darkcomet | 86d72f1eeefa2a31a2a3e00ffa15e12982c57aef6b758ced28a30dfea50646b1

General

Target

MetaMaskBot.exe
Size

38KB
MD5

9169eb7a644bd28cbba4759b30298176
SHA1

ffe90ae79fd542268818deccc193c8617845acfb
SHA256

d97d88d757d722f0c078b4d22a5fac76bcb44db740c8b3ea9181e8733ac3c1ca
SHA512

cb47f0b6e74bc3c255e05ae1c5722100186be86f78df16bba166d2b1e580fa6d7bb1e22744fcd04d081dcc50a9c3580f8f85e3dca6a060cb11ef0a6e0bcfdfb5
SSDEEP

768:h7ra/Tl+hs3E/jU0dugZ0T2Xtz+lHQW40Zz0D3jHUpi1GouIbV:c/T2X/jN2vxZz0DTHUpouIbV

Score

10^/10

darkcomet redline 01 discovery infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
188.120.227.9
Port:
21
Username:
PK1
Password:
PK1

Extracted

Credentials

Protocol: ftp
Host:
79.174.12.59
Port:
21
Username:
hsngfb
Password:
hsnrgthearsgdt

Extracted

Family

redline

Botnet

01

C2

62.109.1.213:25978

Attributes

auth_value
83b3b6de7a5c7e6212ec06f17293a6ba

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-71-0x00000000003D0000-0x0000000000400000-memory.dmp	family_redline
behavioral1/memory/2032-72-0x0000000000460000-0x000000000048E000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

pythonw.exe

pid process

2032 pythonw.exe
Loads dropped DLL 1 IoCs

Processes:

pythonw.exe

pid process

1936 pythonw.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2032	pythonw.exe

pid	process
1936	pythonw.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pythonw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\com = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1680.py"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\googl = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\1680.py"	pythonw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\apdate = "C:\\Users\\Admin\\AppData\\Roaming\\pythonw.exe C:\\Users\\Admin\\AppData\\Roaming\\clip.py"	pythonw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

Processes:

pythonw.exe

description	pid	process	target process
PID 1936 set thread context of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 set thread context of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 set thread context of 1488	1936	pythonw.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e041935f5e25d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85E6B021-9151-11ED-8F62-626C2AE6DC56} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002794a71ed6d6df44a8f0a6d3b50bd67100000000020000000000106600000001000020000000db9feb6376387f58a820a0d39b2c471be61131985fe28e91b7e7dc813a194918000000000e8000000002000020000000022d50ea43fbe73108807ef3876e385c4d55c7624de9da260bc4f9fdd61ffd0c2000000087b19fb9bf1104a1682a5872a2d8200cfcf52771f3aa6747ab0336b3b288871a40000000e2f5edcb310be1edb297e4f482c89eb9e2a877fb19eb2ff16b0d4d65b70d8b5ffb3abee2808e2fa2bf0ce37c1bf323cc577c87b48ae681b7798dd5d8879a4d32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002794a71ed6d6df44a8f0a6d3b50bd6710000000002000000000010660000000100002000000078ebc755652c89ccca85f083a247be0928f204d890c8c7a38948fffdc5e34f7b000000000e80000000020000200000007c5a62e5d5a6339c903401c00f7b530fda0506156aab2332154afe8b2ddc083990000000db2f5fc33a27c3ea66f0e1f450e8efffe630c30ea5579e666b1b5511dd7d0c96276227ff5eda286c6ac1e57386f5966d09fc69ab57eb8c67d405cf30e6184a9b121e46ab21b8073223c4bffb84915653054b229791d251facc8e1464720d982e54c1e1f07fde8397b78af1dddba6612f5f1f69f8d08532231d769aedb9719f22b6f53aacc8abcd8b19a90f045ae80491400000009cd04496c7abb79aa854daaea2d47ab4d7c7e9eb0b01433028a521e6cd9896c0addeefdaf3f224e5788525d92f6ee215ab57a4b80f43809174a4c4851a51d9db	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380166460"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pythonw.exe

pid process

2032 pythonw.exe
2032 pythonw.exe

pid	process
2032	pythonw.exe
2032	pythonw.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

pythonw.exepythonw.exeiexplore.exe

description	pid	process
Token: 35	1936	pythonw.exe
Token: SeDebugPrivilege	2032	pythonw.exe
Token: SeIncreaseQuotaPrivilege	1488	iexplore.exe
Token: SeSecurityPrivilege	1488	iexplore.exe
Token: SeTakeOwnershipPrivilege	1488	iexplore.exe
Token: SeLoadDriverPrivilege	1488	iexplore.exe
Token: SeSystemProfilePrivilege	1488	iexplore.exe
Token: SeSystemtimePrivilege	1488	iexplore.exe
Token: SeProfSingleProcessPrivilege	1488	iexplore.exe
Token: SeIncBasePriorityPrivilege	1488	iexplore.exe
Token: SeCreatePagefilePrivilege	1488	iexplore.exe
Token: SeBackupPrivilege	1488	iexplore.exe
Token: SeRestorePrivilege	1488	iexplore.exe
Token: SeShutdownPrivilege	1488	iexplore.exe
Token: SeDebugPrivilege	1488	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1488	iexplore.exe
Token: SeChangeNotifyPrivilege	1488	iexplore.exe
Token: SeRemoteShutdownPrivilege	1488	iexplore.exe
Token: SeUndockPrivilege	1488	iexplore.exe
Token: SeManageVolumePrivilege	1488	iexplore.exe
Token: SeImpersonatePrivilege	1488	iexplore.exe
Token: SeCreateGlobalPrivilege	1488	iexplore.exe
Token: 33	1488	iexplore.exe
Token: 34	1488	iexplore.exe
Token: 35	1488	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1208 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXE

pid process

1488 iexplore.exe
1208 iexplore.exe
1208 iexplore.exe
328 IEXPLORE.EXE
328 IEXPLORE.EXE
328 IEXPLORE.EXE
328 IEXPLORE.EXE

pid	process
1208	iexplore.exe

pid	process
1488	iexplore.exe
1208	iexplore.exe
1208	iexplore.exe
328	IEXPLORE.EXE
328	IEXPLORE.EXE
328	IEXPLORE.EXE
328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

MetaMaskBot.exepythonw.exeiexplore.exe

description	pid	process	target process
PID 744 wrote to memory of 1936	744	MetaMaskBot.exe	pythonw.exe
PID 744 wrote to memory of 1936	744	MetaMaskBot.exe	pythonw.exe
PID 744 wrote to memory of 1936	744	MetaMaskBot.exe	pythonw.exe
PID 744 wrote to memory of 1936	744	MetaMaskBot.exe	pythonw.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2004	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 2032	1936	pythonw.exe	pythonw.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1488	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1208	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1208	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1208	1936	pythonw.exe	iexplore.exe
PID 1936 wrote to memory of 1208	1936	pythonw.exe	iexplore.exe
PID 1208 wrote to memory of 328	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 328	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 328	1208	iexplore.exe	IEXPLORE.EXE
PID 1208 wrote to memory of 328	1208	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\MetaMaskBot.exe
"C:\Users\Admin\AppData\Local\Temp\MetaMaskBot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\pythonw.exe
"pythonw.exe" "server.dll"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:2004

C:\Users\Admin\AppData\Roaming\pythonw.exe
"C:\Users\Admin\AppData\Roaming\pythonw.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.com/rsgafs
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5EXHYHTH.txt
Filesize
608B

MD5
ec954efab8519f9c5d9b274f07960908

SHA1
51323748027b2abd4da2b34c9963e38688307c2a

SHA256
f7f2b9ce6c9024ea803ed8e62c7e9d857f4dc6550f927b37628c33070a601d79

SHA512
949d7a4e6c474b2c61c25b4fa5c73da5e791c128bc4d6429daff1d47ec92590a8f701fabbeaca082bc3b3035bf1923c576a39c2c68eb0a27dfd3bae6c7a51621

Download Submit
C:\Users\Admin\AppData\Roaming\pythonw.exe
Filesize
94KB

MD5
09e1729b0917b448f60e9520f8b6c844

SHA1
ac1fe5c308fa4f9c94657a10eae83d55f89d66ac

SHA256
333aa54b7532b181164520f69a680eaee344c2f483a02239898a64126d26a6d9

SHA512
4e3abc2167c9a138c0128beff1ad2543374c82b157afba6ffa8a2d3ab07a662a5cec0997912343375327b51d5d50f126e1a47dcfdcbd8f356d73f390f7584b67

Download Submit
\Users\Admin\AppData\Roaming\pythonw.exe
Filesize
94KB

MD5
09e1729b0917b448f60e9520f8b6c844

SHA1
ac1fe5c308fa4f9c94657a10eae83d55f89d66ac

SHA256
333aa54b7532b181164520f69a680eaee344c2f483a02239898a64126d26a6d9

SHA512
4e3abc2167c9a138c0128beff1ad2543374c82b157afba6ffa8a2d3ab07a662a5cec0997912343375327b51d5d50f126e1a47dcfdcbd8f356d73f390f7584b67

Download Submit
memory/744-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1936-55-0x0000000000000000-mapping.dmp

Download
memory/2032-66-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-64-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-67-0x000000000040CD2F-mapping.dmp

Download
memory/2032-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-70-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-71-0x00000000003D0000-0x0000000000400000-memory.dmp

Filesize
192KB

Download
memory/2032-72-0x0000000000460000-0x000000000048E000-memory.dmp

Filesize
184KB

Download
memory/2032-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-76-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-57-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads