betabot | f4d358d649b4194238e4f9ef8fc2722da3aa8fb6a9eb89e590359fbed7205989

General

Target

02bd842c7b587c145a18836f8180846c.exe
Size

284KB
MD5

02bd842c7b587c145a18836f8180846c
SHA1

9a17bab1f56906321a4574e87b6720ab24946b3d
SHA256

f4d358d649b4194238e4f9ef8fc2722da3aa8fb6a9eb89e590359fbed7205989
SHA512

d8bcad2d452f51bfbfde6dc6546d9893e9a869c7475962626c60b54187d6937f6114aa3ef0bc1fac20f9e55ebdcee952630797dc24cf54f4779230add820c7d2
SSDEEP

6144:uiOJeNdupo0RmQt9zt1ZRtK8Q9HcPtmCmptGGsBYW/6d9Yr:nhfm3RRtDuH8tFYGGsz6dS

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Malware Config

Signatures

BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
trojan backdoor botnet betabot

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

02bd842c7b587c145a18836f8180846c.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mg1g31w1.exe	02bd842c7b587c145a18836f8180846c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mg1g31w1.exe\DisableExceptionChainValidation	02bd842c7b587c145a18836f8180846c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "aomj.exe"	explorer.exe

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Device Driver Setup 1.2.510.2001 = "C:\\ProgramData\\Device Driver Setup\\mg1g31w1.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Run\Device Driver Setup 1.2.510.2001 = "\"C:\\ProgramData\\Device Driver Setup\\mg1g31w1.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

02bd842c7b587c145a18836f8180846c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	02bd842c7b587c145a18836f8180846c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exeexplorer.exe

pid	process
2728	02bd842c7b587c145a18836f8180846c.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exe

description pid process target process

PID 1656 set thread context of 2728 1656 02bd842c7b587c145a18836f8180846c.exe 02bd842c7b587c145a18836f8180846c.exe

description	pid	process	target process
PID 1656 set thread context of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe02bd842c7b587c145a18836f8180846c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	02bd842c7b587c145a18836f8180846c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	02bd842c7b587c145a18836f8180846c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exeexplorer.exe

pid	process
1656	02bd842c7b587c145a18836f8180846c.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exeexplorer.exe

pid process

2728 02bd842c7b587c145a18836f8180846c.exe
2728 02bd842c7b587c145a18836f8180846c.exe
3052 explorer.exe
3052 explorer.exe
3052 explorer.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exe

pid process

2728 02bd842c7b587c145a18836f8180846c.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeRestorePrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeBackupPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeLoadDriverPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeCreatePagefilePrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeShutdownPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeTakeOwnershipPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeChangeNotifyPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeCreateTokenPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeMachineAccountPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeSecurityPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeAssignPrimaryTokenPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeCreateGlobalPrivilege	2728	02bd842c7b587c145a18836f8180846c.exe
Token: 33	2728	02bd842c7b587c145a18836f8180846c.exe
Token: SeDebugPrivilege	3052	explorer.exe
Token: SeRestorePrivilege	3052	explorer.exe
Token: SeBackupPrivilege	3052	explorer.exe
Token: SeLoadDriverPrivilege	3052	explorer.exe
Token: SeCreatePagefilePrivilege	3052	explorer.exe
Token: SeShutdownPrivilege	3052	explorer.exe
Token: SeTakeOwnershipPrivilege	3052	explorer.exe
Token: SeChangeNotifyPrivilege	3052	explorer.exe
Token: SeCreateTokenPrivilege	3052	explorer.exe
Token: SeMachineAccountPrivilege	3052	explorer.exe
Token: SeSecurityPrivilege	3052	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3052	explorer.exe
Token: SeCreateGlobalPrivilege	3052	explorer.exe
Token: 33	3052	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exe

pid process

1656 02bd842c7b587c145a18836f8180846c.exe
1656 02bd842c7b587c145a18836f8180846c.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

02bd842c7b587c145a18836f8180846c.exe02bd842c7b587c145a18836f8180846c.exeexplorer.exe

description	pid	process	target process
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 1656 wrote to memory of 2728	1656	02bd842c7b587c145a18836f8180846c.exe	02bd842c7b587c145a18836f8180846c.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 2728 wrote to memory of 3052	2728	02bd842c7b587c145a18836f8180846c.exe	explorer.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1192	3052	explorer.exe	Dwm.exe
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1220	3052	explorer.exe	Explorer.EXE
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe
PID 3052 wrote to memory of 1548	3052	explorer.exe	DllHost.exe

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1548

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe
"C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe
"C:\Users\Admin\AppData\Local\Temp\02bd842c7b587c145a18836f8180846c.exe"
3⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-111-0x00000000025C0000-0x00000000025C6000-memory.dmp

Filesize
24KB

Download
memory/1548-113-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/1656-60-0x0000000000280000-0x0000000000285000-memory.dmp

Filesize
20KB

Download
memory/2728-81-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2728-58-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-57-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-93-0x0000000000270000-0x00000000002D6000-memory.dmp

Filesize
408KB

Download
memory/2728-95-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2728-61-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-62-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-63-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-64-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-65-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-66-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2728-68-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-70-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2728-71-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-72-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2728-74-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2728-75-0x0000000000270000-0x00000000002D6000-memory.dmp

Filesize
408KB

Download
memory/2728-76-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2728-78-0x0000000000270000-0x00000000002D6000-memory.dmp

Filesize
408KB

Download
memory/2728-77-0x00000000002F0000-0x00000000002FD000-memory.dmp

Filesize
52KB

Download
memory/2728-80-0x0000000001DF0000-0x0000000001DFC000-memory.dmp

Filesize
48KB

Download
memory/2728-55-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-54-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2728-59-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-56-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/2728-89-0x0000000000400000-0x00000000018B4000-memory.dmp

Filesize
20.7MB

Download
memory/3052-86-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-82-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-85-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-100-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-87-0x0000000000110000-0x00000000001C1000-memory.dmp

Filesize
708KB

Download
memory/3052-91-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-101-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-96-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/3052-94-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/3052-97-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-109-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-99-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/3052-102-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-92-0x0000000000110000-0x00000000001C1000-memory.dmp

Filesize
708KB

Download
memory/3052-83-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-103-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-104-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-105-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-107-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/3052-106-0x0000000000110000-0x00000000001C1000-memory.dmp

Filesize
708KB

Download
memory/3052-108-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-84-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-112-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download
memory/3052-98-0x00000000772C0000-0x0000000077441000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads