory/828-100-0x00000000739E0000-0x0000000073F8B000-memory.dmp

Filesize
5.7MB

Download
memory/828-87-0x0000000000000000-mapping.dmp

Download
memory/860-104-0x0000000000000000-mapping.dmp

Download
memory/1388-101-0x0000000000000000-mapping.dmp

Download
memory/1388-111-0x0000000071530000-0x0000000071ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1484-98-0x0000000000980000-0x0000000000A82000-memory.dmp

Filesize
1.0MB

Download
memory/1484-92-0x0000000000000000-mapping.dmp

Download
memory/1508-86-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/1508-59-0x0000000000000000-mapping.dmp

Download
memory/1508-82-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-85-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-83-0x000000006EF50000-0x000000006F4FB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-61-0x0000000000000000-mapping.dmp

Download
memory/1536-88-0x0000000000000000-mapping.dmp

Download
memory/1680-62-0x0000000000000000-mapping.dmp

Download
memory/1688-77-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-67-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-84-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-76-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-74-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-72-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-94-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-81-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-70-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-68-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1688-78-0x0000000000405E28-mapping.dmp

Download
memory/1716-97-0x0000000000000000-mapping.dmp

Download
memory/1736-122-0x0000000000405E28-mapping.dmp

Download
memory/1736-127-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1736-126-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1768-66-0x0000000005850000-0x00000000058BA000-memory.dmp

Filesize
424KB

Download
memory/1768-57-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/1768-56-0x0000000000620000-0x0000000000638000-memory.dmp

Filesize
96KB

Download
memory/1768-58-0x0000000005570000-0x0000000005612000-memory.dmp

Filesize
648KB

Download
memory/1768-55-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download
memory/1768-54-0x0000000000B30000-0x0000000000C32000-memory.dmp

Filesize
1.0MB

Download
memory/1968-113-0x0000000071530000-0x0000000071ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1968-102-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads