modiloader | 41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6

General

Target

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe
Size

354KB
MD5

c662257308114e807cb6b437745c3b08
SHA1

6fe2384d83cbcd37b3a3c5a863ccdcb78977b18b
SHA256

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6
SHA512

81249c20aefca4085b0a2484ea68bdff9e05821a4900c17ba98848ed5e0f4c1291f7cd25d26ba9a0369f619a48556fa45eb902be5e60102c03ccc7ab2f425448
SSDEEP

6144:qHUVKdUXp4WdapG8t2Dma25dzUUGHD6PvzV4mG15jbdNtIjHj3I8KGiZh5gUvmCH:qHvmsI80DmN59UaGPb/aTDI8hiZh5gq5

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

System32.EXE

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" System32.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System32.EXE

ModiLoader Second Stage 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2020-66-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2020-69-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2020-67-0x0000000000430464-mapping.dmp	modiloader_stage2
behavioral1/memory/2020-71-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2020-72-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2020-77-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/1352-92-0x0000000000430464-mapping.dmp	modiloader_stage2
behavioral1/memory/1352-97-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/1352-99-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/1352-100-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/1352-101-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

Processes:

System32.exeSystem32.EXESystem32.EXE

pid process

1160 System32.exe
1684 System32.EXE
1352 System32.EXE

pid	process
1160	System32.exe
1684	System32.EXE
1352	System32.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

System32.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	System32.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Windows\\System32.EXE"	System32.EXE

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXESystem32.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System32.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System32.EXE

Suspicious use of SetThreadContext 4 IoCs

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXESystem32.exeSystem32.EXE

description	pid	process	target process
PID 1632 set thread context of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 set thread context of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1160 set thread context of 1684	1160	System32.exe	System32.EXE
PID 1684 set thread context of 1352	1684	System32.EXE	System32.EXE

Drops file in Windows directory 5 IoCs

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXESystem32.EXESystem32.EXE

description	ioc	process
File created	C:\Windows\System32.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
File opened for modification	C:\Windows\System32.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
File opened for modification	C:\Windows\System32.exe	System32.EXE
File created	C:\Windows\ntdtcstp.dll	System32.EXE
File created	C:\Windows\cmsetac.dll	System32.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXEvssvc.exeSystem32.EXE

description	pid	process
Token: SeDebugPrivilege	2020	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
Token: SeBackupPrivilege	1540	vssvc.exe
Token: SeRestorePrivilege	1540	vssvc.exe
Token: SeAuditPrivilege	1540	vssvc.exe
Token: SeDebugPrivilege	1352	System32.EXE
Token: SeDebugPrivilege	1352	System32.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXESystem32.exeSystem32.EXESystem32.EXE

pid	process
1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe
1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
1160	System32.exe
1684	System32.EXE
1352	System32.EXE
1352	System32.EXE

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXESystem32.exeSystem32.EXE

description	pid	process	target process
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1632 wrote to memory of 1240	1632	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 1240 wrote to memory of 2020	1240	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
PID 2020 wrote to memory of 1160	2020	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	System32.exe
PID 2020 wrote to memory of 1160	2020	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	System32.exe
PID 2020 wrote to memory of 1160	2020	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	System32.exe
PID 2020 wrote to memory of 1160	2020	41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE	System32.exe
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1160 wrote to memory of 1684	1160	System32.exe	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE
PID 1684 wrote to memory of 1352	1684	System32.EXE	System32.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

System32.EXE

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" System32.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System32.EXE

C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe
"C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
  "C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE
    "C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE"
    3⤵
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\System32.exe
      "C:\Windows\System32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6.EXE"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\System32.EXE
        
        "C:\Windows\System32.EXE"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1684
      - C:\Windows\System32.EXE
        
        "C:\Windows\System32.EXE"
        6⤵
        UAC bypass
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32.EXE

Filesize
354KB

MD5
c662257308114e807cb6b437745c3b08

SHA1
6fe2384d83cbcd37b3a3c5a863ccdcb78977b18b

SHA256
41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6

SHA512
81249c20aefca4085b0a2484ea68bdff9e05821a4900c17ba98848ed5e0f4c1291f7cd25d26ba9a0369f619a48556fa45eb902be5e60102c03ccc7ab2f425448

Download Submit
C:\Windows\System32.exe

Filesize
354KB

MD5
c662257308114e807cb6b437745c3b08

SHA1
6fe2384d83cbcd37b3a3c5a863ccdcb78977b18b

SHA256
41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6

SHA512
81249c20aefca4085b0a2484ea68bdff9e05821a4900c17ba98848ed5e0f4c1291f7cd25d26ba9a0369f619a48556fa45eb902be5e60102c03ccc7ab2f425448

Download Submit
C:\Windows\System32.exe

Filesize
354KB

MD5
c662257308114e807cb6b437745c3b08

SHA1
6fe2384d83cbcd37b3a3c5a863ccdcb78977b18b

SHA256
41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6

SHA512
81249c20aefca4085b0a2484ea68bdff9e05821a4900c17ba98848ed5e0f4c1291f7cd25d26ba9a0369f619a48556fa45eb902be5e60102c03ccc7ab2f425448

Download Submit
C:\Windows\System32.exe

Filesize
354KB

MD5
c662257308114e807cb6b437745c3b08

SHA1
6fe2384d83cbcd37b3a3c5a863ccdcb78977b18b

SHA256
41f4ce65d92c76258a16482a2b660ee524b42695f668d93e23b3ddc57cde00e6

SHA512
81249c20aefca4085b0a2484ea68bdff9e05821a4900c17ba98848ed5e0f4c1291f7cd25d26ba9a0369f619a48556fa45eb902be5e60102c03ccc7ab2f425448

Download Submit
memory/1160-88-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1160-78-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1160-73-0x0000000000000000-mapping.dmp

Download
memory/1240-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1240-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1240-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1240-61-0x00000000004010D8-mapping.dmp

Download
memory/1240-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1240-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1352-92-0x0000000000430464-mapping.dmp

Download
memory/1352-101-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1352-100-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1352-99-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1352-98-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/1352-97-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1632-64-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1684-95-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1684-85-0x00000000004010D8-mapping.dmp

Download
memory/2020-66-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2020-72-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2020-69-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2020-67-0x0000000000430464-mapping.dmp

Download
memory/2020-70-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/2020-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2020-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads