phobos | 2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90

General

Target

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
Size

149KB
MD5

24e0cf05d2d34b1e6efbc7949bd7aa1f
SHA1

dfdf26d8de8f123dbfdc0b4d5a0a967aee454d9b
SHA256

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
SHA512

5b0a000a3dc159de262de88d8721b766ced6424209ab136c5630c4cd0eb4fc0f7e14624b3f6fb08c2b775ab45402fe863975ae43b48c6b9775f67045f29773f2
SSDEEP

3072:iMYxKXZHdlgQhA+zXuIDl33qMDqNfSwAk/GDbjXR4s4npu4:UOltfDl33BDsJAS8R4Xpu

Score

10^/10

phobos persistence ransomware rezer0

Malware Config

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1944-56-0x0000000001F10000-0x0000000001F2C000-memory.dmp	rezer0

Drops startup file 1 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90 = "C:\\Users\\Admin\\AppData\\Local\\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90 = "C:\\Users\\Admin\\AppData\\Local\\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\desktop.ini	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

description	pid	process	target process
PID 1944 set thread context of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 set thread context of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1448 vssadmin.exe

pid	process
1448	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

pid	process
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exevssvc.exe2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

description	pid	process
Token: SeDebugPrivilege	2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
Token: SeBackupPrivilege	820	vssvc.exe
Token: SeRestorePrivilege	820	vssvc.exe
Token: SeAuditPrivilege	820	vssvc.exe
Token: SeDebugPrivilege	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.execmd.exe2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
"C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
"{path}"
2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
"C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
"{path}"
4⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
"{path}"
4⤵
PID:588

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:820

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-88-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/588-84-0x0000000000402E94-mapping.dmp

Download
memory/1396-72-0x0000000000000000-mapping.dmp

Download
memory/1448-73-0x0000000000000000-mapping.dmp

Download
memory/1624-71-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/1944-55-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/1944-56-0x0000000001F10000-0x0000000001F2C000-memory.dmp

Filesize
112KB

Download
memory/1944-54-0x00000000001E0000-0x000000000020C000-memory.dmp

Filesize
176KB

Download
memory/2032-61-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-65-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-66-0x0000000000402E94-mapping.dmp

Download
memory/2032-68-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/2032-69-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-70-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-57-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

description	pid	process	target process
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1944 wrote to memory of 2032	1944	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 2032 wrote to memory of 1396	2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	cmd.exe
PID 2032 wrote to memory of 1396	2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	cmd.exe
PID 2032 wrote to memory of 1396	2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	cmd.exe
PID 2032 wrote to memory of 1396	2032	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	cmd.exe
PID 1396 wrote to memory of 1448	1396	cmd.exe	vssadmin.exe
PID 1396 wrote to memory of 1448	1396	cmd.exe	vssadmin.exe
PID 1396 wrote to memory of 1448	1396	cmd.exe	vssadmin.exe
PID 1624 wrote to memory of 580	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 580	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 580	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 580	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
PID 1624 wrote to memory of 588	1624	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe	2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads