25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad

General

Target

25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe
Size

6.2MB
MD5

f65a72d90a92954a5268384e21f8480d
SHA1

2afeed5ab78b05c44b1a683b4e2b6baab2b44a3b
SHA256

25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad
SHA512

13f852af9d637fc0fb770a6e796da753e9e383ea83df6faf757a6727ba3e3d0b7434603f18ec8d88d9796d8118524b16f467829ee1f6b46d9c357a355bdc79ad
SSDEEP

98304:ylrZ4WJx/oW4JZJzMHgDTceWglJ/HDlRdsrK4PI9+C8qlXwX6Msa8QLBe23yB5L:m5Jx34TJwHgDA4J/BRtC7jqBYHLiV

Score

8^/10

evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

pid process

1964 Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\OALX\ImagePath = "C:\\ProgramData\\Imagq\\Oiqr.exe"	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe

Loads dropped DLL 3 IoCs

Processes:

25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exeYamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

pid	process
1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe
1964	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
1964	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEYamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000007e7452aca99fba9ac69c67115d6fc798473b36c9f6ac112da6d6f665b7e29cdb000000000e80000000020000200000003681f59662cf91445e91e7ce223d8de96bfb9bbf6842baeb673dbeeeaf007bf6200000009515458e8548fafde72b8fde0fbaf4474a02c4d2aa86a1affa8e7176f49444d8400000001e5610cc8a4b0959b98b2f5761d14243c3b3a28d7da089ec688a9e5743d0c40493e0bd0e835288fc3ccea85c58b3002268a30a81b628d907788ec78a53d80aaa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376150358"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d491abd700d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF282671-6CCA-11ED-BBEF-F2255ECFD43B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000ab1cdc5788f26603cb7df034ac012f30666ecf10835da95048f15891700fee4d000000000e8000000002000020000000ae065cacc84127cd170326e5fd111245b6aa68e8adaa90c17e4bf5ca70198108900000000f517fb535919c037be63e579938122c980790640a1a2f34672f304f2b5bf1cf725d84b1e6547644b2902c771944f4665da9838d332870d358fe30c3e01d86e547bb38effe4a2305a8cd7cc1ff7d500b68d2334447b662611b299f6bb2baa7296045502d6f4410a1b0480fc61ef78242366e7bc9a5d3188ad9b7441160dccadc131d7172a797622bf0e402d24dfe825540000000cfff8d529a93f94dc9d3dc1d58aaeeb93e25a40d9759add7ca132f08c995e1978067b2aa3dc9f7e2e2f0da1c5865efa6a38b1d6497ee19a90906028523620e0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Runs net.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

996 iexplore.exe

pid	process
996	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exeiexplore.exeIEXPLORE.EXE

pid	process
1964	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
1964	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
996	iexplore.exe
996	iexplore.exe
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exeNet.exeiexplore.exe

description	pid	process	target process
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1308 wrote to memory of 1148	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Net.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1148 wrote to memory of 1692	1148	Net.exe	net1.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 1308 wrote to memory of 1964	1308	25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe	Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1172	996	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe
"C:\Users\Admin\AppData\Local\Temp\25abeef875ec6079414b6804248a97c6101eefc689984289b79172cfea5340ad.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\SysWOW64\Net.exe
Net Stop PcaSvc
2⤵
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 Stop PcaSvc
3⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
C:\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0c3786686bdb0df408f0ea05e4764c7c

SHA1
6ffff56b338886123a501f96dfde4c23fa000c68

SHA256
b0160f4b5a7149e6b9e50ef063f3d9b29e716bcee3447af56c7456bf84aa4e1c

SHA512
7cade352e09d7dae15c40863d8d70d7eb6e077aa603d4467e627d81922b377a52ca577b9a160cf2dff1ec29a241c1c044af0628c1d6c977376393aba4509b3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Filesize
4.3MB

MD5
33007da7cd61792e63acba2a48d373cd

SHA1
e33f07778555ddff8138fccaa80629eda9adbd55

SHA256
9d07531ac0deb500f122d145f15851dfe7a06007fd5bdb2a22476e6e1c3cd573

SHA512
01bb378c7c341797728f50619094f3c059d2a34286815436fbab226b739b24c16208800fb2b51278e6a1857484a95b9d59fa045608be143429d4d556343b6e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Filesize
4.3MB

MD5
33007da7cd61792e63acba2a48d373cd

SHA1
e33f07778555ddff8138fccaa80629eda9adbd55

SHA256
9d07531ac0deb500f122d145f15851dfe7a06007fd5bdb2a22476e6e1c3cd573

SHA512
01bb378c7c341797728f50619094f3c059d2a34286815436fbab226b739b24c16208800fb2b51278e6a1857484a95b9d59fa045608be143429d4d556343b6e0f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WTZS0C6W.txt
Filesize
608B

MD5
fb7512bf337ba3c64009a6142c58f5d6

SHA1
4390251d4e98a2d296c297855abbcce7a8c4933a

SHA256
e84498d9930ab01a96c23358eb96f6ba2c004785b03a3822c04a319296d94017

SHA512
bffc85f853bb87ccf29e9c9c760e699ad0c5c386cdc2d928b33959f22d27f32e1a775e431c342f70c99bd2d215820873e85d2be884c22392cdef3fc0fa87c03f

Download Submit
\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Filesize
4.3MB

MD5
33007da7cd61792e63acba2a48d373cd

SHA1
e33f07778555ddff8138fccaa80629eda9adbd55

SHA256
9d07531ac0deb500f122d145f15851dfe7a06007fd5bdb2a22476e6e1c3cd573

SHA512
01bb378c7c341797728f50619094f3c059d2a34286815436fbab226b739b24c16208800fb2b51278e6a1857484a95b9d59fa045608be143429d4d556343b6e0f

Download Submit
\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Filesize
4.3MB

MD5
33007da7cd61792e63acba2a48d373cd

SHA1
e33f07778555ddff8138fccaa80629eda9adbd55

SHA256
9d07531ac0deb500f122d145f15851dfe7a06007fd5bdb2a22476e6e1c3cd573

SHA512
01bb378c7c341797728f50619094f3c059d2a34286815436fbab226b739b24c16208800fb2b51278e6a1857484a95b9d59fa045608be143429d4d556343b6e0f

Download Submit
\Users\Admin\AppData\Local\Temp\g8780\Yamicsoft.Vista.Manager.v3.0.0.Incl.Keymaker-CORE.exe
Filesize
4.3MB

MD5
33007da7cd61792e63acba2a48d373cd

SHA1
e33f07778555ddff8138fccaa80629eda9adbd55

SHA256
9d07531ac0deb500f122d145f15851dfe7a06007fd5bdb2a22476e6e1c3cd573

SHA512
01bb378c7c341797728f50619094f3c059d2a34286815436fbab226b739b24c16208800fb2b51278e6a1857484a95b9d59fa045608be143429d4d556343b6e0f

Download Submit
memory/1148-55-0x0000000000000000-mapping.dmp

Download
memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1692-57-0x0000000000000000-mapping.dmp

Download
memory/1964-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads