ctblocker | 995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22

General

Target

995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22.exe
Size

654KB
MD5

f24e6374518fa7aed3d24a064a03bd23
SHA1

d0ffebdb6e5f97c2842d5578f889345b88224d5c
SHA256

995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22
SHA512

de8c3f80802c06bc85dc1605aae39e981e46861820fd2e2b87eca28febcafc26513ac562d8c133799ab18ffe7c752b45cd3e1fbf6c539e9db9fd45686fa1c484
SSDEEP

12288:MkzXMinmtrfsNG9USY7x3lgSsIXlYlOHls2E/qZaTcMUJnGHqsvXX1tfLs:LjArfCG+nN3aNIXNFZ5R1GHqsvDI

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-pnbblmn.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://kph3onblkthy4z37.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. C5AO45O-PA5F3U4-7EHAGX5-KQ4PTNU-2AKF6BW-HPC2BOP-22WTHK6-ZUSWH6C YXTDNAT-ZA6LTTD-MIAEBQD-CF2RVGW-3OT5UIJ-CR7VRHP-3624MIO-22J6UOM DOXO6X5-QRUVLLV-TSSGQFV-POYGCB2-PH4PYSA-BP7OCPR-WREN5AU-GG6EAQZ Follow the instructions on the server.

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-pnbblmn.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://kph3onblkthy4z37.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. C5AO45O-PA5F3U4-7EHAGX5-KQ4PTNU-2AKF6BW-HPC2BOP-22WTHK6-ZUSWH6C YXTDNAT-ZA6LTTD-MIAEBQD-CF2RVGW-3OT5UIJ-CR7VRHP-3624MIO-22J6UOM DOXO6X5-QRUVLLV-TSSGQFV-POYGCB2-PH4PAAA-5V7OCPR-WREN5AU-GG6UARH Follow the instructions on the server.

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion/

Extracted

Path

C:\ProgramData\nydzthc.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://kph3onblkthy4z37.onion.cab or http://kph3onblkthy4z37.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://kph3onblkthy4z37.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://kph3onblkthy4z37.onion.cab

http://kph3onblkthy4z37.tor2web.org

http://kph3onblkthy4z37.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

pcrcyge.exepcrcyge.exe

pid process

940 pcrcyge.exe
1176 pcrcyge.exe

pid	process
940	pcrcyge.exe
1176	pcrcyge.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\BackupImport.RAW.pnbblmn	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\EnterJoin.CRW.pnbblmn	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\RestorePush.CRW.pnbblmn	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pcrcyge.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation pcrcyge.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	pcrcyge.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-pnbblmn.bmp"	Explorer.EXE

Drops file in Program Files directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-pnbblmn.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-pnbblmn.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1168 vssadmin.exe

pid	process
1168	vssadmin.exe

Modifies data under HKEY_USERS 20 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6a28b224-1a82-11ed-b98f-806e6f6e6963}\MaxCapacity = "15140"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6a28b224-1a82-11ed-b98f-806e6f6e6963}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6a28b224-1a82-11ed-b98f-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00360061003200380062003200320034002d0031006100380032002d0031003100650064002d0062003900380066002d003800300036006500360066003600650036003900360033007d0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22.exepcrcyge.exe

pid	process
1976	995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe
940	pcrcyge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pcrcyge.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 940 pcrcyge.exe
Token: SeDebugPrivilege 940 pcrcyge.exe
Token: SeShutdownPrivilege 1268 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pcrcyge.exe

pid process

1176 pcrcyge.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pcrcyge.exe

pid process

1176 pcrcyge.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pcrcyge.exe

pid process

1176 pcrcyge.exe
1176 pcrcyge.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE

pid	process
1268	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	940	pcrcyge.exe
Token: SeDebugPrivilege	940	pcrcyge.exe
Token: SeShutdownPrivilege	1268	Explorer.EXE

pid	process
1176	pcrcyge.exe

pid	process
1176	pcrcyge.exe

pid	process
1176	pcrcyge.exe
1176	pcrcyge.exe

pid	process
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

taskeng.exepcrcyge.exesvchost.exe

description	pid	process	target process
PID 944 wrote to memory of 940	944	taskeng.exe	pcrcyge.exe
PID 944 wrote to memory of 940	944	taskeng.exe	pcrcyge.exe
PID 944 wrote to memory of 940	944	taskeng.exe	pcrcyge.exe
PID 944 wrote to memory of 940	944	taskeng.exe	pcrcyge.exe
PID 940 wrote to memory of 580	940	pcrcyge.exe	svchost.exe
PID 580 wrote to memory of 520	580	svchost.exe	DllHost.exe
PID 580 wrote to memory of 520	580	svchost.exe	DllHost.exe
PID 580 wrote to memory of 520	580	svchost.exe	DllHost.exe
PID 940 wrote to memory of 1268	940	pcrcyge.exe	Explorer.EXE
PID 940 wrote to memory of 1168	940	pcrcyge.exe	vssadmin.exe
PID 940 wrote to memory of 1168	940	pcrcyge.exe	vssadmin.exe
PID 940 wrote to memory of 1168	940	pcrcyge.exe	vssadmin.exe
PID 940 wrote to memory of 1168	940	pcrcyge.exe	vssadmin.exe
PID 940 wrote to memory of 1176	940	pcrcyge.exe	pcrcyge.exe
PID 940 wrote to memory of 1176	940	pcrcyge.exe	pcrcyge.exe
PID 940 wrote to memory of 1176	940	pcrcyge.exe	pcrcyge.exe
PID 940 wrote to memory of 1176	940	pcrcyge.exe	pcrcyge.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1268

C:\Users\Admin\AppData\Local\Temp\995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22.exe
"C:\Users\Admin\AppData\Local\Temp\995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:520

C:\Windows\system32\taskeng.exe
taskeng.exe {88809D1D-C630-4D2A-940E-2A0909C1EEBE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows all
3⤵
- Interacts with shadow copies
PID:1168

C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
"C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe" -u
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1176

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\aubdarb
Filesize
654B

MD5
473b4cb4fffaf0208e15cbe0adc638c6

SHA1
268c6faeb56daa16522dfdd1072019927974379b

SHA256
d53684187616aad1238494f40d02a7ec1464e385342a83955a5826dbc110d907

SHA512
113488c29758311925abd76034937f21a1a27cb2019fd6fdc366e00f75d9e0b57982e7220b5b943a2c09893635ad071f27d6a409dd959300f7e92c772a06c4cd

Download Submit
C:\ProgramData\Microsoft\aubdarb
Filesize
654B

MD5
473b4cb4fffaf0208e15cbe0adc638c6

SHA1
268c6faeb56daa16522dfdd1072019927974379b

SHA256
d53684187616aad1238494f40d02a7ec1464e385342a83955a5826dbc110d907

SHA512
113488c29758311925abd76034937f21a1a27cb2019fd6fdc366e00f75d9e0b57982e7220b5b943a2c09893635ad071f27d6a409dd959300f7e92c772a06c4cd

Download Submit
C:\ProgramData\Microsoft\aubdarb
Filesize
654B

MD5
915a2b5d6321eb669f608a4aef045a44

SHA1
e0007c2a0742774980119cc7df0ed104bc1f8d72

SHA256
7249d9971a85d7a11680a6318e69c38f9f8457602c57617b3c01991862203047

SHA512
fdbf5b101b1be6269ec561d57e8607977dca35ce9c112e7019413e0098b9cc0c7bf36c2e07cea3fd86c95f5ccd1cb0392b149b8cc9f22b2f1b3eb955ac5cf9fb

Download Submit
C:\ProgramData\Microsoft\aubdarb
Filesize
654B

MD5
e0e1b0313aa43795a8beafd64fd1a3f7

SHA1
4924620bffb61cee1364c9ae2a8e65bc1fd41de7

SHA256
44a69c44a1d9c61fbf62ab9752586cd523b3f5fa5fcf8ff4e09870f88226ad1d

SHA512
1e2217dd0062af69f9459f3688b602f7b9472e21ffebc6bbbf5a7ccdab061db35f2f50018ad30c1e98a5973dc8293ba98ea3ea535b4bd2bcd463872a50e642a8

Download Submit
C:\ProgramData\nydzthc.html
Filesize
62KB

MD5
183d217f7ee43834ea51d2d4ccbc464c

SHA1
143e54e98e1f446e6da609b978736cd7c1e76e9f

SHA256
0481936c6207455282129fec0120c8e1a9393c4451033956950e8b9f91a57e96

SHA512
26966f67f77c2c1c4bf1b6c4d33b6666926c53a8c8cf9863c1ff3403f4d01127e64a132b1670e4249d8a60dc200c3acab0886a373d433343f0d242966bb7a2ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
Filesize
654KB

MD5
f24e6374518fa7aed3d24a064a03bd23

SHA1
d0ffebdb6e5f97c2842d5578f889345b88224d5c

SHA256
995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22

SHA512
de8c3f80802c06bc85dc1605aae39e981e46861820fd2e2b87eca28febcafc26513ac562d8c133799ab18ffe7c752b45cd3e1fbf6c539e9db9fd45686fa1c484

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
Filesize
654KB

MD5
f24e6374518fa7aed3d24a064a03bd23

SHA1
d0ffebdb6e5f97c2842d5578f889345b88224d5c

SHA256
995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22

SHA512
de8c3f80802c06bc85dc1605aae39e981e46861820fd2e2b87eca28febcafc26513ac562d8c133799ab18ffe7c752b45cd3e1fbf6c539e9db9fd45686fa1c484

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcrcyge.exe
Filesize
654KB

MD5
f24e6374518fa7aed3d24a064a03bd23

SHA1
d0ffebdb6e5f97c2842d5578f889345b88224d5c

SHA256
995944ed13ab4ff7f88fa268bb0c29b23ff762f4329730fd056dcac5e27f9d22

SHA512
de8c3f80802c06bc85dc1605aae39e981e46861820fd2e2b87eca28febcafc26513ac562d8c133799ab18ffe7c752b45cd3e1fbf6c539e9db9fd45686fa1c484

Download Submit
memory/520-68-0x0000000000000000-mapping.dmp

Download
memory/580-65-0x00000000002B0000-0x0000000000327000-memory.dmp

Filesize
476KB

Download
memory/580-69-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/580-63-0x00000000002B0000-0x0000000000327000-memory.dmp

Filesize
476KB

Download
memory/940-62-0x0000000000780000-0x00000000009CB000-memory.dmp

Filesize
2.3MB

Download
memory/940-58-0x0000000000000000-mapping.dmp

Download
memory/1168-75-0x0000000000000000-mapping.dmp

Download
memory/1176-76-0x0000000000000000-mapping.dmp

Download
memory/1176-80-0x0000000000BE0000-0x0000000000E2B000-memory.dmp

Filesize
2.3MB

Download
memory/1976-56-0x00000000008A0000-0x0000000000AEB000-memory.dmp

Filesize
2.3MB

Download
memory/1976-54-0x0000000000680000-0x000000000089A000-memory.dmp

Filesize
2.1MB

Download
memory/1976-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads