bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e

Analysis

max time kernel
118s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Size

716KB
MD5

4780b5422eb56929a826a8aea6345e72
SHA1

f7b562af913b9da29973e73a74cd290f7af3b987
SHA256

bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e
SHA512

37b5bc2fd69fc164832a2fd35d2e28d9e07eb2bfe60409485041e71740a8e51c4eff2d97563a91c311cf26893f228e35498ec434fd06b0526dc0b94efdc8fb24
SSDEEP

12288:wvw6ro+pQe1M2fr3fhFYGq6i0kaHKmJ/syPQHdqNyXovOi8kXg16J9KmxOnRE:crRQey2rXYyA78/svHsoqokXgAwoOO

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

dsa.exeserver.exeserver.exeCHANGE~1.EXE

pid process

1488 dsa.exe
1964 server.exe
1016 server.exe
1396 CHANGE~1.EXE
Loads dropped DLL 6 IoCs

Processes:

bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exedsa.exeserver.exe

pid process

1252 bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
1488 dsa.exe
1488 dsa.exe
1964 server.exe
1488 dsa.exe
1488 dsa.exe

pid	process
1488	dsa.exe
1964	server.exe
1016	server.exe
1396	CHANGE~1.EXE

pid	process
1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
1488	dsa.exe
1488	dsa.exe
1964	server.exe
1488	dsa.exe
1488	dsa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dsa.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dsa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dsa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

server.exe

pid process

1016 server.exe
1016 server.exe

pid	process
1016	server.exe
1016	server.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exedsa.exeserver.exeserver.exe

description	pid	process
Token: 33	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: SeIncBasePriorityPrivilege	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: 33	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: SeIncBasePriorityPrivilege	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: 33	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: SeIncBasePriorityPrivilege	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: 33	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: SeIncBasePriorityPrivilege	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
Token: 33	1488	dsa.exe
Token: SeIncBasePriorityPrivilege	1488	dsa.exe
Token: 33	1964	server.exe
Token: SeIncBasePriorityPrivilege	1964	server.exe
Token: 33	1964	server.exe
Token: SeIncBasePriorityPrivilege	1964	server.exe
Token: 33	1016	server.exe
Token: SeIncBasePriorityPrivilege	1016	server.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CHANGE~1.EXE

pid process

1396 CHANGE~1.EXE

pid	process
1396	CHANGE~1.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exedsa.exeserver.exeserver.exe

description	pid	process	target process
PID 1252 wrote to memory of 1488	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe	dsa.exe
PID 1252 wrote to memory of 1488	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe	dsa.exe
PID 1252 wrote to memory of 1488	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe	dsa.exe
PID 1252 wrote to memory of 1488	1252	bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe	dsa.exe
PID 1488 wrote to memory of 1964	1488	dsa.exe	server.exe
PID 1488 wrote to memory of 1964	1488	dsa.exe	server.exe
PID 1488 wrote to memory of 1964	1488	dsa.exe	server.exe
PID 1488 wrote to memory of 1964	1488	dsa.exe	server.exe
PID 1964 wrote to memory of 1016	1964	server.exe	server.exe
PID 1964 wrote to memory of 1016	1964	server.exe	server.exe
PID 1964 wrote to memory of 1016	1964	server.exe	server.exe
PID 1964 wrote to memory of 1016	1964	server.exe	server.exe
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1016 wrote to memory of 1208	1016	server.exe	Explorer.EXE
PID 1488 wrote to memory of 1396	1488	dsa.exe	CHANGE~1.EXE
PID 1488 wrote to memory of 1396	1488	dsa.exe	CHANGE~1.EXE
PID 1488 wrote to memory of 1396	1488	dsa.exe	CHANGE~1.EXE
PID 1488 wrote to memory of 1396	1488	dsa.exe	CHANGE~1.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe
"C:\Users\Admin\AppData\Local\Temp\bcebc8e9c4275fd189e87da6a180c0f9bf6f92b8f83bec87ed518a61aaa9433e.exe"
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\dsa.exe
"C:\Users\Admin\AppData\Local\Temp\dsa.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.25\Virtual\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\server.exe
"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Native\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\CHANGE~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CHANGE~1.EXE
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CHANGE~1.EXE
Filesize
20KB

MD5
c7851d971a65f2939d09af3b4469b7cd

SHA1
19def9f9208862e097e83cde7f6b2522a0f2c071

SHA256
f66be3247726cc0724d4d29bf06a597b13cd65be2b40b7eec3c903cbff036f6b

SHA512
bd598468bf73715d7363f67547abde6e1821f81b86f8565480354bfa896936835f9f4d616aa90189b7e067e84696bebc1f58809bae63f856b6b1f0f24d095fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
Filesize
354KB

MD5
a1f369f08734247b3159c3ede05bcae9

SHA1
86eaa06f7e12da258e30ce07d5b9a3e4772a4013

SHA256
04cfbe0d4ab2a5b949e924368c3fe5d027abd0f8022e6124be2487511e371582

SHA512
daae61df91b345e86ab7380179cfa26697c89427ec4fde50e02fb2bc7e3f5331f6fd79e3979a0240963e9a0303836c1ddc10604f5531e1ff870d02aacc2ebaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
Filesize
354KB

MD5
a1f369f08734247b3159c3ede05bcae9

SHA1
86eaa06f7e12da258e30ce07d5b9a3e4772a4013

SHA256
04cfbe0d4ab2a5b949e924368c3fe5d027abd0f8022e6124be2487511e371582

SHA512
daae61df91b345e86ab7380179cfa26697c89427ec4fde50e02fb2bc7e3f5331f6fd79e3979a0240963e9a0303836c1ddc10604f5531e1ff870d02aacc2ebaa7

Download Submit
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.25\Virtual\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\server.exe
Filesize
17KB

MD5
4927ddbb60db41b4b6fe90540c5ae7bb

SHA1
3626a815c0c8039361baf12a6d4fc3a1d06676df

SHA256
f17dcb91e79f9d879a66ad7ff536da5261f6d57af58fb455e903c2920d6fc018

SHA512
5bf3cc72eb8cbe92f90ecc761ac59e14a30baa60f79343d3ce576155d6e490be09c92fe13c3567b813997a2c1e2354f3c0abbc500217590e0a422ca8b4fdb32c

Download Submit
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Native\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\CHANGE~1.EXE
Filesize
17KB

MD5
043c51b5683e79d80cbdbfa00e9f77a4

SHA1
ed18233e54ac7073613f8c334f2c1c3e18290461

SHA256
4d60172a4ff72d67b9d1ced63901e6dd056984e802e9b169ab06fbeebc328c15

SHA512
d98fa9211a191448249e179f2f19907f79cd4ef810cd0a0fcd689ec4f0fb716bd147aeecd9bd8bbf5ab121c754ba02312e8ffd7edda56956df12a31e41642c22

Download Submit
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\dsa.exe
Filesize
17KB

MD5
60db249ebf401c2b49faafa08020b5a1

SHA1
9c8a72057137c369833e5cdd8b2bd78953743f17

SHA256
bf453aa2049ab81cdba1f1de66b21b54d54e67e9502a40877239a217f0721ff1

SHA512
945d5c5c33a3799c360c93bd9158c6fb78fc984621870fca451b9c28d304a149d119f47fd9d0e8ae3fff1c3ec556cb830cba67b949c51d4298d0e19530e9f0e5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\CHANGE~1.EXE
Filesize
20KB

MD5
c7851d971a65f2939d09af3b4469b7cd

SHA1
19def9f9208862e097e83cde7f6b2522a0f2c071

SHA256
f66be3247726cc0724d4d29bf06a597b13cd65be2b40b7eec3c903cbff036f6b

SHA512
bd598468bf73715d7363f67547abde6e1821f81b86f8565480354bfa896936835f9f4d616aa90189b7e067e84696bebc1f58809bae63f856b6b1f0f24d095fd1

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
Filesize
354KB

MD5
a1f369f08734247b3159c3ede05bcae9

SHA1
86eaa06f7e12da258e30ce07d5b9a3e4772a4013

SHA256
04cfbe0d4ab2a5b949e924368c3fe5d027abd0f8022e6124be2487511e371582

SHA512
daae61df91b345e86ab7380179cfa26697c89427ec4fde50e02fb2bc7e3f5331f6fd79e3979a0240963e9a0303836c1ddc10604f5531e1ff870d02aacc2ebaa7

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
Filesize
354KB

MD5
a1f369f08734247b3159c3ede05bcae9

SHA1
86eaa06f7e12da258e30ce07d5b9a3e4772a4013

SHA256
04cfbe0d4ab2a5b949e924368c3fe5d027abd0f8022e6124be2487511e371582

SHA512
daae61df91b345e86ab7380179cfa26697c89427ec4fde50e02fb2bc7e3f5331f6fd79e3979a0240963e9a0303836c1ddc10604f5531e1ff870d02aacc2ebaa7

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.25\Virtual\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\server.exe
Filesize
17KB

MD5
4927ddbb60db41b4b6fe90540c5ae7bb

SHA1
3626a815c0c8039361baf12a6d4fc3a1d06676df

SHA256
f17dcb91e79f9d879a66ad7ff536da5261f6d57af58fb455e903c2920d6fc018

SHA512
5bf3cc72eb8cbe92f90ecc761ac59e14a30baa60f79343d3ce576155d6e490be09c92fe13c3567b813997a2c1e2354f3c0abbc500217590e0a422ca8b4fdb32c

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Native\STUBEXE\@APPDATALOCAL@\Temp\IXP000.TMP\CHANGE~1.EXE
Filesize
17KB

MD5
043c51b5683e79d80cbdbfa00e9f77a4

SHA1
ed18233e54ac7073613f8c334f2c1c3e18290461

SHA256
4d60172a4ff72d67b9d1ced63901e6dd056984e802e9b169ab06fbeebc328c15

SHA512
d98fa9211a191448249e179f2f19907f79cd4ef810cd0a0fcd689ec4f0fb716bd147aeecd9bd8bbf5ab121c754ba02312e8ffd7edda56956df12a31e41642c22

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\1431.09.15T04.29\Virtual\STUBEXE\@APPDATALOCAL@\Temp\dsa.exe
Filesize
17KB

MD5
60db249ebf401c2b49faafa08020b5a1

SHA1
9c8a72057137c369833e5cdd8b2bd78953743f17

SHA256
bf453aa2049ab81cdba1f1de66b21b54d54e67e9502a40877239a217f0721ff1

SHA512
945d5c5c33a3799c360c93bd9158c6fb78fc984621870fca451b9c28d304a149d119f47fd9d0e8ae3fff1c3ec556cb830cba67b949c51d4298d0e19530e9f0e5

Download Submit
memory/1016-1301-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1016-992-0x0000000000000000-mapping.dmp

Download
memory/1016-1118-0x0000000000360000-0x00000000003CC000-memory.dmp

Filesize
432KB

Download
memory/1016-1300-0x00000000003AB000-0x00000000003AD000-memory.dmp

Filesize
8KB

Download
memory/1016-1302-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1016-1309-0x0000000000360000-0x00000000003CC000-memory.dmp

Filesize
432KB

Download
memory/1016-1310-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1252-87-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-65-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-95-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-101-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-99-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-97-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-103-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-105-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-107-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-109-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-111-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-115-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-113-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-117-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-219-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-221-0x000000000050B000-0x000000000050D000-memory.dmp

Filesize
8KB

Download
memory/1252-91-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-365-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-1631-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-59-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-61-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-57-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-89-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-81-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-55-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-83-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-85-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-54-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-93-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-63-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-79-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-77-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-75-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-73-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-71-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-69-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1252-67-0x00000000004C0000-0x000000000052C000-memory.dmp

Filesize
432KB

Download
memory/1396-1623-0x000000000045B000-0x000000000045D000-memory.dmp

Filesize
8KB

Download
memory/1396-1622-0x0000000000410000-0x000000000047C000-memory.dmp

Filesize
432KB

Download
memory/1396-1314-0x0000000000000000-mapping.dmp

Download
memory/1396-1627-0x0000000000410000-0x000000000047C000-memory.dmp

Filesize
432KB

Download
memory/1396-1628-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1396-1626-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1488-366-0x0000000000000000-mapping.dmp

Download
memory/1488-1304-0x00000000003EB000-0x00000000003ED000-memory.dmp

Filesize
8KB

Download
memory/1488-876-0x0000000001000000-0x000000000106F000-memory.dmp

Filesize
444KB

Download
memory/1488-523-0x00000000003A0000-0x000000000040C000-memory.dmp

Filesize
432KB

Download
memory/1488-1303-0x00000000003A0000-0x000000000040C000-memory.dmp

Filesize
432KB

Download
memory/1488-1629-0x00000000003A0000-0x000000000040C000-memory.dmp

Filesize
432KB

Download
memory/1488-1630-0x0000000001000000-0x000000000106F000-memory.dmp

Filesize
444KB

Download
memory/1488-525-0x00000000003EB000-0x00000000003ED000-memory.dmp

Filesize
8KB

Download
memory/1964-677-0x0000000000000000-mapping.dmp

Download
memory/1964-1308-0x0000000000220000-0x000000000028C000-memory.dmp

Filesize
432KB

Download
memory/1964-1311-0x0000000000220000-0x000000000028C000-memory.dmp

Filesize
432KB

Download
memory/1964-877-0x0000000000220000-0x000000000028C000-memory.dmp

Filesize
432KB

Download
memory/1964-878-0x000000000026B000-0x000000000026D000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads