smokeloader | 72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b

General

Target

72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
Size

320KB
MD5

b49fcbdf8e72720d78bf04dcbdd415a9
SHA1

38f3022e08c3061bde1631a5ba6942cfb94853c2
SHA256

72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b
SHA512

1a082ab58028291030d9c7b00ad732093871e2fa88576e4ce9e96b40ec0d1a42877754d9acf711385c3b086c88faa6657a0023ffc2756c0f7a5ab418e6c473f3
SSDEEP

6144:6XNLaEVQ0YvTM/riHKMsfQbSZ5cuQj9OboJaM5:6XNFVgwOHKMsfQ+gljIeD

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4636-133-0x00000000005E0000-0x00000000005E9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

47 1924 rundll32.exe
128 1924 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

F63C.exe

pid process

3280 F63C.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

1924 rundll32.exe
1924 rundll32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1924 set thread context of 4808 1924 rundll32.exe rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

316 3280 WerFault.exe F63C.exe

flow	pid	process
47	1924	rundll32.exe
128	1924	rundll32.exe

pid	process
3280	F63C.exe

pid	process
1924	rundll32.exe
1924	rundll32.exe

description	pid	process	target process
PID 1924 set thread context of 4808	1924	rundll32.exe	rundll32.exe

pid	pid_target	process	target process
316	3280	WerFault.exe	F63C.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000004656a38a100054656d7000003a0009000400efbe0c55ec984656a78a2e00000000000000000000000000000000000000000000000000b0299a00540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

2204

pid	process
2204

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe

pid	process
4636	72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
4636	72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204
2204

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2204
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe

pid process

4636 72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe

pid	process
2204

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204
Token: SeShutdownPrivilege	2204
Token: SeCreatePagefilePrivilege	2204

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

4808 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

2204
2204

pid	process
4808	rundll32.exe

pid	process
2204
2204

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

F63C.exerundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 3280	2204		F63C.exe
PID 2204 wrote to memory of 3280	2204		F63C.exe
PID 2204 wrote to memory of 3280	2204		F63C.exe
PID 3280 wrote to memory of 1924	3280	F63C.exe	rundll32.exe
PID 3280 wrote to memory of 1924	3280	F63C.exe	rundll32.exe
PID 3280 wrote to memory of 1924	3280	F63C.exe	rundll32.exe
PID 1924 wrote to memory of 4808	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 4808	1924	rundll32.exe	rundll32.exe
PID 1924 wrote to memory of 4808	1924	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe
"C:\Users\Admin\AppData\Local\Temp\72a612b53ceccc7256c767f56dfae33b534e8c95c7293fd32cc6dfc1c9497c4b.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4636

C:\Users\Admin\AppData\Local\Temp\F63C.exe
C:\Users\Admin\AppData\Local\Temp\F63C.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wadadftewrrfq.dll,start
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 24004
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 496
2⤵
- Program crash
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3280 -ip 3280
1⤵
PID:1620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F63C.exe
Filesize
3.7MB

MD5
247300a29ab85ce508146a1fe855aa41

SHA1
822b06c6b1bfdd98ce758c6b8c4c203c4a702e3d

SHA256
d394bb9b02f0b72a853d152a90ae62f21ec3bfd4a5455f2670ca59745748c4c5

SHA512
1008043bfc542e8fa0cbf4c5214a8a10ed41a9574bbddeee15dc45430f23111d8387a2508615d726ff3e19b2732ce8ed6a60ebbf8344677d96f5f81bb45e96c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\F63C.exe
Filesize
3.7MB

MD5
247300a29ab85ce508146a1fe855aa41

SHA1
822b06c6b1bfdd98ce758c6b8c4c203c4a702e3d

SHA256
d394bb9b02f0b72a853d152a90ae62f21ec3bfd4a5455f2670ca59745748c4c5

SHA512
1008043bfc542e8fa0cbf4c5214a8a10ed41a9574bbddeee15dc45430f23111d8387a2508615d726ff3e19b2732ce8ed6a60ebbf8344677d96f5f81bb45e96c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wadadftewrrfq.dll
Filesize
4.2MB

MD5
0eab17ff57b59591019d0147ec26dec0

SHA1
fe80ff85e4cd438e6f08258f2042f18a99eb3b3c

SHA256
c38e98c0130ec4c567d6daef90bb781ed93ce43b761930c0dc1a6a1a084cb52e

SHA512
d20f2eb7de5f86a157cb7f75ec1eddfea9a75f15fc722b9126e45859944b430c91653e7a83191bf87aa60c62f7663e1bbc5897f7f1261ca87b8f16d28850d844

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wadadftewrrfq.dll
Filesize
4.2MB

MD5
0eab17ff57b59591019d0147ec26dec0

SHA1
fe80ff85e4cd438e6f08258f2042f18a99eb3b3c

SHA256
c38e98c0130ec4c567d6daef90bb781ed93ce43b761930c0dc1a6a1a084cb52e

SHA512
d20f2eb7de5f86a157cb7f75ec1eddfea9a75f15fc722b9126e45859944b430c91653e7a83191bf87aa60c62f7663e1bbc5897f7f1261ca87b8f16d28850d844

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wadadftewrrfq.dll
Filesize
4.2MB

MD5
0eab17ff57b59591019d0147ec26dec0

SHA1
fe80ff85e4cd438e6f08258f2042f18a99eb3b3c

SHA256
c38e98c0130ec4c567d6daef90bb781ed93ce43b761930c0dc1a6a1a084cb52e

SHA512
d20f2eb7de5f86a157cb7f75ec1eddfea9a75f15fc722b9126e45859944b430c91653e7a83191bf87aa60c62f7663e1bbc5897f7f1261ca87b8f16d28850d844

Download Submit
memory/1924-156-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-146-0x0000000002290000-0x00000000026CC000-memory.dmp

Filesize
4.2MB

Download
memory/1924-154-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-153-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-152-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-142-0x0000000000000000-mapping.dmp

Download
memory/1924-163-0x0000000003510000-0x000000000405E000-memory.dmp

Filesize
11.3MB

Download
memory/1924-151-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-160-0x00000000041D9000-0x00000000041DB000-memory.dmp

Filesize
8KB

Download
memory/1924-155-0x0000000004160000-0x00000000042A0000-memory.dmp

Filesize
1.2MB

Download
memory/1924-150-0x0000000003510000-0x000000000405E000-memory.dmp

Filesize
11.3MB

Download
memory/1924-148-0x0000000003510000-0x000000000405E000-memory.dmp

Filesize
11.3MB

Download
memory/1924-149-0x0000000003510000-0x000000000405E000-memory.dmp

Filesize
11.3MB

Download
memory/3280-147-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/3280-136-0x0000000000000000-mapping.dmp

Download
memory/3280-141-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/3280-140-0x0000000002B50000-0x0000000003026000-memory.dmp

Filesize
4.8MB

Download
memory/3280-139-0x00000000027D4000-0x0000000002B4C000-memory.dmp

Filesize
3.5MB

Download
memory/4636-134-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4636-132-0x00000000004FE000-0x0000000000513000-memory.dmp

Filesize
84KB

Download
memory/4636-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

Filesize
36KB

Download
memory/4636-135-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4808-157-0x00007FF7181A6890-mapping.dmp

Download
memory/4808-158-0x0000018C7E010000-0x0000018C7E150000-memory.dmp

Filesize
1.2MB

Download
memory/4808-159-0x0000018C7E010000-0x0000018C7E150000-memory.dmp

Filesize
1.2MB

Download
memory/4808-161-0x00000000002D0000-0x0000000000561000-memory.dmp

Filesize
2.6MB

Download
memory/4808-162-0x0000018C7C5C0000-0x0000018C7C863000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads