asyncrat | 1080f3cd4328fd1e0597c4aba89bf5004894c938234f2d2ccf282f1416219864

General

Target

Legion Private Bot.exe
Size

640KB
MD5

092334866080e7ec50fccc264d869221
SHA1

b4b69530c71474507e8ec5a341252e11862986e0
SHA256

1080f3cd4328fd1e0597c4aba89bf5004894c938234f2d2ccf282f1416219864
SHA512

101eaf97dc6293d7295fccd7883d161c128c780f55d76ba3132685cd92d52d0a417b373d08aa7cdde82f7cf0831776ea959040c7f6fb9568abbf34d365cbc9d9
SSDEEP

12288:/QGF2tAu9o+JPYx+5psS5GkwqbT7pllql+WZcYrje23UFDd6S7sQo:/7F2tAu9o+JQ+5psSU12olvraDt7s

Score

10^/10

asyncrat stormkitty default persistence rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5345460701:AAELDlYM_8yHwfKYHoYl_27JYXLpT-SLsyY/sendMessage?chat_id=689992339

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1804-152-0x0000000000400000-0x0000000000440000-memory.dmp	family_stormkitty

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1804-152-0x0000000000400000-0x0000000000440000-memory.dmp	asyncrat

Executes dropped EXE 4 IoCs

Processes:

svc host.exeWindows Security Service.exesvc host.exeWindows Security Service.exe

pid process

1464 svc host.exe
3368 Windows Security Service.exe
4348 svc host.exe
1804 Windows Security Service.exe

pid	process
1464	svc host.exe
3368	Windows Security Service.exe
4348	svc host.exe
1804	Windows Security Service.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Legion Private Bot.exeWindows Security Service.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Legion Private Bot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Windows Security Service.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Legion Private Bot.exesvc host.exeWindows Security Service.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	Legion Private Bot.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FoGzRNCsHJ = "C:\\Users\\Admin\\AppData\\Roaming\\wDWQzMbHJQ\\xBLQRnSbFD.exe"	svc host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SoMYYdgGNH = "C:\\Users\\Admin\\AppData\\Roaming\\GxMBKmkSFT\\YdXWJzaKWR.exe"	Windows Security Service.exe

Drops desktop.ini file(s) 10 IoCs

Processes:

Windows Security Service.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	Windows Security Service.exe
File opened for modification	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Windows Security Service.exe
File opened for modification	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	Windows Security Service.exe
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	Windows Security Service.exe
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	Windows Security Service.exe
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Windows Security Service.exe
File opened for modification	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	Windows Security Service.exe
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	Windows Security Service.exe
File created	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	Windows Security Service.exe
File opened for modification	C:\Users\Admin\AppData\Local\02b399f142bf7ce91ea3aa10029008a5\Admin@COXNLIOB_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	Windows Security Service.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

flow	ioc
15	icanhazip.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

Legion Private Bot.exesvc host.exeWindows Security Service.exe

description	pid	process	target process
PID 3388 set thread context of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 1464 set thread context of 4348	1464	svc host.exe	svc host.exe
PID 3368 set thread context of 1804	3368	Windows Security Service.exe	Windows Security Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Windows Security Service.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Windows Security Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Windows Security Service.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3388 schtasks.exe

pid	process
3388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Windows Security Service.exe

pid	process
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe
1804	Windows Security Service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Windows Security Service.exe

description pid process

Token: SeDebugPrivilege 1804 Windows Security Service.exe
Token: SeDebugPrivilege 1804 Windows Security Service.exe

description	pid	process
Token: SeDebugPrivilege	1804	Windows Security Service.exe
Token: SeDebugPrivilege	1804	Windows Security Service.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

Legion Private Bot.exeLegion Private Bot.exesvc host.exeWindows Security Service.exeWindows Security Service.execmd.execmd.exe

description	pid	process	target process
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 3388 wrote to memory of 1704	3388	Legion Private Bot.exe	Legion Private Bot.exe
PID 1704 wrote to memory of 1464	1704	Legion Private Bot.exe	svc host.exe
PID 1704 wrote to memory of 1464	1704	Legion Private Bot.exe	svc host.exe
PID 1704 wrote to memory of 1464	1704	Legion Private Bot.exe	svc host.exe
PID 1704 wrote to memory of 3368	1704	Legion Private Bot.exe	Windows Security Service.exe
PID 1704 wrote to memory of 3368	1704	Legion Private Bot.exe	Windows Security Service.exe
PID 1704 wrote to memory of 3368	1704	Legion Private Bot.exe	Windows Security Service.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 1464 wrote to memory of 4348	1464	svc host.exe	svc host.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 3368 wrote to memory of 1804	3368	Windows Security Service.exe	Windows Security Service.exe
PID 1804 wrote to memory of 5056	1804	Windows Security Service.exe	cmd.exe
PID 1804 wrote to memory of 5056	1804	Windows Security Service.exe	cmd.exe
PID 1804 wrote to memory of 5056	1804	Windows Security Service.exe	cmd.exe
PID 5056 wrote to memory of 4300	5056	cmd.exe	chcp.com
PID 5056 wrote to memory of 4300	5056	cmd.exe	chcp.com
PID 5056 wrote to memory of 4300	5056	cmd.exe	chcp.com
PID 5056 wrote to memory of 2164	5056	cmd.exe	netsh.exe
PID 5056 wrote to memory of 2164	5056	cmd.exe	netsh.exe
PID 5056 wrote to memory of 2164	5056	cmd.exe	netsh.exe
PID 5056 wrote to memory of 3448	5056	cmd.exe	findstr.exe
PID 5056 wrote to memory of 3448	5056	cmd.exe	findstr.exe
PID 5056 wrote to memory of 3448	5056	cmd.exe	findstr.exe
PID 1804 wrote to memory of 4572	1804	Windows Security Service.exe	cmd.exe
PID 1804 wrote to memory of 4572	1804	Windows Security Service.exe	cmd.exe
PID 1804 wrote to memory of 4572	1804	Windows Security Service.exe	cmd.exe
PID 4572 wrote to memory of 4252	4572	cmd.exe	chcp.com
PID 4572 wrote to memory of 4252	4572	cmd.exe	chcp.com
PID 4572 wrote to memory of 4252	4572	cmd.exe	chcp.com
PID 4572 wrote to memory of 3568	4572	cmd.exe	netsh.exe
PID 4572 wrote to memory of 3568	4572	cmd.exe	netsh.exe
PID 4572 wrote to memory of 3568	4572	cmd.exe	netsh.exe
PID 1804 wrote to memory of 3388	1804	Windows Security Service.exe	schtasks.exe
PID 1804 wrote to memory of 3388	1804	Windows Security Service.exe	schtasks.exe
PID 1804 wrote to memory of 3388	1804	Windows Security Service.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Legion Private Bot.exe
"C:\Users\Admin\AppData\Local\Temp\Legion Private Bot.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388

C:\Users\Admin\AppData\Local\Temp\Legion Private Bot.exe
"C:\Users\Admin\AppData\Local\Temp\Legion Private Bot.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Roaming\svc host.exe
"C:\Users\Admin\AppData\Roaming\svc host.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Roaming\svc host.exe
"C:\Users\Admin\AppData\Roaming\svc host.exe"
4⤵
- Executes dropped EXE
PID:4348

C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
"C:\Users\Admin\AppData\Roaming\Windows Security Service.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
"C:\Users\Admin\AppData\Roaming\Windows Security Service.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
5⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:4300

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
6⤵
PID:2164

C:\Windows\SysWOW64\findstr.exe
findstr All
6⤵
PID:3448

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
5⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:4252

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
6⤵
PID:3568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Roaming\Windows Security Service.exe"
5⤵
- Creates scheduled task(s)
PID:3388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Legion Private Bot.exe.log
Filesize
507B

MD5
76ffb2f33cb32ade8fc862a67599e9d8

SHA1
920cc4ab75b36d2f9f6e979b74db568973c49130

SHA256
f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

SHA512
f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svc host.exe.log
Filesize
507B

MD5
76ffb2f33cb32ade8fc862a67599e9d8

SHA1
920cc4ab75b36d2f9f6e979b74db568973c49130

SHA256
f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

SHA512
f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
Filesize
297KB

MD5
46f8b83424bbee8da5fd4f604ff0d980

SHA1
70bb6632cdafd5d2b1d12017be7573f997782ddd

SHA256
618abb7d696e6545bf5c13f03a45faf1e5c3a15ecbedd0bf59096a62c6c94c9a

SHA512
898390de451b8e6b691df6e7fbc3ccfbfd030da7ba6b436bf4a8fe0ebe20f8a2914b346f5775fe9ea7bed6d350f4f66adb6106cf83d22c4116bac384e02fb03c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
Filesize
297KB

MD5
46f8b83424bbee8da5fd4f604ff0d980

SHA1
70bb6632cdafd5d2b1d12017be7573f997782ddd

SHA256
618abb7d696e6545bf5c13f03a45faf1e5c3a15ecbedd0bf59096a62c6c94c9a

SHA512
898390de451b8e6b691df6e7fbc3ccfbfd030da7ba6b436bf4a8fe0ebe20f8a2914b346f5775fe9ea7bed6d350f4f66adb6106cf83d22c4116bac384e02fb03c

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Security Service.exe
Filesize
297KB

MD5
46f8b83424bbee8da5fd4f604ff0d980

SHA1
70bb6632cdafd5d2b1d12017be7573f997782ddd

SHA256
618abb7d696e6545bf5c13f03a45faf1e5c3a15ecbedd0bf59096a62c6c94c9a

SHA512
898390de451b8e6b691df6e7fbc3ccfbfd030da7ba6b436bf4a8fe0ebe20f8a2914b346f5775fe9ea7bed6d350f4f66adb6106cf83d22c4116bac384e02fb03c

Download Submit
C:\Users\Admin\AppData\Roaming\svc host.exe
Filesize
140KB

MD5
397638390e9c49c10200a5cbd7a9ec7f

SHA1
e763d4cf6f005eac4fa683647d33ff9989069a90

SHA256
0b6a4f044f5e73cea182b412fe01dd6b93b959c29c477bb729facc9d6f648c0f

SHA512
11e1d3ddc3bc932e39462cf8c5f5f876edcdb609a29913c0d7775a9130e0634836aa1f0d5bc1fe66c4b0c8ceda429a135d3ded37ecb9fc8f36fe0a37b5b34701

Download Submit
C:\Users\Admin\AppData\Roaming\svc host.exe
Filesize
140KB

MD5
397638390e9c49c10200a5cbd7a9ec7f

SHA1
e763d4cf6f005eac4fa683647d33ff9989069a90

SHA256
0b6a4f044f5e73cea182b412fe01dd6b93b959c29c477bb729facc9d6f648c0f

SHA512
11e1d3ddc3bc932e39462cf8c5f5f876edcdb609a29913c0d7775a9130e0634836aa1f0d5bc1fe66c4b0c8ceda429a135d3ded37ecb9fc8f36fe0a37b5b34701

Download Submit
C:\Users\Admin\AppData\Roaming\svc host.exe
Filesize
140KB

MD5
397638390e9c49c10200a5cbd7a9ec7f

SHA1
e763d4cf6f005eac4fa683647d33ff9989069a90

SHA256
0b6a4f044f5e73cea182b412fe01dd6b93b959c29c477bb729facc9d6f648c0f

SHA512
11e1d3ddc3bc932e39462cf8c5f5f876edcdb609a29913c0d7775a9130e0634836aa1f0d5bc1fe66c4b0c8ceda429a135d3ded37ecb9fc8f36fe0a37b5b34701

Download Submit
memory/1464-143-0x00000000001C0000-0x00000000001EA000-memory.dmp

Filesize
168KB

Download
memory/1464-139-0x0000000000000000-mapping.dmp

Download
memory/1704-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1704-136-0x0000000000000000-mapping.dmp

Download
memory/1804-150-0x0000000000000000-mapping.dmp

Download
memory/1804-163-0x0000000006F60000-0x0000000006F6A000-memory.dmp

Filesize
40KB

Download
memory/1804-164-0x0000000005F90000-0x0000000005FA2000-memory.dmp

Filesize
72KB

Download
memory/1804-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1804-154-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/2164-158-0x0000000000000000-mapping.dmp

Download
memory/3368-142-0x0000000000000000-mapping.dmp

Download
memory/3368-146-0x0000000000730000-0x0000000000782000-memory.dmp

Filesize
328KB

Download
memory/3388-134-0x00000000054A0000-0x0000000005532000-memory.dmp

Filesize
584KB

Download
memory/3388-133-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/3388-132-0x0000000000A20000-0x0000000000AC6000-memory.dmp

Filesize
664KB

Download
memory/3388-165-0x0000000000000000-mapping.dmp

Download
memory/3388-135-0x00000000055E0000-0x000000000567C000-memory.dmp

Filesize
624KB

Download
memory/3448-159-0x0000000000000000-mapping.dmp

Download
memory/3568-162-0x0000000000000000-mapping.dmp

Download
memory/4252-161-0x0000000000000000-mapping.dmp

Download
memory/4300-157-0x0000000000000000-mapping.dmp

Download
memory/4348-147-0x0000000000000000-mapping.dmp

Download
memory/4348-155-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/4348-148-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4572-160-0x0000000000000000-mapping.dmp

Download
memory/5056-156-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads