icedid | b2675ac7e8e728ea6c6a23aa67f264e80913387c978252e43fbd3cbf41278f63

General

Target

Setup_Win_14-12-2022_20-25-57.msi
Size

1.9MB
MD5

1108c1add09244f8615d6cc6539f9602
SHA1

a0c1bd208e3dfc0b928d6b06b3a7bd9fba43b15b
SHA256

b2675ac7e8e728ea6c6a23aa67f264e80913387c978252e43fbd3cbf41278f63
SHA512

21ba422893566afdbe2c0343d178d4c8bf7f752d1caf3e7c7203ed3eb192b64138b5d74265f53b4dae39952c48d464ec057e47706aa45438ad91a0aab9a96398
SSDEEP

49152:9r0nHD5a4/oyGe8EsuRMEl73hXNGzchfzYZppUQ:9r0jMDLshh

Score

10^/10

icedid 1002085315 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1002085315

C2

klepdrafooip.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

2 552 rundll32.exe
4 552 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

1300 MsiExec.exe
1864 rundll32.exe
552 rundll32.exe

flow	pid	process
2	552	rundll32.exe
4	552	rundll32.exe

pid	process
1300	MsiExec.exe
1864	rundll32.exe
552	rundll32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 15 IoCs

Processes:

msiexec.exerundll32.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\6c5e85.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6202.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6202.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6202.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\6c5e85.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6172.tmp	msiexec.exe
File created	C:\Windows\Installer\6c5e86.ipi	msiexec.exe
File created	C:\Windows\Installer\6c5e88.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c5e86.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6202.tmp-\test.cs.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6202.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exerundll32.exe

pid process

1720 msiexec.exe
1720 msiexec.exe
552 rundll32.exe
552 rundll32.exe

pid	process
1720	msiexec.exe
1720	msiexec.exe
552	rundll32.exe
552	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1404	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeSecurityPrivilege	1720	msiexec.exe
Token: SeCreateTokenPrivilege	1404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1404	msiexec.exe
Token: SeLockMemoryPrivilege	1404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1404	msiexec.exe
Token: SeMachineAccountPrivilege	1404	msiexec.exe
Token: SeTcbPrivilege	1404	msiexec.exe
Token: SeSecurityPrivilege	1404	msiexec.exe
Token: SeTakeOwnershipPrivilege	1404	msiexec.exe
Token: SeLoadDriverPrivilege	1404	msiexec.exe
Token: SeSystemProfilePrivilege	1404	msiexec.exe
Token: SeSystemtimePrivilege	1404	msiexec.exe
Token: SeProfSingleProcessPrivilege	1404	msiexec.exe
Token: SeIncBasePriorityPrivilege	1404	msiexec.exe
Token: SeCreatePagefilePrivilege	1404	msiexec.exe
Token: SeCreatePermanentPrivilege	1404	msiexec.exe
Token: SeBackupPrivilege	1404	msiexec.exe
Token: SeRestorePrivilege	1404	msiexec.exe
Token: SeShutdownPrivilege	1404	msiexec.exe
Token: SeDebugPrivilege	1404	msiexec.exe
Token: SeAuditPrivilege	1404	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1404	msiexec.exe
Token: SeChangeNotifyPrivilege	1404	msiexec.exe
Token: SeRemoteShutdownPrivilege	1404	msiexec.exe
Token: SeUndockPrivilege	1404	msiexec.exe
Token: SeSyncAgentPrivilege	1404	msiexec.exe
Token: SeEnableDelegationPrivilege	1404	msiexec.exe
Token: SeManageVolumePrivilege	1404	msiexec.exe
Token: SeImpersonatePrivilege	1404	msiexec.exe
Token: SeCreateGlobalPrivilege	1404	msiexec.exe
Token: SeBackupPrivilege	1780	vssvc.exe
Token: SeRestorePrivilege	1780	vssvc.exe
Token: SeAuditPrivilege	1780	vssvc.exe
Token: SeBackupPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	800	DrvInst.exe
Token: SeLoadDriverPrivilege	800	DrvInst.exe
Token: SeLoadDriverPrivilege	800	DrvInst.exe
Token: SeLoadDriverPrivilege	800	DrvInst.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe
Token: SeTakeOwnershipPrivilege	1720	msiexec.exe
Token: SeRestorePrivilege	1720	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1404 msiexec.exe
1404 msiexec.exe

pid	process
1404	msiexec.exe
1404	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.exe

description	pid	process	target process
PID 1720 wrote to memory of 1300	1720	msiexec.exe	MsiExec.exe
PID 1720 wrote to memory of 1300	1720	msiexec.exe	MsiExec.exe
PID 1720 wrote to memory of 1300	1720	msiexec.exe	MsiExec.exe
PID 1720 wrote to memory of 1300	1720	msiexec.exe	MsiExec.exe
PID 1720 wrote to memory of 1300	1720	msiexec.exe	MsiExec.exe
PID 1300 wrote to memory of 1864	1300	MsiExec.exe	rundll32.exe
PID 1300 wrote to memory of 1864	1300	MsiExec.exe	rundll32.exe
PID 1300 wrote to memory of 1864	1300	MsiExec.exe	rundll32.exe
PID 1864 wrote to memory of 552	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 552	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 552	1864	rundll32.exe	rundll32.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_14-12-2022_20-25-57.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 46B617C457DCD0BA007DA1890324B6F4
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI6202.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7103131 1 test.cs!XXX.YyY.ZzZ
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI37cf4167.mst",init
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000490" "0000000000000588"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MSI37cf4167.mst
Filesize
1.4MB

MD5
2b2deb165147b50f557b05b8ae31f877

SHA1
10f6d61f1bdcf416ab18ce72d6665d87db59ac22

SHA256
098b0237143e4c7c646df424915297ed66915869d94107cea4d7b72399021680

SHA512
87ba907efcab68e370869d1d41c9b022b2c7e81eec8f08092e5f1a8bc6b2ad3869459687fb79f42a665841dcb2741542c86de34f3395983e0e7d47afce794f69

Download Submit
C:\Windows\Installer\MSI6202.tmp
Filesize
414KB

MD5
ce78c41d4670bf1187f5cc5a67778d67

SHA1
65efdc8ab9fa58cb7ffda52a305fec8b6e314da4

SHA256
fcb072760b433026e2703cb87782a0e90ef099837582b09dd6c11b1443635d19

SHA512
18897491a0b60cfcfa25167f2426ed979bae091b861c75b6b7a32289c09575c4030467006332afca6b83c12fcae44f6d17c060c57c3697d9f0792fe8b61c8232

Download Submit
\Users\Admin\AppData\Local\MSI37cf4167.mst
Filesize
1.4MB

MD5
2b2deb165147b50f557b05b8ae31f877

SHA1
10f6d61f1bdcf416ab18ce72d6665d87db59ac22

SHA256
098b0237143e4c7c646df424915297ed66915869d94107cea4d7b72399021680

SHA512
87ba907efcab68e370869d1d41c9b022b2c7e81eec8f08092e5f1a8bc6b2ad3869459687fb79f42a665841dcb2741542c86de34f3395983e0e7d47afce794f69

Download Submit
\Windows\Installer\MSI6202.tmp
Filesize
414KB

MD5
ce78c41d4670bf1187f5cc5a67778d67

SHA1
65efdc8ab9fa58cb7ffda52a305fec8b6e314da4

SHA256
fcb072760b433026e2703cb87782a0e90ef099837582b09dd6c11b1443635d19

SHA512
18897491a0b60cfcfa25167f2426ed979bae091b861c75b6b7a32289c09575c4030467006332afca6b83c12fcae44f6d17c060c57c3697d9f0792fe8b61c8232

Download Submit
\Windows\Installer\MSI6202.tmp
Filesize
414KB

MD5
ce78c41d4670bf1187f5cc5a67778d67

SHA1
65efdc8ab9fa58cb7ffda52a305fec8b6e314da4

SHA256
fcb072760b433026e2703cb87782a0e90ef099837582b09dd6c11b1443635d19

SHA512
18897491a0b60cfcfa25167f2426ed979bae091b861c75b6b7a32289c09575c4030467006332afca6b83c12fcae44f6d17c060c57c3697d9f0792fe8b61c8232

Download Submit
memory/552-66-0x0000000000000000-mapping.dmp

Download
memory/552-69-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1300-56-0x0000000000000000-mapping.dmp

Download
memory/1404-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download
memory/1864-62-0x0000000001F40000-0x0000000001F6E000-memory.dmp

Filesize
184KB

Download
memory/1864-63-0x0000000001EA0000-0x0000000001EAA000-memory.dmp

Filesize
40KB

Download
memory/1864-64-0x0000000001FF0000-0x0000000002060000-memory.dmp

Filesize
448KB

Download
memory/1864-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads