redline | 16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be

General

Target

16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe
Size

522KB
MD5

ad4ab8904c368d4ef21d357cfa523eb1
SHA1

12304324b8f999a319b82e6e554518e1f6ed6ebb
SHA256

16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be
SHA512

917793f9824ffe7e8ec18e1b4e68f3f649d3378a9df4b3a699aae870d68b436d8d91dee0ff211b9a76db3edab922aa9a897d7c331c5d82cdaf9c5ab5b0d6344b
SSDEEP

12288:oMrpy90KcaYySiq9nycHCpgHhr8Mj4C6zWKriNepH:ByfcaYy96nwpgCMcCDKriId

Score

10^/10

redline rosn spora discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes

auth_value
441b39ab37774b2ca9931c31e1bc6071

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

jr858534.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr858534.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr858534.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr858534.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr858534.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr858534.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr858534.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/336-157-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-156-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-159-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-161-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-163-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-167-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-169-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-171-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-175-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-173-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-181-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-183-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-185-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-187-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-179-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-177-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-193-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-195-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-199-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-201-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-197-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-203-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-191-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-189-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-207-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-205-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-215-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-213-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-211-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-209-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-221-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-219-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline
behavioral1/memory/336-217-0x00000000050A0000-0x00000000050DF000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

zizb0235.exejr858534.exeku837876.exelr193569.exe

pid process

4476 zizb0235.exe
1160 jr858534.exe
336 ku837876.exe
3340 lr193569.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

jr858534.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr858534.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4476	zizb0235.exe
1160	jr858534.exe
336	ku837876.exe
3340	lr193569.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr858534.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exezizb0235.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zizb0235.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zizb0235.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4624 336 WerFault.exe ku837876.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

jr858534.exeku837876.exelr193569.exe

pid process

1160 jr858534.exe
1160 jr858534.exe
336 ku837876.exe
336 ku837876.exe
3340 lr193569.exe
3340 lr193569.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

jr858534.exeku837876.exelr193569.exe

description pid process

Token: SeDebugPrivilege 1160 jr858534.exe
Token: SeDebugPrivilege 336 ku837876.exe
Token: SeDebugPrivilege 3340 lr193569.exe

pid	pid_target	process	target process
4624	336	WerFault.exe	ku837876.exe

pid	process
1160	jr858534.exe
1160	jr858534.exe
336	ku837876.exe
336	ku837876.exe
3340	lr193569.exe
3340	lr193569.exe

description	pid	process
Token: SeDebugPrivilege	1160	jr858534.exe
Token: SeDebugPrivilege	336	ku837876.exe
Token: SeDebugPrivilege	3340	lr193569.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exezizb0235.exe

description	pid	process	target process
PID 4260 wrote to memory of 4476	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	zizb0235.exe
PID 4260 wrote to memory of 4476	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	zizb0235.exe
PID 4260 wrote to memory of 4476	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	zizb0235.exe
PID 4476 wrote to memory of 1160	4476	zizb0235.exe	jr858534.exe
PID 4476 wrote to memory of 1160	4476	zizb0235.exe	jr858534.exe
PID 4476 wrote to memory of 336	4476	zizb0235.exe	ku837876.exe
PID 4476 wrote to memory of 336	4476	zizb0235.exe	ku837876.exe
PID 4476 wrote to memory of 336	4476	zizb0235.exe	ku837876.exe
PID 4260 wrote to memory of 3340	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	lr193569.exe
PID 4260 wrote to memory of 3340	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	lr193569.exe
PID 4260 wrote to memory of 3340	4260	16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe	lr193569.exe

C:\Users\Admin\AppData\Local\Temp\16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe
"C:\Users\Admin\AppData\Local\Temp\16db0875399a80120633a547d00543382f9321834a6cf4afb29d1a1caf0d38be.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizb0235.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizb0235.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr858534.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr858534.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku837876.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku837876.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 1732
4⤵
- Program crash
PID:4624

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr193569.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr193569.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 336 -ip 336
1⤵
PID:5004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Disabling Security Tools

2

T1089

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr193569.exe
Filesize
175KB

MD5
521a4228cc837d55b6f81e76034e8fef

SHA1
a6e64b69fa404b524dd3772e229969fa11925e20

SHA256
55bfc510af676683336e13430f28680f52ffc592da90746db97c7aa8ce56a02b

SHA512
f9731b885d6a2a60a75cc618b8d52f5b6ebe78982194beb878b1b8833a93ab95a6d02a8120b94823db5a4232505da90fb30fe6c81316239a8a72e7b982eb62e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr193569.exe
Filesize
175KB

MD5
521a4228cc837d55b6f81e76034e8fef

SHA1
a6e64b69fa404b524dd3772e229969fa11925e20

SHA256
55bfc510af676683336e13430f28680f52ffc592da90746db97c7aa8ce56a02b

SHA512
f9731b885d6a2a60a75cc618b8d52f5b6ebe78982194beb878b1b8833a93ab95a6d02a8120b94823db5a4232505da90fb30fe6c81316239a8a72e7b982eb62e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizb0235.exe
Filesize
380KB

MD5
7a0e9423f56b6a9a32dcc8358f215448

SHA1
ab5c5702c834e2829b65fd92ba21ce0dc795d56f

SHA256
ec1f97e8837525cc9665e6da1fabd44e0b1f92e06753a14a4bb46e0c787f442a

SHA512
c2905f131bb14946732c09396c92527579a1b309a4fa547fe87e7d9bce3809697988689c32b43a27f34bca0117f64020db66eac51e175e88b5eef96462106f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizb0235.exe
Filesize
380KB

MD5
7a0e9423f56b6a9a32dcc8358f215448

SHA1
ab5c5702c834e2829b65fd92ba21ce0dc795d56f

SHA256
ec1f97e8837525cc9665e6da1fabd44e0b1f92e06753a14a4bb46e0c787f442a

SHA512
c2905f131bb14946732c09396c92527579a1b309a4fa547fe87e7d9bce3809697988689c32b43a27f34bca0117f64020db66eac51e175e88b5eef96462106f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr858534.exe
Filesize
15KB

MD5
3d1e22240541af29b83d36580e7b0a80

SHA1
02181339ceeeaaf632fc9af7e5f184ccbac20dea

SHA256
bae93dd75487a6e1f3ceba5727d7a153bad6a7687336d0999dd4eeceb70e69fe

SHA512
3e9ab3deb7653b3fb8244b2c4f79e47d331c5218373c48e5cee8418866e4dc3a4328e7de6afbdba39630fec4bf93299ae2578b461ff1e8da435d0918fc3fba97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr858534.exe
Filesize
15KB

MD5
3d1e22240541af29b83d36580e7b0a80

SHA1
02181339ceeeaaf632fc9af7e5f184ccbac20dea

SHA256
bae93dd75487a6e1f3ceba5727d7a153bad6a7687336d0999dd4eeceb70e69fe

SHA512
3e9ab3deb7653b3fb8244b2c4f79e47d331c5218373c48e5cee8418866e4dc3a4328e7de6afbdba39630fec4bf93299ae2578b461ff1e8da435d0918fc3fba97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku837876.exe
Filesize
294KB

MD5
5e131662e772a48c22cacafbf02fe500

SHA1
c6b5ebc0c073d5ea73eb7c96537c1acfdc47ea22

SHA256
19bc634374f0aa0fe449faaab529d4a5b7429e1ea86164e18f62144ee19397f1

SHA512
6b903a4466d40c9b020957f83587f6e75c51879aad66d196eb0843322ff3c82808bbc3c2f11686bed5a6b8fad0d7db815688ee9f70546b6bef9cb64ed4654fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku837876.exe
Filesize
294KB

MD5
5e131662e772a48c22cacafbf02fe500

SHA1
c6b5ebc0c073d5ea73eb7c96537c1acfdc47ea22

SHA256
19bc634374f0aa0fe449faaab529d4a5b7429e1ea86164e18f62144ee19397f1

SHA512
6b903a4466d40c9b020957f83587f6e75c51879aad66d196eb0843322ff3c82808bbc3c2f11686bed5a6b8fad0d7db815688ee9f70546b6bef9cb64ed4654fd8

Download Submit
memory/336-153-0x0000000000650000-0x000000000069B000-memory.dmp

Filesize
300KB

Download
memory/336-154-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-155-0x0000000004AF0000-0x0000000005094000-memory.dmp

Filesize
5.6MB

Download
memory/336-157-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-156-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-159-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-161-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-164-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-163-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-166-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-167-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-169-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-171-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-175-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-173-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-181-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-183-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-185-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-187-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-179-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-177-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-193-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-195-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-199-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-201-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-197-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-203-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-191-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-189-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-207-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-205-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-215-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-213-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-211-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-209-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-221-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-219-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-217-0x00000000050A0000-0x00000000050DF000-memory.dmp

Filesize
252KB

Download
memory/336-1064-0x0000000005220000-0x0000000005838000-memory.dmp

Filesize
6.1MB

Download
memory/336-1065-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/336-1066-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/336-1067-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/336-1068-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-1070-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-1071-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-1072-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-1073-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/336-1074-0x00000000063B0000-0x0000000006442000-memory.dmp

Filesize
584KB

Download
memory/336-1075-0x0000000006590000-0x0000000006606000-memory.dmp

Filesize
472KB

Download
memory/336-1076-0x0000000006620000-0x0000000006670000-memory.dmp

Filesize
320KB

Download
memory/336-1077-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/336-1078-0x0000000006810000-0x00000000069D2000-memory.dmp

Filesize
1.8MB

Download
memory/336-1080-0x00000000069E0000-0x0000000006F0C000-memory.dmp

Filesize
5.2MB

Download
memory/1160-147-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/3340-1086-0x0000000000D30000-0x0000000000D62000-memory.dmp

Filesize
200KB

Download
memory/3340-1087-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads