sodinokibi | 740ad8ea62f10de39e0b794cf6f579f25af1b8d79f859b48ecd41edc1f92cf13

Reason

Machine shutdown

General

Target

Revil.exe
Size

119KB
MD5

fa8117afd2dbd20513522f2f8e991262
SHA1

f7b876edb8fc0c83fd8b665d3c5a1050d4396302
SHA256

78b592a2710d81fa91235b445f674ee804db39c8cc34f7e894b4e7b7f6eacaff
SHA512

2bab344d136b31cd7c55b7cd0ef1b7718c9952573f3b1478a2efb8211563d7dedacefd4764a7186e15f7de93cc43fa29fc4d2fa61961a14bb12d7bea830e5032
SSDEEP

3072:KW5yc3Y4SMQwuOekD96R928AN+/uSxo+HHz/bs/k4OS:K83Y5BAxa92KrxTnz/Y/k4O

Score

10^/10

sodinokibi $2b$13$wz1rerfdlg.aistldqg5jeqqysemspatwkhdwbpwvrc3ty7akscg6 49 ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6

Campaign

49

Attributes

net
false
pid
$2b$13$wz1reRfdLg.aiStLDqg5JeqqySemSPatWKHdwbpWVrC3ty7Akscg6
prc
vsnapvss

EnterpriseClient

firefox

infopath

cvd

tv_x64.exe

VeeamTransportSvc

steam

encsvc

mydesktopservice

outlook

synctime

ocssd

SAP

cvfwd

bengien

vxmon

bedbh

ocomm

ocautoupds

raw_agent_svc

oracle

disk+work

powerpnt

saposcol

sqbcoreservice

sapstartsrv

beserver

saphostexec

dbeng50

isqlplussvc

CVODS

DellSystemDetect

CVMountd

TeamViewer.exe

dbsnmp

thunderbird

mspub

wordpad

visio

benetns

QBCFMonitorService

TeamViewer_Service.exe

tv_w32.exe

QBIDPService

winword

thebat

VeeamDeploymentSvc

avagent

QBDBMgrN

mydesktopqos

xfssvccon

sql

tbirdconfig

CagService

pvlsvr

avscc

VeeamNFSSvc

onenote

excel

msaccess

agntsvc
ransom_oneliner
All of your files are encrypted! Find EDGEWATER-README.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have {EXT} extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: {KEY} !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!
sub
49
svc
QBCFMonitorService

thebat

dbeng50

winword

dbsnmp

VeeamTransportSvc

disk+work

TeamViewer_Service.exe

firefox

QBIDPService

steam

onenote

CVMountd

cvd

VeeamDeploymentSvc

VeeamNFSSvc

bedbh

mydesktopqos

avscc

infopath

cvfwd

excel

beserver

powerpnt

mspub

synctime

QBDBMgrN

tv_w32.exe

EnterpriseClient

msaccess

ocssd

mydesktopservice

sqbcoreservice

CVODS

DellSystemDetect

oracle

ocautoupds

wordpad

visio

SAP

bengien

TeamViewer.exe

agntsvc

CagService

avagent

ocomm

outlook

saposcol

xfssvccon

isqlplussvc

pvlsvr

sql

tbirdconfig

vxmon

benetns

tv_x64.exe

encsvc

sapstartsrv

vsnapvss

raw_agent_svc

thunderbird

saphostexec

Extracted

Path

C:\Recovery\EDGEWATER-README.txt

Ransom Note

---=== Welcome. Again. ===--- [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have 6yj691 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion When you visit our website, put the following data into the input form: Key: Kb4v5Lcbv3sfBkktB6E4rFpVWC8o0w4IfxnWHN4Ls8hogGm0cC3DRSARsrNMsrGQ Mfyt+bK9xH7sx1dgaacwVcCetG1u4glGSNsVsvSjc9lJot+Ng0jhyuxXWJ9tZBBZ 8D8kr+hWFrAX314bnjXqnw1zt5H0D43bWrutGWPmfetxbwutKuc1DZBWnvenbOm/ h4RuJanM6HTGRaDqE9/HFsRhakks2boYeAL4fZv+0n40DZGc0ky0CCvk1HY0p14D e3gyEG4MoF7OCHaqigAEou2su99z7bTSncsqqknWrL0dXXoMwUVl1cJNsH3KE0kW 8nNhOfiznbR4nR4jVuUb56fWvLZC2XYnb4bIHOyLQw/PjUCfRrrH79eKPnCG6kak RenLnEbCjP4F8w1dfM1608LDXXZOsU+nqESL4ZsEK2HMkDzutgt0apH4WiVBAz5S hk2m7XSSejX0uqHCnYwMpQ4JYQAIWjOdtL14RSLbkoWiVJr4w/TfyZMgUlaW6+n9 NTPQvYxNK6gcd8wP+BqNGGmn0sIcNSSsA03/Fh72gktCxDbvdkr9u7B5qxS2fD4S do4aLwXid9jg6xQoguQtScXipdbhX/9C/R8hrlZfI/w/EpYQ4sxPczNXGa0omGAs 3XjO6oX15hpq3LD4Jc6z9oVrLU+7eBJV3UQZ1MFhimwXMAqhQTwXp+S5mYhaJvzX laT/uS5uDEnX9+Q+OxtUbjMlIDvPofmaRMJikbFKKPTmx1YRePGOREXNURpgCLU7 rKVx+dmAViWFvwuloHQzl0uDZ91tEDajIkOK7wnN0ub9gHqAOY59/NkvRT3fFyLv tsYJEbik9jyDJyW8gbXLMGzrFogwW0i9sDnOOZFkgJU3OYJAXDzYrPTIh3eMu1DD ZcO3nWPl2FQ7kmAqXQFRSvmBg3cjrxoD2w6lRPUL3Ggq+AzeD+0BNYBJzb1lIsvk OYaVmFTcoT0kqgVfG6zFBEKEix8VPn3Bq0qmfYKPyWQZMDlyiJk+VH5MDfSO8U26 e3JQoOJZ3yMa7aB5yKNnw1CEVAnOp8EdK36YjpUUOLKBOYs+JQcsAxAz5FivpNAU DEs4ZlAU75X86sUoMyA1Hfvh0HDWv6LOhOIQ8/Tr3wgiTMaMbs73RNu104cpbI5V 8yUxpwSRW/YrTQ2pDy+BNVfXv68IlaxQgoz0P7OZQmdFHNPy/V90A4yvByrMxm0p XwCWXWT6GEc0rizUi0iwMTq0zWoOZRk2A7Hsfkde4Tjz1QVN9H8QHDJgc3x8JtiE Eou9Gr8MwmiqxY6WmCBNhJm13GNfSMmadn65m1Q7PAZECi/4n3k0OYw/gQg1ZFK5 J1MA0Pq65JNGUQfR8FHCq7fluUPirDeEYSCw+5wGDSJEXg== !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!

URLs

http://4to43yp4mng2gdc3jgnep5bt7lkhqvjqiritbv4x2ebj3qun7wz4y2id.onion

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Revil.exe

description	ioc	process
File opened (read-only)	\??\D:	Revil.exe
File opened (read-only)	\??\A:	Revil.exe
File opened (read-only)	\??\G:	Revil.exe
File opened (read-only)	\??\M:	Revil.exe
File opened (read-only)	\??\N:	Revil.exe
File opened (read-only)	\??\X:	Revil.exe
File opened (read-only)	\??\Y:	Revil.exe
File opened (read-only)	\??\Q:	Revil.exe
File opened (read-only)	\??\R:	Revil.exe
File opened (read-only)	\??\E:	Revil.exe
File opened (read-only)	\??\I:	Revil.exe
File opened (read-only)	\??\J:	Revil.exe
File opened (read-only)	\??\L:	Revil.exe
File opened (read-only)	\??\O:	Revil.exe
File opened (read-only)	\??\P:	Revil.exe
File opened (read-only)	\??\T:	Revil.exe
File opened (read-only)	\??\Z:	Revil.exe
File opened (read-only)	\??\B:	Revil.exe
File opened (read-only)	\??\H:	Revil.exe
File opened (read-only)	\??\S:	Revil.exe
File opened (read-only)	\??\V:	Revil.exe
File opened (read-only)	\??\F:	Revil.exe
File opened (read-only)	\??\K:	Revil.exe
File opened (read-only)	\??\U:	Revil.exe
File opened (read-only)	\??\W:	Revil.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Revil.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qbtwgm809v6c0.bmp"	Revil.exe

Drops file in Program Files directory 26 IoCs

Processes:

Revil.exe

description	ioc	process
File opened for modification	\??\c:\program files\ResumeUndo.rtf	Revil.exe
File opened for modification	\??\c:\program files\TraceSwitch.dib	Revil.exe
File opened for modification	\??\c:\program files\UnblockDebug.wvx	Revil.exe
File created	\??\c:\program files\EDGEWATER-README.txt	Revil.exe
File opened for modification	\??\c:\program files\ConvertFromRead.aifc	Revil.exe
File opened for modification	\??\c:\program files\DisconnectEnter.gif	Revil.exe
File opened for modification	\??\c:\program files\ImportRestore.M2TS	Revil.exe
File opened for modification	\??\c:\program files\PublishEnter.temp	Revil.exe
File created	\??\c:\program files (x86)\EDGEWATER-README.txt	Revil.exe
File opened for modification	\??\c:\program files\CopyOpen.mp4v	Revil.exe
File opened for modification	\??\c:\program files\ReceiveAssert.mpg	Revil.exe
File opened for modification	\??\c:\program files\WatchPing.jpg	Revil.exe
File opened for modification	\??\c:\program files\UsePing.xla	Revil.exe
File opened for modification	\??\c:\program files\CompressTrace.vstm	Revil.exe
File opened for modification	\??\c:\program files\ConvertFromExpand.sql	Revil.exe
File opened for modification	\??\c:\program files\DisableUnblock.dib	Revil.exe
File opened for modification	\??\c:\program files\ExpandTrace.cr2	Revil.exe
File opened for modification	\??\c:\program files\RedoBackup.vdw	Revil.exe
File opened for modification	\??\c:\program files\StopInitialize.clr	Revil.exe
File opened for modification	\??\c:\program files\UnregisterDisconnect.pps	Revil.exe
File opened for modification	\??\c:\program files\UseImport.M2T	Revil.exe
File opened for modification	\??\c:\program files\AddLock.easmx	Revil.exe
File opened for modification	\??\c:\program files\CloseSelect.mpg	Revil.exe
File opened for modification	\??\c:\program files\CompleteHide.tif	Revil.exe
File opened for modification	\??\c:\program files\InvokeRestart.gif	Revil.exe
File opened for modification	\??\c:\program files\MountExit.pot	Revil.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3936 WINWORD.EXE
3936 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Revil.exepowershell.exe

pid process

2524 Revil.exe
2524 Revil.exe
4352 powershell.exe
4352 powershell.exe

pid	process
3936	WINWORD.EXE
3936	WINWORD.EXE

pid	process
2524	Revil.exe
2524	Revil.exe
4352	powershell.exe
4352	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Revil.exepowershell.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2524	Revil.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeBackupPrivilege	2252	vssvc.exe
Token: SeRestorePrivilege	2252	vssvc.exe
Token: SeAuditPrivilege	2252	vssvc.exe
Token: SeTakeOwnershipPrivilege	2524	Revil.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXELogonUI.exe

pid process

3936 WINWORD.EXE
3936 WINWORD.EXE
3936 WINWORD.EXE
3936 WINWORD.EXE
3936 WINWORD.EXE
3936 WINWORD.EXE
992 LogonUI.exe

pid	process
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
3936	WINWORD.EXE
992	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Revil.exe

description	pid	process	target process
PID 2524 wrote to memory of 4352	2524	Revil.exe	powershell.exe
PID 2524 wrote to memory of 4352	2524	Revil.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Revil.exe
"C:\Users\Admin\AppData\Local\Temp\Revil.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2412

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\EDGEWATER-README.txt
1⤵
PID:4060

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:4020

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3960855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\EDGEWATER-README.txt
Filesize
6KB

MD5
03b9c12cd974bdad48dcd231f9224d6d

SHA1
157d2b5a7a27790ee61767b5cce93dd27b9e6d03

SHA256
a24c38ff93983e4e1854e4f715a9892461d0637a2942c406494d570ff6149061

SHA512
ba3df9ac08ba4c685bf54461704c3c76a1d5639e0d70d3c79ed2e7e925672dea8fc35ec1955929547034ef097259b490230478f02b06c33e22a7083b91fce1dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3axoceg.ggj.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\EDGEWATER-README.txt
Filesize
6KB

MD5
03b9c12cd974bdad48dcd231f9224d6d

SHA1
157d2b5a7a27790ee61767b5cce93dd27b9e6d03

SHA256
a24c38ff93983e4e1854e4f715a9892461d0637a2942c406494d570ff6149061

SHA512
ba3df9ac08ba4c685bf54461704c3c76a1d5639e0d70d3c79ed2e7e925672dea8fc35ec1955929547034ef097259b490230478f02b06c33e22a7083b91fce1dd

Download Submit
memory/2524-133-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/2524-134-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/2524-151-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/2524-611-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/2524-627-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/3936-646-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-649-0x00007FF8D0A20000-0x00007FF8D0A30000-memory.dmp

Filesize
64KB

Download
memory/3936-631-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-633-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-632-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-634-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-630-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-635-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-636-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-637-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-638-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-639-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-641-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-640-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-642-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-643-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-644-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-645-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-629-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-647-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-648-0x00007FF8D0A20000-0x00007FF8D0A30000-memory.dmp

Filesize
64KB

Download
memory/3936-628-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-651-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-652-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-653-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-654-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-656-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-657-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-655-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-659-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-658-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-660-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-661-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-662-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/3936-676-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-677-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-678-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-679-0x00007FF8D2F10000-0x00007FF8D2F20000-memory.dmp

Filesize
64KB

Download
memory/3936-680-0x00007FF912E90000-0x00007FF913085000-memory.dmp

Filesize
2.0MB

Download
memory/4352-135-0x000001EA6C070000-0x000001EA6C092000-memory.dmp

Filesize
136KB

Download
memory/4352-145-0x00007FF8F4840000-0x00007FF8F5301000-memory.dmp

Filesize
10.8MB

Download
memory/4352-146-0x000001EA6C0E0000-0x000001EA6C0F0000-memory.dmp

Filesize
64KB

Download
memory/4352-147-0x000001EA6C0E0000-0x000001EA6C0F0000-memory.dmp

Filesize
64KB

Download
memory/4352-150-0x00007FF8F4840000-0x00007FF8F5301000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads