blackmoon | a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda

General

Target

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
Size

146KB
MD5

0558b31bd9e3e8233ca74837754882d7
SHA1

a4bcad094372c9348bce850034a028460d19b0a6
SHA256

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda
SHA512

4e8cb6bcd0b74b5508ee211fb2d7796fc5177d3b10fdc3283614ae872bd4cfa32d80648e35c79b2b2b3fa867eadcce4e706301f6e716e46fddefca08eeb1fb04
SSDEEP

3072:GB1Q3LeTWmL359vd0OmS7ok57ORL2G4kOqOcPxab/gp2pFuuxE6l/:E1WeTWmLp9vd0Om6B57ORaG4Rqh51p2q

Score

10^/10

blackmoon gh0strat banker persistence rat trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1256-58-0x0000000000400000-0x0000000000481000-memory.dmp	family_blackmoon
behavioral1/memory/1256-59-0x0000000000400000-0x0000000000481000-memory.dmp	family_blackmoon

Gh0st RAT payload 7 IoCs

Processes:

resource	yara_rule
\Windows\Logs\RunDllExe.dll	family_gh0strat
behavioral1/memory/1744-56-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1744-57-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1256-58-0x0000000000400000-0x0000000000481000-memory.dmp	family_gh0strat
behavioral1/memory/1256-59-0x0000000000400000-0x0000000000481000-memory.dmp	family_gh0strat
behavioral1/memory/1820-62-0x00000000023F0000-0x0000000002430000-memory.dmp	family_gh0strat
behavioral1/memory/1820-63-0x00000000023F0000-0x0000000002430000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Registers new Print Monitor 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe\Driver = "C:\\Windows\\Logs\\RunDllExe.dll"	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1820 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

pid process

616

pid	process
1820	powershell.exe

pid	process
616

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1256-58-0x0000000000400000-0x0000000000481000-memory.dmp	upx
behavioral1/memory/1256-59-0x0000000000400000-0x0000000000481000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 203.124.11.111

description	ioc
Destination IP	203.124.11.111

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MpMgSvc[1].dll	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

description ioc process

File created C:\Windows\Logs\RunDllExe.dll a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

description	ioc	process
File created	C:\Windows\Logs\RunDllExe.dll	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-46-d7-d9-cb-f6\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-46-d7-d9-cb-f6\WpadDecisionTime = 602752649d9ed901	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}\WpadNetworkName = "Network 2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}\86-46-d7-d9-cb-f6	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00be000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-46-d7-d9-cb-f6	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}\WpadDecisionTime = 602752649d9ed901	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6A8BD28B-A178-4097-957E-4E862C0A20E1}\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-46-d7-d9-cb-f6\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exepowershell.exe

pid process

1256 a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
1820 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1820 powershell.exe

pid	process
1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
1820	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1820	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe

description	pid	process	target process
PID 1256 wrote to memory of 1268	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1268	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1268	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1268	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1508	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1508	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1508	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1508	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1648	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1648	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1648	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1648	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 696	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 696	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 696	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 696	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1516	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1516	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1516	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1516	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 896	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 896	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 896	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 896	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1116	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1116	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1116	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1116	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 608	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 608	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 608	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 608	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1528	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1528	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1528	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1528	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 980	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 980	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 980	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 980	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1784	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1784	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1784	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1784	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	netsh.exe
PID 1256 wrote to memory of 1820	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	powershell.exe
PID 1256 wrote to memory of 1820	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	powershell.exe
PID 1256 wrote to memory of 1820	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	powershell.exe
PID 1256 wrote to memory of 1820	1256	a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe
"C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe"
1⤵
- Registers new Print Monitor
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Block
  2⤵
  PID:1268
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filterlist name=Filter1
  2⤵
  PID:1508
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  PID:1648
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  PID:696
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  PID:1516
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  PID:896
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  PID:1116
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  PID:608
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=FilteraAtion1 action=block
  2⤵
  PID:1528
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
  2⤵
  PID:980
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Block assign=y
  2⤵
  PID:1784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\Admin\AppData\Local\Temp\a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda.exe"
  2⤵
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1820

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Logs\RunDllExe.dll

Filesize
169KB

MD5
a80fe16634130aaf166357487b919c4e

SHA1
b3a54e44d1bc8033e221a91432cc05a49ba014dd

SHA256
0cdee9d791f2e9bc98f3e053127a72267f5b90f1f9075db1aa00e26a04a2fd6e

SHA512
f3329ca4351c6bd406ade372af2a926ef4bede851da30621314e1893dc964c42ebb934cea712e72975f68e4e2f6dd063580811caaf9683ed92854eddcefebec8

Download Submit
memory/1256-58-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1256-59-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1744-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1744-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1820-62-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1820-63-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download
memory/1820-64-0x00000000023F0000-0x0000000002430000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads