warzonerat | ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

Analysis

max time kernel
135s
max time network
166s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe
Size

708KB
MD5

ecb6e0b8c1c969fb81be1b5d52ea4bab
SHA1

aa7d5a7a84f7a2b24d5177bfc147561964d0a250
SHA256

ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44
SHA512

4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48
SSDEEP

12288:NGcpdQGrhJFun+3L04NtfzaAixx2L6sqyHdUPsjIPF81DLAIM:ND2Grg+I4Ntfzay3UMiFay

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

bedahogs.100chickens.me:6093

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1040-82-0x0000000000400000-0x00000000004B6000-memory.dmp	warzonerat
behavioral1/memory/1040-83-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1572	Spotify.scr
1040	Spotify.scr

Loads dropped DLL 3 IoCs

pid	Process
1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe
1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe
1572	Spotify.scr

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry Key Name = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Spotify\\Spotify.vbs -VC"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Foxmail = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Spotify\\Spotify.scr"	Spotify.scr
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 1040	1572	Spotify.scr	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c494814906d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4CD2F21-723C-11ED-A674-466E2F293893} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a4f97397e0ef342a8692911b96389b000000000020000000000106600000001000020000000bc2b2364f4cc2011c3f76cfe5d08c5a0e8a8a5c74aafed3d795ac7bac5432e13000000000e80000000020000200000005f381e2d2ce5f47e9a4cf492207bb1397f7228c8c48c53450a17862d0f16aa522000000083f175e505c02dc016dded0e9a250b4712b8497d33f4d4359d7e00ac5276601240000000a8ed50b3b618666377e172895cea509e400eb05524f025afb1d6140635eb258b02a5a80a19e673a4de5126d85259f4b6544d20276c86aab8ff48d35d46d9a7fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a4f97397e0ef342a8692911b96389b0000000000200000000001066000000010000200000004a4de6969c21ddefd56380641908da722f69b56022b35aaaba0567f7e9978fe0000000000e8000000002000020000000e876c40206313ea0e3dc5aa4209859fecbc07eb7bb16df5f773fd5466ac948b090000000b8f1cf654b680ac7c15f62c40c97d10e65994ada18862169ce9f6dde6caecf881a62354cce2051f1a232ed054021476df6b369cc7130224dbc1048a50a4ad27214976c514df0bbb524c1b2c179dba793295fc6247e05884c97b5b0c7fc34666c3975ded3721ea9348b86dfcd61d5b5d62b90dc7fe5d7fb3baa8c9712bbaf1db4dc37f88a15e31a4be31d37ef069c93f24000000091cb391979f8753e9a0041548bdbc87ec704fb1f8bb0fce2b5e5707746d03cbce124750d980c5734413d60a8be1da0a48d6e8026e9e96344a8f36eeccc943844	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376749030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe
1572	Spotify.scr
1744	iexplore.exe
1744	iexplore.exe
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1744	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	28
PID 1964 wrote to memory of 1744	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	28
PID 1964 wrote to memory of 1744	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	28
PID 1964 wrote to memory of 1744	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	28
PID 1964 wrote to memory of 1304	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	29
PID 1964 wrote to memory of 1304	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	29
PID 1964 wrote to memory of 1304	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	29
PID 1964 wrote to memory of 1304	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	29
PID 1964 wrote to memory of 1572	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	30
PID 1964 wrote to memory of 1572	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	30
PID 1964 wrote to memory of 1572	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	30
PID 1964 wrote to memory of 1572	1964	ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe	30
PID 1744 wrote to memory of 1352	1744	iexplore.exe	32
PID 1744 wrote to memory of 1352	1744	iexplore.exe	32
PID 1744 wrote to memory of 1352	1744	iexplore.exe	32
PID 1744 wrote to memory of 1352	1744	iexplore.exe	32
PID 1572 wrote to memory of 1040	1572	Spotify.scr	33
PID 1572 wrote to memory of 1040	1572	Spotify.scr	33
PID 1572 wrote to memory of 1040	1572	Spotify.scr	33
PID 1572 wrote to memory of 1040	1572	Spotify.scr	33
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34
PID 1040 wrote to memory of 1408	1040	Spotify.scr	34

C:\Users\Admin\AppData\Local\Temp\ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe
"C:\Users\Admin\AppData\Local\Temp\ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\REQUEST-QUOTATION.GIF
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1352
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.vbs"
  2⤵
  - Adds Run key to start application
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr
  "C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr
    C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr" /S
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\REQUEST-QUOTATION.GIF

Filesize
11KB

MD5
278956f711ed61cbd3c2823479ff8d1f

SHA1
6c13dc9edbc8d32785161a656416ec05e90b6012

SHA256
cab4061a6c121e1e6223c87c53b016fa0087236453a6b1e449efbf6571a19c92

SHA512
29874611477a5c704d2a911e384221542cb27e6b1d887be99d95fba97d50e5151f8007e1df96052595df5ef53367659b5191c2e0ea13bfb216f76afbd473f489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spotify\Spotify.vbs

Filesize
1024B

MD5
c8aec1dc4775b2f9bfb3944b596bcfa1

SHA1
5b6188ac37ab8b6a0ef4ffea82a284abc5d40898

SHA256
3fb9caeff6259d6131fc1b43d57d6409866ce5541313098d8471b694d7996264

SHA512
e350218d945b9b1166c0404cdc50930d9bc89391bc19f8eb562692394270543c02076d29db900b440c96110ac0d2c03a63335320d4da352730875c7c8dc82e4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FXNUESG2.txt

Filesize
539B

MD5
368b36e6af231cbe7db54efc79323f9f

SHA1
5193d1cbb31056972782a1d55eef7ec9608fdefb

SHA256
83cba73eb4b3aa92ab5f243258a55e9a8f9d96b9e3495e75019d6202007af7c6

SHA512
dab86cca47e28e9b313781d9f9a92d162f235cfe87166576d54d3c97d954168d2eea85f528a4374ac57f0aa1d823861ec0603255774f01273c422ffec83645cd

Download Submit
\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
\Users\Admin\AppData\Local\Temp\Spotify\Spotify.scr

Filesize
708KB

MD5
ecb6e0b8c1c969fb81be1b5d52ea4bab

SHA1
aa7d5a7a84f7a2b24d5177bfc147561964d0a250

SHA256
ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

SHA512
4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

Download Submit
memory/1040-80-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1040-83-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1040-89-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/1040-82-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1040-81-0x00000000771E0000-0x0000000077360000-memory.dmp

Filesize
1.5MB

Download
memory/1408-91-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1572-78-0x00000000771E0000-0x0000000077360000-memory.dmp

Filesize
1.5MB

Download
memory/1572-77-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1572-76-0x0000000000270000-0x0000000000277000-memory.dmp

Filesize
28KB

Download
memory/1964-56-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/1964-67-0x00000000771E0000-0x0000000077360000-memory.dmp

Filesize
1.5MB

Download
memory/1964-65-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1964-64-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/1964-57-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads