qakbot | f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

General

Target

quak.exe
Size

216KB
MD5

58e1c32eeb0130da19625e55ee48cf1e
SHA1

00ae1c5066f67e5e71285de99bea8d8b67085743
SHA256

f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790
SHA512

31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2
SSDEEP

3072:4FCXMfyhFPZ8H7kJiIceKozOMeNJwOUJCfUfWcxQvAKChQztvWZZOtyFb8e:lXPFP6HWriMeN2rJCyWVDhM55

Score

10^/10

qakbot spx143 1592482956 banker evasion stealer trojan

Malware Config

Extracted

Family

qakbot

Version

324.142

Botnet

spx143

Campaign

1592482956

C2

39.36.254.179:995

24.139.132.70:443

24.202.42.48:2222

72.204.242.138:443

172.242.156.50:995

72.204.242.138:20

68.174.15.223:443

74.193.197.246:443

96.56.237.174:990

64.19.74.29:995

70.168.130.172:443

189.236.166.167:443

68.4.137.211:443

76.187.8.160:443

76.86.57.179:2222

73.226.220.56:443

67.250.184.157:443

75.183.171.155:3389

173.172.205.216:443

173.3.132.17:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe = "0"	reg.exe

Executes dropped EXE 4 IoCs

Processes:

gyosxfa.exegyosxfa.exegyosxfa.exegyosxfa.exe

pid process

4736 gyosxfa.exe
4468 gyosxfa.exe
224 gyosxfa.exe
3464 gyosxfa.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4736	gyosxfa.exe
4468	gyosxfa.exe
224	gyosxfa.exe
3464	gyosxfa.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gyosxfa.exequak.exegyosxfa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	quak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	gyosxfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	gyosxfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	gyosxfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	quak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	quak.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	gyosxfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	gyosxfa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	gyosxfa.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4796 schtasks.exe

pid	process
4796	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

quak.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	quak.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	quak.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	quak.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	quak.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	quak.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1332 PING.EXE

pid	process
1332	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

quak.exequak.exegyosxfa.exegyosxfa.exeexplorer.exequak.exegyosxfa.exegyosxfa.exe

pid	process
3980	quak.exe
3980	quak.exe
1956	quak.exe
1956	quak.exe
1956	quak.exe
1956	quak.exe
4736	gyosxfa.exe
4736	gyosxfa.exe
4468	gyosxfa.exe
4468	gyosxfa.exe
4468	gyosxfa.exe
4468	gyosxfa.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
4636	quak.exe
4636	quak.exe
224	gyosxfa.exe
224	gyosxfa.exe
3464	gyosxfa.exe
3464	gyosxfa.exe
3464	gyosxfa.exe
3464	gyosxfa.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

gyosxfa.exe

pid process

4736 gyosxfa.exe

pid	process
4736	gyosxfa.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

quak.exegyosxfa.exequak.execmd.exegyosxfa.exe

description	pid	process	target process
PID 3980 wrote to memory of 1956	3980	quak.exe	quak.exe
PID 3980 wrote to memory of 1956	3980	quak.exe	quak.exe
PID 3980 wrote to memory of 1956	3980	quak.exe	quak.exe
PID 3980 wrote to memory of 4736	3980	quak.exe	gyosxfa.exe
PID 3980 wrote to memory of 4736	3980	quak.exe	gyosxfa.exe
PID 3980 wrote to memory of 4736	3980	quak.exe	gyosxfa.exe
PID 3980 wrote to memory of 4796	3980	quak.exe	schtasks.exe
PID 3980 wrote to memory of 4796	3980	quak.exe	schtasks.exe
PID 3980 wrote to memory of 4796	3980	quak.exe	schtasks.exe
PID 4736 wrote to memory of 4468	4736	gyosxfa.exe	gyosxfa.exe
PID 4736 wrote to memory of 4468	4736	gyosxfa.exe	gyosxfa.exe
PID 4736 wrote to memory of 4468	4736	gyosxfa.exe	gyosxfa.exe
PID 4736 wrote to memory of 1152	4736	gyosxfa.exe	explorer.exe
PID 4736 wrote to memory of 1152	4736	gyosxfa.exe	explorer.exe
PID 4736 wrote to memory of 1152	4736	gyosxfa.exe	explorer.exe
PID 4736 wrote to memory of 1152	4736	gyosxfa.exe	explorer.exe
PID 4636 wrote to memory of 2472	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 2472	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 1828	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 1828	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 4712	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 4712	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 3316	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 3316	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 1316	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 1316	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 4412	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 4412	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 2820	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 2820	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 3660	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 3660	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 2800	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 2800	4636	quak.exe	reg.exe
PID 4636 wrote to memory of 224	4636	quak.exe	gyosxfa.exe
PID 4636 wrote to memory of 224	4636	quak.exe	gyosxfa.exe
PID 4636 wrote to memory of 224	4636	quak.exe	gyosxfa.exe
PID 4636 wrote to memory of 2332	4636	quak.exe	cmd.exe
PID 4636 wrote to memory of 2332	4636	quak.exe	cmd.exe
PID 4636 wrote to memory of 2076	4636	quak.exe	schtasks.exe
PID 4636 wrote to memory of 2076	4636	quak.exe	schtasks.exe
PID 2332 wrote to memory of 1332	2332	cmd.exe	PING.EXE
PID 2332 wrote to memory of 1332	2332	cmd.exe	PING.EXE
PID 224 wrote to memory of 3464	224	gyosxfa.exe	gyosxfa.exe
PID 224 wrote to memory of 3464	224	gyosxfa.exe	gyosxfa.exe
PID 224 wrote to memory of 3464	224	gyosxfa.exe	gyosxfa.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\quak.exe
"C:\Users\Admin\AppData\Local\Temp\quak.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3980

C:\Users\Admin\AppData\Local\Temp\quak.exe
C:\Users\Admin\AppData\Local\Temp\quak.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1956

C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn mzosxrl /tr "\"C:\Users\Admin\AppData\Local\Temp\quak.exe\" /I mzosxrl" /SC ONCE /Z /ST 11:26 /ET 11:38
2⤵
- Creates scheduled task(s)
PID:4796

C:\Users\Admin\AppData\Local\Temp\quak.exe
C:\Users\Admin\AppData\Local\Temp\quak.exe /I mzosxrl
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:2472

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:1828

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:4712

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3316

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:1316

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:4412

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:2820

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3660

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe" /d "0"
2⤵
- Windows security bypass
PID:2800

C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224

C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\quak.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:1332

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN mzosxrl
2⤵
PID:2076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.dat
Filesize
63B

MD5
cbe726e288d4281c1bbc9bab94cd0676

SHA1
25ed885ae4933858edc30e4b250560428ca33ba0

SHA256
98f25b5fde57eb06d3a174be2f945d01273d8d6ba995f49b4d4f47d94b1d9422

SHA512
a0c6ec4663bceb36222dce38aa674b8f71f0295cb8b3c90a325f6f47b25c7be8170fd291ba2322d841e596025bd62d0625f84b4866ce9e821e372ce52a270e3f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Jyuazxcetmoe\gyosxfa.exe
Filesize
216KB

MD5
58e1c32eeb0130da19625e55ee48cf1e

SHA1
00ae1c5066f67e5e71285de99bea8d8b67085743

SHA256
f5ff6dbf5206cc2db098b41f5af14303f6dc43e36c5ec02604a50d5cfecf4790

SHA512
31ea3186c3c7b77f815e1bc060add4a6c7b3abddf98c5a615a5779472ea46eeacfe256286f8dd741deb29d1d43889f05854462ba621f0f5065cd1e36b61478f2

Download Submit
memory/1152-140-0x0000000000DB0000-0x0000000000DEA000-memory.dmp

Filesize
232KB

Download
memory/1152-144-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download
memory/1152-145-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download
memory/1152-147-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download
memory/1152-150-0x0000000000DB0000-0x0000000000DEA000-memory.dmp

Filesize
232KB

Download
memory/1152-151-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download
memory/1152-142-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download
memory/1152-141-0x0000000001800000-0x0000000001833000-memory.dmp

Filesize
204KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads