icedid | 63a7d98369925d6e98994cdb5937bd896506665be9f80dc55de7eb6df00f7607

General

Target

Setup_Win_14-12-2022_18-36-29.msi
Size

1.9MB
MD5

483a92951b440f2212fbfba38174d8a4
SHA1

914b9a827b1937935681a033b1c32a2df97a4874
SHA256

63a7d98369925d6e98994cdb5937bd896506665be9f80dc55de7eb6df00f7607
SHA512

336d65a516d8503ec939cb52d186b42d1dc41abc253ac85262bd251f4c63f81fa78d8f48122e608c91ec7f6cf43db1daf87c9c26f6636fa6410d10541018a93b
SSDEEP

49152:Jr0QHD5a4/7yGe8EsuRMEl73hXNGzchfzYZppUQ:Jr08MuLshh

Score

10^/10

icedid 1002085315 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

1002085315

C2

klepdrafooip.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

2 1792 rundll32.exe
4 1792 rundll32.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

1912 MsiExec.exe
1552 rundll32.exe
1792 rundll32.exe

flow	pid	process
2	1792	rundll32.exe
4	1792	rundll32.exe

pid	process
1912	MsiExec.exe
1552	rundll32.exe
1792	rundll32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 15 IoCs

Processes:

DrvInst.exemsiexec.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\6c4f69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\6c4f6c.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\6c4f6a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI522A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI522A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\6c4f69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI518B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c4f6a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI522A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI522A.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI522A.tmp-\test.cs.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msiexec.exerundll32.exe

pid process

1900 msiexec.exe
1900 msiexec.exe
1792 rundll32.exe
1792 rundll32.exe

pid	process
1900	msiexec.exe
1900	msiexec.exe
1792	rundll32.exe
1792	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1440	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeSecurityPrivilege	1900	msiexec.exe
Token: SeCreateTokenPrivilege	1440	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1440	msiexec.exe
Token: SeLockMemoryPrivilege	1440	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1440	msiexec.exe
Token: SeMachineAccountPrivilege	1440	msiexec.exe
Token: SeTcbPrivilege	1440	msiexec.exe
Token: SeSecurityPrivilege	1440	msiexec.exe
Token: SeTakeOwnershipPrivilege	1440	msiexec.exe
Token: SeLoadDriverPrivilege	1440	msiexec.exe
Token: SeSystemProfilePrivilege	1440	msiexec.exe
Token: SeSystemtimePrivilege	1440	msiexec.exe
Token: SeProfSingleProcessPrivilege	1440	msiexec.exe
Token: SeIncBasePriorityPrivilege	1440	msiexec.exe
Token: SeCreatePagefilePrivilege	1440	msiexec.exe
Token: SeCreatePermanentPrivilege	1440	msiexec.exe
Token: SeBackupPrivilege	1440	msiexec.exe
Token: SeRestorePrivilege	1440	msiexec.exe
Token: SeShutdownPrivilege	1440	msiexec.exe
Token: SeDebugPrivilege	1440	msiexec.exe
Token: SeAuditPrivilege	1440	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1440	msiexec.exe
Token: SeChangeNotifyPrivilege	1440	msiexec.exe
Token: SeRemoteShutdownPrivilege	1440	msiexec.exe
Token: SeUndockPrivilege	1440	msiexec.exe
Token: SeSyncAgentPrivilege	1440	msiexec.exe
Token: SeEnableDelegationPrivilege	1440	msiexec.exe
Token: SeManageVolumePrivilege	1440	msiexec.exe
Token: SeImpersonatePrivilege	1440	msiexec.exe
Token: SeCreateGlobalPrivilege	1440	msiexec.exe
Token: SeBackupPrivilege	1240	vssvc.exe
Token: SeRestorePrivilege	1240	vssvc.exe
Token: SeAuditPrivilege	1240	vssvc.exe
Token: SeBackupPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	836	DrvInst.exe
Token: SeLoadDriverPrivilege	836	DrvInst.exe
Token: SeLoadDriverPrivilege	836	DrvInst.exe
Token: SeLoadDriverPrivilege	836	DrvInst.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe
Token: SeTakeOwnershipPrivilege	1900	msiexec.exe
Token: SeRestorePrivilege	1900	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1440 msiexec.exe
1440 msiexec.exe

pid	process
1440	msiexec.exe
1440	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.exe

description	pid	process	target process
PID 1900 wrote to memory of 1912	1900	msiexec.exe	MsiExec.exe
PID 1900 wrote to memory of 1912	1900	msiexec.exe	MsiExec.exe
PID 1900 wrote to memory of 1912	1900	msiexec.exe	MsiExec.exe
PID 1900 wrote to memory of 1912	1900	msiexec.exe	MsiExec.exe
PID 1900 wrote to memory of 1912	1900	msiexec.exe	MsiExec.exe
PID 1912 wrote to memory of 1552	1912	MsiExec.exe	rundll32.exe
PID 1912 wrote to memory of 1552	1912	MsiExec.exe	rundll32.exe
PID 1912 wrote to memory of 1552	1912	MsiExec.exe	rundll32.exe
PID 1552 wrote to memory of 1792	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1792	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1792	1552	rundll32.exe	rundll32.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup_Win_14-12-2022_18-36-29.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1440

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 24C717F5153181C0B2A1F1D9DB03C196
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI522A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_7099168 1 test.cs!XXX.YyY.ZzZ
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\MSI778738a9.mst",init
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000049C" "00000000000004A4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MSI778738a9.mst
Filesize
1.4MB

MD5
ddc204b27174d22b5bbf10819bf30707

SHA1
c70473bc99e2fec21c1bc305a1f81ea3d52aaed0

SHA256
7e5da5fcda0da494da85cdc76384b3b08f135f09f20e582e049486e8ae2f168e

SHA512
8f3c9a8ec15458b2302a1914fc8408c156a88b872982122c2171c7290679e14f51268b1f5c405143322e99c71e7eb7ff24f1c4492f01ce76ecdbe965fb880adf

Download Submit
C:\Windows\Installer\MSI522A.tmp
Filesize
414KB

MD5
cda2f0bb7819921c98e376562f8db1bb

SHA1
1a579a1b47c840a85181da8a70fe846084cd83c2

SHA256
3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

SHA512
9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

Download Submit
\Users\Admin\AppData\Local\MSI778738a9.mst
Filesize
1.4MB

MD5
ddc204b27174d22b5bbf10819bf30707

SHA1
c70473bc99e2fec21c1bc305a1f81ea3d52aaed0

SHA256
7e5da5fcda0da494da85cdc76384b3b08f135f09f20e582e049486e8ae2f168e

SHA512
8f3c9a8ec15458b2302a1914fc8408c156a88b872982122c2171c7290679e14f51268b1f5c405143322e99c71e7eb7ff24f1c4492f01ce76ecdbe965fb880adf

Download Submit
\Windows\Installer\MSI522A.tmp
Filesize
414KB

MD5
cda2f0bb7819921c98e376562f8db1bb

SHA1
1a579a1b47c840a85181da8a70fe846084cd83c2

SHA256
3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

SHA512
9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

Download Submit
\Windows\Installer\MSI522A.tmp
Filesize
414KB

MD5
cda2f0bb7819921c98e376562f8db1bb

SHA1
1a579a1b47c840a85181da8a70fe846084cd83c2

SHA256
3294ddfeba71b6718034400e2c40dc1f8f64f2480aff90c38e6b04a9fc2cb1ad

SHA512
9058543415ff917dbcf583c1bb99ba41142d3f22617fe3e409a7cf219d9f32ca8d11130e4e7df93025d0e332efd5ba71d54a3d88f9eec4b98e4f2fea9743a2ad

Download Submit
memory/1440-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download
memory/1552-62-0x0000000000410000-0x000000000043E000-memory.dmp

Filesize
184KB

Download
memory/1552-63-0x0000000001CE0000-0x0000000001CEA000-memory.dmp

Filesize
40KB

Download
memory/1552-64-0x0000000002050000-0x00000000020C0000-memory.dmp

Filesize
448KB

Download
memory/1552-60-0x0000000000000000-mapping.dmp

Download
memory/1792-66-0x0000000000000000-mapping.dmp

Download
memory/1792-69-0x0000000000530000-0x0000000000539000-memory.dmp

Filesize
36KB

Download
memory/1912-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads