redline | 088b0658153a7ad4ff47b113577aa4cc874d2381f0402a317074706761a498a1

General

Target

b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe
Size

682KB
MD5

4842aafe330a4066543e094290f55d21
SHA1

710fdaa38e74a58a7c73de8fa70bcc0d02b9e82d
SHA256

b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21
SHA512

d95b988b48f25169e83b515ac14fe40adad5cb55b715634af4c4357d87ca6f2500c72d16e05508ce47f5e978035b6b5226bc17e698cee36d79ccb4abf5118525
SSDEEP

12288:JMrmy90JiFq4Cfr2vNVhlpaktBMuhWNhtt24JqKY42mZ:jyF4fcjnpasS/j24JqKYg

Score

10^/10

redline dent sony discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes

auth_value
e795368557f02e28e8aef6bcb279a3b0

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pro3210.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro3210.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1244-192-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-194-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-191-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-196-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-198-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-200-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-204-0x0000000007260000-0x0000000007270000-memory.dmp	family_redline
behavioral2/memory/1244-207-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-203-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-209-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-211-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-213-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-215-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-217-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-219-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-221-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-223-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-225-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline
behavioral2/memory/1244-227-0x0000000007130000-0x000000000716E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

un556306.exepro3210.exequ9027.exesi282906.exe

pid process

1712 un556306.exe
3344 pro3210.exe
1244 qu9027.exe
4056 si282906.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1712	un556306.exe
3344	pro3210.exe
1244	qu9027.exe
4056	si282906.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pro3210.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro3210.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro3210.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exeun556306.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un556306.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un556306.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pro3210.exequ9027.exesi282906.exe

pid process

3344 pro3210.exe
3344 pro3210.exe
1244 qu9027.exe
1244 qu9027.exe
4056 si282906.exe
4056 si282906.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pro3210.exequ9027.exesi282906.exe

description pid process

Token: SeDebugPrivilege 3344 pro3210.exe
Token: SeDebugPrivilege 1244 qu9027.exe
Token: SeDebugPrivilege 4056 si282906.exe

pid	process
3344	pro3210.exe
3344	pro3210.exe
1244	qu9027.exe
1244	qu9027.exe
4056	si282906.exe
4056	si282906.exe

description	pid	process
Token: SeDebugPrivilege	3344	pro3210.exe
Token: SeDebugPrivilege	1244	qu9027.exe
Token: SeDebugPrivilege	4056	si282906.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exeun556306.exe

description	pid	process	target process
PID 4644 wrote to memory of 1712	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	un556306.exe
PID 4644 wrote to memory of 1712	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	un556306.exe
PID 4644 wrote to memory of 1712	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	un556306.exe
PID 1712 wrote to memory of 3344	1712	un556306.exe	pro3210.exe
PID 1712 wrote to memory of 3344	1712	un556306.exe	pro3210.exe
PID 1712 wrote to memory of 3344	1712	un556306.exe	pro3210.exe
PID 1712 wrote to memory of 1244	1712	un556306.exe	qu9027.exe
PID 1712 wrote to memory of 1244	1712	un556306.exe	qu9027.exe
PID 1712 wrote to memory of 1244	1712	un556306.exe	qu9027.exe
PID 4644 wrote to memory of 4056	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	si282906.exe
PID 4644 wrote to memory of 4056	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	si282906.exe
PID 4644 wrote to memory of 4056	4644	b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe	si282906.exe

C:\Users\Admin\AppData\Local\Temp\b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe
"C:\Users\Admin\AppData\Local\Temp\b82fcf368bda3ca3dc3909a3962c32c9b778a507b814faa4c9a7e685ab51ca21.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4644

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556306.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556306.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3210.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3210.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9027.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9027.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si282906.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si282906.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si282906.exe
Filesize
175KB

MD5
41dae7877d8ea31ae106f1da78e97f16

SHA1
f3b65c258217446c152aabac7c29373d8b8cf3b9

SHA256
70dc531779ac27d91729dc9246fd396b5a051011233627e826a0f3d19e76e318

SHA512
d70ac4fc3fc9a9cb14e6bc7deab511e4bdc6a1af80a44006fce41cdd844930a2587c4533a0e83db703cab2130ae0396ec186c1c95d3f2113f3e972d04ae3500e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si282906.exe
Filesize
175KB

MD5
41dae7877d8ea31ae106f1da78e97f16

SHA1
f3b65c258217446c152aabac7c29373d8b8cf3b9

SHA256
70dc531779ac27d91729dc9246fd396b5a051011233627e826a0f3d19e76e318

SHA512
d70ac4fc3fc9a9cb14e6bc7deab511e4bdc6a1af80a44006fce41cdd844930a2587c4533a0e83db703cab2130ae0396ec186c1c95d3f2113f3e972d04ae3500e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556306.exe
Filesize
540KB

MD5
7dfd68aabe5aa201ec8626b62ee3f320

SHA1
8810138e1d503929d77dba550f7e24c86a19d2dd

SHA256
8e54b92db30cdf88ab5a2630fcf8105ba9340bd40d0c20fb19d6e3795a59d47f

SHA512
3fd55b08524613e46301e6c7f66b4d53fb846a27bddda33d4c6e5e08b3bca719fcf19c91201d0a5d5c9a6db719cdd4cb5100eac91daa8e034e7229030f0d2955

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556306.exe
Filesize
540KB

MD5
7dfd68aabe5aa201ec8626b62ee3f320

SHA1
8810138e1d503929d77dba550f7e24c86a19d2dd

SHA256
8e54b92db30cdf88ab5a2630fcf8105ba9340bd40d0c20fb19d6e3795a59d47f

SHA512
3fd55b08524613e46301e6c7f66b4d53fb846a27bddda33d4c6e5e08b3bca719fcf19c91201d0a5d5c9a6db719cdd4cb5100eac91daa8e034e7229030f0d2955

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3210.exe
Filesize
322KB

MD5
7d13e1f77a8a0dde60ebc72d903c1de3

SHA1
304529222e1abb4f33cc362cd6407ecc9d7236e9

SHA256
1af99da183bcda829d8b7da71d0b7f90c3a67790e20d094087ce50de2a8218b4

SHA512
8368d5cae596e55c2ef9cff3fec11bbca54eadd245f2ae672a66986bc0f4ba2796b54c14c58640948ece8664fc7ce7ede19051522657cdc9f1bb6be7c0d3161f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3210.exe
Filesize
322KB

MD5
7d13e1f77a8a0dde60ebc72d903c1de3

SHA1
304529222e1abb4f33cc362cd6407ecc9d7236e9

SHA256
1af99da183bcda829d8b7da71d0b7f90c3a67790e20d094087ce50de2a8218b4

SHA512
8368d5cae596e55c2ef9cff3fec11bbca54eadd245f2ae672a66986bc0f4ba2796b54c14c58640948ece8664fc7ce7ede19051522657cdc9f1bb6be7c0d3161f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9027.exe
Filesize
379KB

MD5
d1286043891cfbb979a4f2b1dfb4bb84

SHA1
d3b87690656277bf1112f134929692268a4648df

SHA256
e68090e86974202dfc9d96f18c89dbfc3467b7c364eb93968221cd508e1b4f5e

SHA512
2488aa2eced35af10e92f437801969dc0bd262ce6b42dee5801b98cad620025e163c6f7c153ae746d95b28653e4a83e5be87b3ecbf3d8fad93198d2732a6ffa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9027.exe
Filesize
379KB

MD5
d1286043891cfbb979a4f2b1dfb4bb84

SHA1
d3b87690656277bf1112f134929692268a4648df

SHA256
e68090e86974202dfc9d96f18c89dbfc3467b7c364eb93968221cd508e1b4f5e

SHA512
2488aa2eced35af10e92f437801969dc0bd262ce6b42dee5801b98cad620025e163c6f7c153ae746d95b28653e4a83e5be87b3ecbf3d8fad93198d2732a6ffa4

Download Submit
memory/1244-227-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-1102-0x00000000080B0000-0x00000000080C2000-memory.dmp

Filesize
72KB

Download
memory/1244-1114-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-1113-0x0000000009440000-0x0000000009490000-memory.dmp

Filesize
320KB

Download
memory/1244-1112-0x00000000093B0000-0x0000000009426000-memory.dmp

Filesize
472KB

Download
memory/1244-1111-0x0000000008D60000-0x000000000928C000-memory.dmp

Filesize
5.2MB

Download
memory/1244-1110-0x0000000008B90000-0x0000000008D52000-memory.dmp

Filesize
1.8MB

Download
memory/1244-1109-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-1108-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-1107-0x0000000008460000-0x00000000084C6000-memory.dmp

Filesize
408KB

Download
memory/1244-1106-0x00000000083C0000-0x0000000008452000-memory.dmp

Filesize
584KB

Download
memory/1244-1104-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-1103-0x00000000080D0000-0x000000000810C000-memory.dmp

Filesize
240KB

Download
memory/1244-1101-0x0000000007F70000-0x000000000807A000-memory.dmp

Filesize
1.0MB

Download
memory/1244-1100-0x0000000007920000-0x0000000007F38000-memory.dmp

Filesize
6.1MB

Download
memory/1244-225-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-223-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-221-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-219-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-217-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-215-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-213-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-211-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-192-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-194-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-191-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-196-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-198-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-200-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-201-0x0000000002C80000-0x0000000002CCB000-memory.dmp

Filesize
300KB

Download
memory/1244-204-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-205-0x0000000007260000-0x0000000007270000-memory.dmp

Filesize
64KB

Download
memory/1244-207-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-203-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/1244-209-0x0000000007130000-0x000000000716E000-memory.dmp

Filesize
248KB

Download
memory/3344-174-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-160-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-152-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-184-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-183-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-182-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-181-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3344-180-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-150-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-178-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-176-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-153-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-186-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/3344-172-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-156-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-168-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-164-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-166-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-162-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-151-0x00000000071E0000-0x00000000071F0000-memory.dmp

Filesize
64KB

Download
memory/3344-158-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-170-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-154-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Filesize
72KB

Download
memory/3344-149-0x0000000002B80000-0x0000000002BAD000-memory.dmp

Filesize
180KB

Download
memory/3344-148-0x00000000071F0000-0x0000000007794000-memory.dmp

Filesize
5.6MB

Download
memory/4056-1120-0x00000000006B0000-0x00000000006E2000-memory.dmp

Filesize
200KB

Download
memory/4056-1121-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads