blackmoon | f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f

General

Target

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
Size

220KB
MD5

5e4f863b9f834f972821c780ead30bd3
SHA1

9877329e8c5b33160fb5bb3428a4446c8936aed0
SHA256

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f
SHA512

7d3e90bcf6be982efd135fc6f4f25ea0679084465d98aa45b6befd70e9cc92777f126205a7f2ca66ac3ddd14937fb840d6c88ba0a187f7472f081a0d19d76f9e
SSDEEP

3072:sqtk2tL7E8TGNSOZtvbEwctSC8JSu+B/+RtXTOMQt9ccOy:sqtks4Vp1h9+B/0jOLDJOy

Score

10^/10

blackmoon gh0strat banker persistence rat trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4112-137-0x00000000022A0000-0x00000000022D8000-memory.dmp	family_blackmoon
behavioral2/memory/4112-143-0x0000000002E40000-0x0000000002EA6000-memory.dmp	family_blackmoon
behavioral2/memory/4112-142-0x0000000002E40000-0x0000000002EA6000-memory.dmp	family_blackmoon
behavioral2/memory/4112-145-0x0000000002E40000-0x0000000002EA6000-memory.dmp	family_blackmoon
behavioral2/memory/4112-186-0x00000000022A0000-0x00000000022D8000-memory.dmp	family_blackmoon
behavioral2/memory/4112-188-0x0000000002E40000-0x0000000002EA6000-memory.dmp	family_blackmoon
behavioral2/memory/4112-195-0x0000000002E40000-0x0000000002EA6000-memory.dmp	family_blackmoon
behavioral2/memory/4112-198-0x00000000022A0000-0x00000000022D8000-memory.dmp	family_blackmoon

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4112-173-0x0000000010000000-0x0000000010003000-memory.dmp	family_gh0strat
behavioral2/memory/4112-175-0x0000000010000000-0x0000000010017000-memory.dmp	family_gh0strat
behavioral2/memory/4112-174-0x0000000010001000-0x000000001000F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Loads dropped DLL 2 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

pid	process
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\Run	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\Documents\\Applicationpxesj.exe"	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	ioc	process
File opened (read-only)	\??\Y:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\M:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\N:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\P:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\T:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\V:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\Z:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\B:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\H:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\L:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\U:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\W:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\F:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\G:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\R:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\K:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\O:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\Q:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\S:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\X:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\E:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\I:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
File opened (read-only)	\??\J:	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

924 4112 WerFault.exe f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

pid	pid_target	process	target process
924	4112	WerFault.exe	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Modifies registry class 1 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4332 NOTEPAD.EXE

pid	process
4332	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

pid	process
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

pid process

4112 f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

pid	process
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe

description	pid	process	target process
PID 4112 wrote to memory of 4332	4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe	NOTEPAD.EXE
PID 4112 wrote to memory of 4332	4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe	NOTEPAD.EXE
PID 4112 wrote to memory of 4332	4112	f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe
"C:\Users\Admin\AppData\Local\Temp\f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.txt
2⤵
- Opens file in notepad (likely ransom note)
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 2136
2⤵
- Program crash
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4112 -ip 4112
1⤵
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aaaty.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaaty.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1948b20c6391592ba65b9dfbe9c90b2e81923e1c327c5c1b851f3a2c13ad58f.txt
Filesize
120KB

MD5
3aea5b78bac5359a799c2714fecccd1a

SHA1
5d3203b328ecfc7a55c0ded1032d209e9f273367

SHA256
c05e763cab67cf9daf5be7a6a6cff2650223987a9693eaa119f69b2bbb6df6c3

SHA512
9513cc84a7ed3dd709d4affb03f6e286dcd43e82f33441c00a9d74d2b45449f2ee20baa8db46218d7a59d9e62fb7f95050ea305166e70f3e71dde39ccf07b6d3

Download Submit
C:\Users\Public\Documents\gjttn.dll
Filesize
2KB

MD5
7943effe67a4647e06def2348949020e

SHA1
eabd561f0639a975de259633f63896d82c3f878d

SHA256
3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa

SHA512
c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

Download Submit
C:\Users\Public\Documents\sjsw.log
Filesize
247B

MD5
fb45a034145a5f25990462d478dbcd48

SHA1
9236ebe83f5af670a549fabadd9b7fc565267b50

SHA256
e409ee406b9d19d39b88db5777e666b05848ba209770dc0b0437cf3361d6626d

SHA512
bb32ef4a1a521ecfffd2c68316ea4be15b81c8a5d388700dd8a8d5443200d1ba97d6045f5398f53ccd0167bb91d0a251164a9cdd8dece7c95511b4cf00053c2f

Download Submit
memory/4112-169-0x0000000003A80000-0x0000000003B72000-memory.dmp

Filesize
968KB

Download
memory/4112-171-0x0000000003A80000-0x0000000003B72000-memory.dmp

Filesize
968KB

Download
memory/4112-146-0x0000000002300000-0x0000000002303000-memory.dmp

Filesize
12KB

Download
memory/4112-142-0x0000000002E40000-0x0000000002EA6000-memory.dmp

Filesize
408KB

Download
memory/4112-143-0x0000000002E40000-0x0000000002EA6000-memory.dmp

Filesize
408KB

Download
memory/4112-167-0x0000000003A80000-0x0000000003B72000-memory.dmp

Filesize
968KB

Download
memory/4112-168-0x0000000003A80000-0x0000000003B72000-memory.dmp

Filesize
968KB

Download
memory/4112-137-0x00000000022A0000-0x00000000022D8000-memory.dmp

Filesize
224KB

Download
memory/4112-170-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4112-145-0x0000000002E40000-0x0000000002EA6000-memory.dmp

Filesize
408KB

Download
memory/4112-173-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/4112-175-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4112-174-0x0000000010001000-0x000000001000F000-memory.dmp

Filesize
56KB

Download
memory/4112-177-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4112-186-0x00000000022A0000-0x00000000022D8000-memory.dmp

Filesize
224KB

Download
memory/4112-188-0x0000000002E40000-0x0000000002EA6000-memory.dmp

Filesize
408KB

Download
memory/4112-189-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4112-195-0x0000000002E40000-0x0000000002EA6000-memory.dmp

Filesize
408KB

Download
memory/4112-198-0x00000000022A0000-0x00000000022D8000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads