sodinokibi | b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355

General

Target

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe
Size

2.2MB
MD5

d57b968e46117db2f28f660090056cbd
SHA1

91408887001f38abd455efafd7fcee127e76c074
SHA256

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355
SHA512

dda24c65f1aa301818b76cbdfcf5f7fe6b0b3f846623aa8611f49487d342796cd89a162849c8ebb47834a8c77b361fada6641c8f12bb1c090b48a98b387793d7
SSDEEP

49152:pQOZDV/xW2GlEVJu1u2F00bq1olF9BbP5Fp:pZDRxwJ1ji0+yTx

Score

10^/10

sodinokibi $2a$10$9jz5ifrh1v0vhyo02j4h8ogobfa6j48rvgp/ffuyumddpjdwgkqxi 6858 ransomware spyware stealer

Malware Config

Extracted

Path

C:\hkr047ttz6-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension hkr047ttz6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/714B2CAE0C818956 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/714B2CAE0C818956 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2YvUvT3YMX8THWcww6OqNa0a8yoRIyWFmiPE7/cLipLRL4SaH73yKuhCrbmSZTz6 MIqsx/0fC6gukLjaCDDwagANq2X+Qq4oISZ7j+dLfYfSqhgacC74lC12SUA7muFp Mcij+UE5JrBp9OX8iX3h0e4pdzlp7wQYXhoT2TNNCkdvAqzL1bdA19Tmg2bKdEqK W8szjzRgwPRWAQSJXtrwOvF7dGD9/I0y7Vp+OArOGtXCq8/QtAFzqHCyKmeIbgkb eVvfrfL3/hq2supVGHRsLa0P4AeRA0bTWhiDXcqPlYnjCcuHSy0krr56Uwz+Mc6U j+XuiRxonKHOy4D5EOL5CgBZuVcgj9bfb6p8WKP5npS4/FqBZpZrtYP3BCKXsVOR 3UqQEc9E4n8TA1F5lJe/iEnGCF0kAU4yt9GfxH9uX+YXUpI6BxVRmCXJ73WIZUjS VCEbJBYzd3/uFKYd0ppqc6Wi5KduOwUGoP098H5qj9TwEvJuslDhkXWaWIYO8YRx GSEg0NyCvv6urwt3Yz0FwfKEYouCrsMhlkt5/N5BCsjR9PcMJOkx/ZX4HQQC3Tid V9fE+67QSNdWzIJVp43IS+lt0dBXzoJEesj1xq9AukGCXhTHfu1nnWWg8htVC9iz LifUtAggZU5WHXnceIzDDD2meRucDTxbmvqlsh6Jp2fZ1H/o7hRbXOTEXVJayVTm ZR9wfMOh4ZCnAMukK/5HiAISBz5vJX8KypahJ6KB4NFi0CSPC5pJ1OY6VH4nVbxK pqW3VPAIgmtI2LtCNmhYLTMtYW84i8/dj98ZKkqOfuX8aII7gRcNWuyB1fCgJpIH Ts9OYKgzMeLRVikts1FIuDV3Gf7UntJfqGEziN1PCtVTGQ8R0nwlcQXVHwC3Ve6d DAWSX+6ErrfTz4Qj3DINn9cBPd/tdWnrTYSwX9LDA4C4sw+tcpi6caxN1t2PKY/k b5ULV6y/ZFYNcq+2kV2p/k6FyPctaGT1+LMXcalp7bAJZ8Ajb2aGn2ooKI9xzX6x q+kFm28AcA38jlDxw2TlMfBcvi23/LcHDw+ZnjWqHH0SoxVu08vkEEJrWsDIw+2W s9tmm2Nd1GszFlBDKWiZaH5VSAGBSTmrZmDPywg16JidIF0lJQ6/sBOfQjgAXs7M QtaS8KiesKtFOspHOPQTcEd6GY3mAj9VFctHO9m3ZzZrIfJDYDb7JAHok7MCJwJe 8YGcR4K34qQV7uJWIZ4lO77YKnq0lQEXojZ8tNb9E5jkQRvOveqN02Q5WcoxTPd6 HBlyeZ3XC5lrnVuBHj5iQkpZgzHcrlJklPQgzv6UdSHmD6XCIW8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/714B2CAE0C818956

http://decoder.re/714B2CAE0C818956

Extracted

Family

sodinokibi

Botnet

$2a$10$9jZ5Ifrh1v0vhyO02j4H8OGoBFa6j48RvGp/FfUyUmDdPJdWGKqXi

Campaign

6858

Decoy

dubnew.com

danielblum.info

groupe-cets.com

simoneblum.de

slimani.net

oncarrot.com

live-con-arte.de

allentownpapershow.com

hashkasolutindo.com

withahmed.com

qualitus.com

zenderthelender.com

ceid.info.tr

strandcampingdoonbeg.com

bradynursery.com

365questions.org

bouldercafe-wuppertal.de

charlottepoudroux-photographie.fr

pay4essays.net

aminaboutique247.com

Attributes

net
false
pid
$2a$10$9jZ5Ifrh1v0vhyO02j4H8OGoBFa6j48RvGp/FfUyUmDdPJdWGKqXi
prc
sql
winword
mspub
sqbcoreservice
mydesktopservice
visio
ocomm
dbsnmp
powerpnt
msaccess
thunderbird
dbeng50
oracle
tbirdconfig
xfssvccon
outlook
encsvc
mydesktopqos
ocssd
agntsvc
onenote
infopath
thebat
steam
firefox
excel
isqlplussvc
wordpad
ocautoupds
synctime
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
6858
svc
vss
veeam
svc$
backup
memtas
sophos
mepocs
sql

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

3940 vbc.exe

pid	process
3940	vbc.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

vbc.exe

description	ioc	process
File opened for modification	\??\c:\users\admin\pictures\HideGet.tiff	vbc.exe
File renamed	C:\Users\Admin\Pictures\PushWatch.png => \??\c:\users\admin\pictures\PushWatch.png.hkr047ttz6	vbc.exe
File renamed	C:\Users\Admin\Pictures\RequestMount.tiff => \??\c:\users\admin\pictures\RequestMount.tiff.hkr047ttz6	vbc.exe
File opened for modification	\??\c:\users\admin\pictures\RestoreRemove.tiff	vbc.exe
File opened for modification	\??\c:\users\admin\pictures\ShowBlock.tiff	vbc.exe
File renamed	C:\Users\Admin\Pictures\HideGet.tiff => \??\c:\users\admin\pictures\HideGet.tiff.hkr047ttz6	vbc.exe
File renamed	C:\Users\Admin\Pictures\InvokeSearch.raw => \??\c:\users\admin\pictures\InvokeSearch.raw.hkr047ttz6	vbc.exe
File opened for modification	\??\c:\users\admin\pictures\RequestMount.tiff	vbc.exe
File renamed	C:\Users\Admin\Pictures\RestoreRemove.tiff => \??\c:\users\admin\pictures\RestoreRemove.tiff.hkr047ttz6	vbc.exe
File renamed	C:\Users\Admin\Pictures\ShowBlock.tiff => \??\c:\users\admin\pictures\ShowBlock.tiff.hkr047ttz6	vbc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vbc.exe

description	ioc	process
File opened (read-only)	\??\M:	vbc.exe
File opened (read-only)	\??\R:	vbc.exe
File opened (read-only)	\??\T:	vbc.exe
File opened (read-only)	\??\Z:	vbc.exe
File opened (read-only)	\??\K:	vbc.exe
File opened (read-only)	\??\B:	vbc.exe
File opened (read-only)	\??\H:	vbc.exe
File opened (read-only)	\??\I:	vbc.exe
File opened (read-only)	\??\J:	vbc.exe
File opened (read-only)	\??\O:	vbc.exe
File opened (read-only)	\??\P:	vbc.exe
File opened (read-only)	\??\W:	vbc.exe
File opened (read-only)	\??\A:	vbc.exe
File opened (read-only)	\??\X:	vbc.exe
File opened (read-only)	\??\F:	vbc.exe
File opened (read-only)	\??\G:	vbc.exe
File opened (read-only)	\??\L:	vbc.exe
File opened (read-only)	\??\U:	vbc.exe
File opened (read-only)	\??\V:	vbc.exe
File opened (read-only)	\??\E:	vbc.exe
File opened (read-only)	\??\Q:	vbc.exe
File opened (read-only)	\??\S:	vbc.exe
File opened (read-only)	\??\Y:	vbc.exe
File opened (read-only)	\??\D:	vbc.exe
File opened (read-only)	\??\N:	vbc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ckxa08t4ueh.bmp"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe

description	pid	process	target process
PID 3092 set thread context of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe

Drops file in Program Files directory 29 IoCs

Processes:

vbc.exe

description	ioc	process
File opened for modification	\??\c:\program files\SubmitAssert.txt	vbc.exe
File opened for modification	\??\c:\program files\PublishShow.vsdm	vbc.exe
File opened for modification	\??\c:\program files\UnprotectConfirm.eps	vbc.exe
File opened for modification	\??\c:\program files\AddSwitch.wmx	vbc.exe
File opened for modification	\??\c:\program files\ClearDisable.scf	vbc.exe
File opened for modification	\??\c:\program files\SuspendStep.i64	vbc.exe
File opened for modification	\??\c:\program files\SyncEnable.crw	vbc.exe
File opened for modification	\??\c:\program files\UndoSkip.vssx	vbc.exe
File opened for modification	\??\c:\program files\ApproveUnprotect.mpg	vbc.exe
File opened for modification	\??\c:\program files\ConvertFromOut.mht	vbc.exe
File opened for modification	\??\c:\program files\DenyPublish.nfo	vbc.exe
File opened for modification	\??\c:\program files\ExitSearch.dib	vbc.exe
File opened for modification	\??\c:\program files\SendAdd.xps	vbc.exe
File opened for modification	\??\c:\program files\UnblockCheckpoint.odt	vbc.exe
File opened for modification	\??\c:\program files\BackupFormat.wps	vbc.exe
File opened for modification	\??\c:\program files\CompareUnlock.vbs	vbc.exe
File opened for modification	\??\c:\program files\ExportComplete.cr2	vbc.exe
File opened for modification	\??\c:\program files\ExportExpand.docx	vbc.exe
File opened for modification	\??\c:\program files\RestartSend.emf	vbc.exe
File opened for modification	\??\c:\program files\ClearSkip.mpp	vbc.exe
File opened for modification	\??\c:\program files\ConnectProtect.xhtml	vbc.exe
File opened for modification	\??\c:\program files\DenyRename.nfo	vbc.exe
File opened for modification	\??\c:\program files\LockCompress.htm	vbc.exe
File opened for modification	\??\c:\program files\PopSwitch.aifc	vbc.exe
File opened for modification	\??\c:\program files\GetSearch.dwfx	vbc.exe
File opened for modification	\??\c:\program files\GrantUpdate.mpg	vbc.exe
File opened for modification	\??\c:\program files\MergeExit.ttc	vbc.exe
File opened for modification	\??\c:\program files\NewExport.m4a	vbc.exe
File opened for modification	\??\c:\program files\OpenUnpublish.ttf	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

vbc.exe

pid process

3940 vbc.exe
3940 vbc.exe
3940 vbc.exe
3940 vbc.exe

pid	process
3940	vbc.exe
3940	vbc.exe
3940	vbc.exe
3940	vbc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

vbc.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	3940	vbc.exe
Token: SeTakeOwnershipPrivilege	3940	vbc.exe
Token: SeBackupPrivilege	5016	vssvc.exe
Token: SeRestorePrivilege	5016	vssvc.exe
Token: SeAuditPrivilege	5016	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.execmd.exe

description	pid	process	target process
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 3940	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	vbc.exe
PID 3092 wrote to memory of 776	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 3092 wrote to memory of 776	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 3092 wrote to memory of 776	3092	b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe	cmd.exe
PID 776 wrote to memory of 2512	776	cmd.exe	choice.exe
PID 776 wrote to memory of 2512	776	cmd.exe	choice.exe
PID 776 wrote to memory of 2512	776	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe
"C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Local\Temp\vbc.exe
C:\Users\Admin\AppData\Local\Temp\vbc.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 5
3⤵
PID:2512

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b90208a4568088bb7da423c71c9d09a78d709152599bb115316a6d2579330355.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
13e16c5885a2496a6da66535b125f5f8

SHA1
4600ee4dbb12d19d4552615863f4f1260404ae45

SHA256
b94d3bf5504160465039d0dcd15b64014c9a0b67f0dca4cefac3d6e19e187873

SHA512
d0fada8d95a25a5cb5a00dc9e39685cd7221abb8ca3a5474b7477faffbb2dd882b919f35df5ef27a65ce2722d22ba36d10e0960225f86027c1e2a22907f0cb34

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc.exe
Filesize
1.1MB

MD5
13e16c5885a2496a6da66535b125f5f8

SHA1
4600ee4dbb12d19d4552615863f4f1260404ae45

SHA256
b94d3bf5504160465039d0dcd15b64014c9a0b67f0dca4cefac3d6e19e187873

SHA512
d0fada8d95a25a5cb5a00dc9e39685cd7221abb8ca3a5474b7477faffbb2dd882b919f35df5ef27a65ce2722d22ba36d10e0960225f86027c1e2a22907f0cb34

Download Submit
memory/776-140-0x0000000000000000-mapping.dmp

Download
memory/2512-141-0x0000000000000000-mapping.dmp

Download
memory/3092-132-0x0000000000620000-0x000000000085C000-memory.dmp

Filesize
2.2MB

Download
memory/3940-133-0x0000000000000000-mapping.dmp

Download
memory/3940-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3940-138-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3940-139-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3940-143-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3940-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads