njrat | beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c

General

Target

beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe
Size

276KB
MD5

2c6e1a9de503a7d08d02b6370501531b
SHA1

9e33bb585aa23045fb834c4023029c9ab4a28e99
SHA256

beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c
SHA512

dad86e43844dbc0831886908d8e5bb30b1380c8733e4386671900409e73219b98988e40a04f0a90105e3e69f1e725794a26fe56436b4f40abd82b3b64f3d6ba3
SSDEEP

6144:6OBe0K5uUYVbcuKTlbGbpshywoul5K9x4FNADPETTEeLN:zbguGuwlbPhVlQINqVeLN

Score

10^/10

njrat hunar83 evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hunar83

C2

farman33.no-ip.biz:5552

Mutex

934765b6ad06834b303835a4e1d1d5a2

Attributes

reg_key
934765b6ad06834b303835a4e1d1d5a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

Server.exeicon disk top.exe

pid process

1264 Server.exe
392 icon disk top.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

624 netsh.exe
Loads dropped DLL 2 IoCs

Processes:

beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exeServer.exe

pid process

1632 beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe
1264 Server.exe

pid	process
1264	Server.exe
392	icon disk top.exe

pid	process
624	netsh.exe

pid	process
1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe
1264	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

icon disk top.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\934765b6ad06834b303835a4e1d1d5a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\icon disk top.exe\" .."	icon disk top.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\934765b6ad06834b303835a4e1d1d5a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\icon disk top.exe\" .."	icon disk top.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000546c2b2419a829d8a1aeef001644ad54cc26f5d41f27e6fdb5080ab5f5b214be000000000e8000000002000020000000a9a8a4af5226579b56c83b1aab73fdf3fcb40b46956365cdc211902cdddccae5900000000d0330e97198a18fafd93fba6614d2423c88a73deb7f707874676e14f7eea51e31b3e5df23bfe38b03c838452608bd7ce2b08fbb5096537194bf3d33ae3a2bc373113574881618791717f147fe1e6107690d8123f72f5094b688f52e2ffb1660d9496c2b80e2b8ecfd7bf08a2476910dc6287a4f4653d30f89532b35458bef5350d8fbf6fbcb8494aeb9aaec4c4b602a40000000d7b6be68a15dab92515adc0ec1411e2fb0f41ed7cdaaf32fb30e7c4fa3e0670477d7546ed949ce460136e193353b23240c51a8477a5cb352b8c84141c00f9bc5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CBA6701-6D26-11ED-AAF5-C244376E7EDB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909067723301d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376189794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000077b6cbf6ece829985c1bf16facfd73f937b2ba83fb2a1bbd9927a029a1fb6f0a000000000e8000000002000020000000faf46c4310f0aa8b8c0051898023a97ada5f3bfa7efd1e26054296912691c36520000000ce74fc1a470b06f9c7d58088ce0ab91c7477a7c2b16e43c46c4c391bc2b8458740000000e97cd0f72596f61c15fed5ca3ed8d65e7fa524ef9ba474a136d94c1fd21ec39816a2224b04d64c207d1f690cd1aceede84daba5d6eccea2a9114b7048322fdb5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

icon disk top.exe

description	pid	process
Token: SeDebugPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe
Token: 33	392	icon disk top.exe
Token: SeIncBasePriorityPrivilege	392	icon disk top.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2036 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2036 iexplore.exe
2036 iexplore.exe
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE
1316 IEXPLORE.EXE

pid	process
2036	iexplore.exe

pid	process
2036	iexplore.exe
2036	iexplore.exe
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE
1316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exeiexplore.exeServer.exeicon disk top.exe

description	pid	process	target process
PID 1632 wrote to memory of 1264	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	Server.exe
PID 1632 wrote to memory of 1264	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	Server.exe
PID 1632 wrote to memory of 1264	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	Server.exe
PID 1632 wrote to memory of 1264	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	Server.exe
PID 1632 wrote to memory of 2036	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	iexplore.exe
PID 1632 wrote to memory of 2036	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	iexplore.exe
PID 1632 wrote to memory of 2036	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	iexplore.exe
PID 1632 wrote to memory of 2036	1632	beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe	iexplore.exe
PID 2036 wrote to memory of 1316	2036	iexplore.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1316	2036	iexplore.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1316	2036	iexplore.exe	IEXPLORE.EXE
PID 2036 wrote to memory of 1316	2036	iexplore.exe	IEXPLORE.EXE
PID 1264 wrote to memory of 392	1264	Server.exe	icon disk top.exe
PID 1264 wrote to memory of 392	1264	Server.exe	icon disk top.exe
PID 1264 wrote to memory of 392	1264	Server.exe	icon disk top.exe
PID 1264 wrote to memory of 392	1264	Server.exe	icon disk top.exe
PID 392 wrote to memory of 624	392	icon disk top.exe	netsh.exe
PID 392 wrote to memory of 624	392	icon disk top.exe	netsh.exe
PID 392 wrote to memory of 624	392	icon disk top.exe	netsh.exe
PID 392 wrote to memory of 624	392	icon disk top.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe
"C:\Users\Admin\AppData\Local\Temp\beb8d9619b3b016900226e8c797123b2710c82c9d8f1d20baecb0ffa089eb74c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\icon disk top.exe
"C:\Users\Admin\AppData\Local\Temp\icon disk top.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\icon disk top.exe" "icon disk top.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Barcelona%2525252Bv%2525252.gif
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Barcelona%2525252Bv%2525252.gif

Filesize
109KB

MD5
fa80ec857b5a262bf80a869c8ee6412c

SHA1
082d3bda5dca464a5c1c80b66ea5087c6ceb92a1

SHA256
6eacf4d1230ee097103b2deb54e94ff8a66f3693ddedf514e6b674f9e1944075

SHA512
5658c0720f6982f4cd28510a787a4bd5e484de5822b0b84066e67ee1bcc6cd2521f9650aa119dc090f3b5fda142384fa65d4f4fedeea9fa75d34b1ca75268e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\icon disk top.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\icon disk top.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DB8DS05R.txt

Filesize
603B

MD5
9babc8af2aad2830caa1100683e3384e

SHA1
3ed5558c7cf12a32cc23180241a819d3fce879bf

SHA256
c8171a4320d0bce208e221a09dcd82c5ad450dec015e440bbf6ab742edbb15d4

SHA512
00248c1c85113c81832cacfbc6c39f3f40cb716189ccd85868591a9fde6dd5441b2162ad9d58a96e6ae1a529bb8dffe8a468df34cbdcf05c977e610397add140

Download Submit
\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
\Users\Admin\AppData\Local\Temp\icon disk top.exe

Filesize
23KB

MD5
ff427e7e5834822a0448d35950c6f1e7

SHA1
bf4fcd87c6a37fd058d6b48115a508325d9cef6a

SHA256
7210ff1920b071c8595803241d874db80bb72f0e6524c6a97dff6e372f96d646

SHA512
1c8edd1618cea4839e0284a4ef01561e1b2e013048ddf24f7a8dce6feac9943fdaba4c4fd2244d8f615be58e10fad0412cfc75409c43a02382c15686769d4f3f

Download Submit
memory/392-63-0x0000000000000000-mapping.dmp

Download
memory/392-68-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/392-71-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/624-69-0x0000000000000000-mapping.dmp

Download
memory/1264-56-0x0000000000000000-mapping.dmp

Download
memory/1264-61-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1264-67-0x0000000074BB0000-0x000000007515B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads