dcrat | f729b1f245206764aec8b16491884978effc91030735430d5d906c06c4761a5c

General

Target

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Size

532KB
MD5

7fbdb2f5c7830894d0436a8291e1231f
SHA1

22a13d9bacb8dcf04eb0260999f75fed68d21d0a
SHA256

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152
SHA512

186f41e9bf79dd0e3711c95d2a73ac734efe83b2321f4f5cd920bf21e95c4075829780d91adbce471335a76cc786a68d8162447b6032465def9d54e8e6b36c1d
SSDEEP

12288:KqnOG4bunLVYAN2ehGtdd3vzQ2JzgW8Lntk:K+OG4bcYAnhGl3U2Jz

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeSFX\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeSFX\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\", \"C:\\Documents and Settings\\fontdrvhost.exe\", \"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/1036-132-0x00000000000D0000-0x000000000015C000-memory.dmp	dcrat
C:\Users\SearchApp.exe	dcrat
C:\Documents and Settings\SearchApp.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

SearchApp.exe

pid process

3844 SearchApp.exe

pid	process
3844	SearchApp.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeSFX\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Documents and Settings\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Documents and Settings\\SearchApp.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Documents and Settings\\SearchApp.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Documents and Settings\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152 = "\"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152 = "\"C:\\odt\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxManifest\\StartMenuExperienceHost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\C_936\\fontdrvhost.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeSFX\\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe\""	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

Drops file in System32 directory 3 IoCs

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	ioc	process
File created	C:\Windows\System32\C_936\fontdrvhost.exe	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
File opened for modification	C:\Windows\System32\C_936\fontdrvhost.exe	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
File created	C:\Windows\System32\C_936\5b884080fd4f94e2695da25c503f9e33b9605b83	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

Drops file in Windows directory 2 IoCs

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	ioc	process
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\55b276f4edf653fe07efe8f1ecc32d3d195abd16	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4596 schtasks.exe
5096 schtasks.exe
2032 schtasks.exe
4204 schtasks.exe
2376 schtasks.exe
3592 schtasks.exe
328 schtasks.exe

pid	process
4596	schtasks.exe
5096	schtasks.exe
2032	schtasks.exe
4204	schtasks.exe
2376	schtasks.exe
3592	schtasks.exe
328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exeSearchApp.exe

pid	process
1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
3844	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exeSearchApp.exe

description	pid	process
Token: SeDebugPrivilege	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
Token: SeDebugPrivilege	3844	SearchApp.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe

description	pid	process	target process
PID 1036 wrote to memory of 5096	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 5096	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 2032	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 2032	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 4204	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 4204	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 2376	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 2376	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 3592	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 3592	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 328	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 328	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 4596	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 4596	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	schtasks.exe
PID 1036 wrote to memory of 3844	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	SearchApp.exe
PID 1036 wrote to memory of 3844	1036	25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe	SearchApp.exe

C:\Users\Admin\AppData\Local\Temp\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe
"C:\Users\Admin\AppData\Local\Temp\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\C_936\fontdrvhost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:5096

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2032

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152" /sc ONLOGON /tr "'C:\odt\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4204

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxManifest\StartMenuExperienceHost.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:2376

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:3592

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\AdobeSFX\25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:328

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:4596

C:\Documents and Settings\SearchApp.exe
"C:\Documents and Settings\SearchApp.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\SearchApp.exe

Filesize
532KB

MD5
7fbdb2f5c7830894d0436a8291e1231f

SHA1
22a13d9bacb8dcf04eb0260999f75fed68d21d0a

SHA256
25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152

SHA512
186f41e9bf79dd0e3711c95d2a73ac734efe83b2321f4f5cd920bf21e95c4075829780d91adbce471335a76cc786a68d8162447b6032465def9d54e8e6b36c1d

Download Submit
C:\Users\SearchApp.exe

Filesize
532KB

MD5
7fbdb2f5c7830894d0436a8291e1231f

SHA1
22a13d9bacb8dcf04eb0260999f75fed68d21d0a

SHA256
25bc30afa69d34b938949f1f75a41a142636603a71607e2313e0ce467af93152

SHA512
186f41e9bf79dd0e3711c95d2a73ac734efe83b2321f4f5cd920bf21e95c4075829780d91adbce471335a76cc786a68d8162447b6032465def9d54e8e6b36c1d

Download Submit
memory/328-139-0x0000000000000000-mapping.dmp

Download
memory/1036-133-0x00007FF8B3D60000-0x00007FF8B4821000-memory.dmp

Filesize
10.8MB

Download
memory/1036-144-0x00007FF8B3D60000-0x00007FF8B4821000-memory.dmp

Filesize
10.8MB

Download
memory/1036-132-0x00000000000D0000-0x000000000015C000-memory.dmp

Filesize
560KB

Download
memory/2032-135-0x0000000000000000-mapping.dmp

Download
memory/2376-137-0x0000000000000000-mapping.dmp

Download
memory/3592-138-0x0000000000000000-mapping.dmp

Download
memory/3844-141-0x0000000000000000-mapping.dmp

Download
memory/3844-145-0x00007FF8B3D60000-0x00007FF8B4821000-memory.dmp

Filesize
10.8MB

Download
memory/3844-146-0x00007FF8B3D60000-0x00007FF8B4821000-memory.dmp

Filesize
10.8MB

Download
memory/4204-136-0x0000000000000000-mapping.dmp

Download
memory/4596-140-0x0000000000000000-mapping.dmp

Download
memory/5096-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads