blackmoon | bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f

General

Target

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
Size

355KB
MD5

8ede2c513718db9aff6af9e587b24410
SHA1

e32bcf8d62241a66ba3f748af0b505547b16de8c
SHA256

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f
SHA512

d2bdf4ffe8ca3905f08da6a88d0289c9a3699ccb78a6aa03b294aac413fe340ee773946896e27a333867636d4974828ef62455b41fcbdd926ee0459304a04961
SSDEEP

6144:mhb8VSeoQZP0MPkUonj5tQHTFdkelDnUEA6Fyz1+KqW40D1Kp4StY6Vw7uX:2IweoQR0MPktjsHUZeWD0Z7VQ

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3012-141-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon
behavioral2/memory/3012-142-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon
behavioral2/memory/3012-144-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon
behavioral2/memory/3012-187-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon
behavioral2/memory/3012-189-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon
behavioral2/memory/3012-194-0x0000000002E50000-0x0000000002EB6000-memory.dmp	family_blackmoon

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3012-176-0x0000000010000000-0x0000000010017000-memory.dmp	family_gh0strat
behavioral2/memory/3012-175-0x0000000010001000-0x000000001000F000-memory.dmp	family_gh0strat
behavioral2/memory/3012-196-0x0000000010000000-0x0000000010003000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Loads dropped DLL 1 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

pid process

3012 bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdate = "C:\\Users\\Public\\Documents\\Applicationosyjb.exe"	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	ioc	process
File opened (read-only)	\??\F:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\I:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\K:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\L:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\O:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\R:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\T:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\W:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\X:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\M:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\P:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\U:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\Y:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\Z:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\B:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\H:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\N:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\Q:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\S:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\E:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\G:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\J:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
File opened (read-only)	\??\V:	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 3012 WerFault.exe bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

pid	pid_target	process	target process
1916	3012	WerFault.exe	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Modifies registry class 1 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4988 NOTEPAD.EXE

pid	process
4988	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

pid	process
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

pid process

3012 bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

pid	process
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe

description	pid	process	target process
PID 3012 wrote to memory of 4988	3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe	NOTEPAD.EXE
PID 3012 wrote to memory of 4988	3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe	NOTEPAD.EXE
PID 3012 wrote to memory of 4988	3012	bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe
"C:\Users\Admin\AppData\Local\Temp\bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 2132
2⤵
- Program crash
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3012 -ip 3012
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bfb8286490735f777b64ccdf4fa211e53b2ceb7a8d6cd1929760c211c58b972f.txt
Filesize
120KB

MD5
3aea5b78bac5359a799c2714fecccd1a

SHA1
5d3203b328ecfc7a55c0ded1032d209e9f273367

SHA256
c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3

SHA512
9513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
214B

MD5
959ac6885577db087ef67a95a6a20b11

SHA1
9b95ecb8ec21cc6d1a66445e7dfccd1cc3be28a6

SHA256
a25c209bb1632b10b67322cfa6ac12a3b792ae3bd0be979675df99bdcd680e4a

SHA512
43298968510088467ad33f5cbf40a9a8477ae71595af2915253c41fd25b64a984dca3c07dcdec99f12c56b125774fc10d92b9955b8bdf644a1433947e9127485

Download Submit
C:\Users\Public\Documents\yrrgt.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
memory/3012-141-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-170-0x0000000003FD0000-0x00000000040BC000-memory.dmp

Filesize
944KB

Download
memory/3012-133-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/3012-142-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-144-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-145-0x0000000002320000-0x0000000002323000-memory.dmp

Filesize
12KB

Download
memory/3012-135-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/3012-134-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/3012-169-0x0000000003FD0000-0x00000000040BC000-memory.dmp

Filesize
944KB

Download
memory/3012-136-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/3012-171-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3012-172-0x0000000003FD0000-0x00000000040BC000-memory.dmp

Filesize
944KB

Download
memory/3012-176-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/3012-175-0x0000000010001000-0x000000001000F000-memory.dmp

Filesize
56KB

Download
memory/3012-178-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3012-187-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-189-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-191-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3012-194-0x0000000002E50000-0x0000000002EB6000-memory.dmp

Filesize
408KB

Download
memory/3012-196-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads