gozi | 95bb46185c352b770ee7bb43ef8635058fc180879d6de6627991e06468329042

General

Target

b334e0d09cea851bd72d2346526a8bfd15a5dbd5ed4a36f0d0fd603a04b4e48f.vbs
Size

847KB
MD5

2368e9e529ee85a9c57efae72ee32a63
SHA1

6c9c1510ca27b115323ff2c11f004fbcb7bf03f8
SHA256

b334e0d09cea851bd72d2346526a8bfd15a5dbd5ed4a36f0d0fd603a04b4e48f
SHA512

a9146dfcf5b0fbe3491898257373c526dfba2b782e45e911b7490a661eed295081c6858eeb7b574f9dfa23b6ede7ba17f2e78e53b3c5613dc07c19d5c89e0c60
SSDEEP

6144:DSI4WZ5LeyWnPuoWD8TgkcObHofZMMKzqXCFdlXYkq8xM2dC0tk2+NEImlKiYebD:D/4r

Score

10^/10

gozi 2000 banker isfb trojan

Malware Config

Extracted

Family

gozi

Attributes

build
217112

Extracted

Family

gozi

Botnet

2000

C2

ad1.wensa.at/api1

nort.calag.at/api1

Attributes

build
217112
dga_base_url
constitution.org/usdeclar.txt
dga_crc
0x4eb7d2ca
dga_season
10
dga_tlds
com

ru

org
dns_servers
193.183.98.66

51.15.98.97

94.247.43.254

195.10.195.195

8.8.8.8
exe_type
loader
server_id
730

rsa_pubkey.plain

serpent.plain

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2860 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2860	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035bca1fda3dd0a4bb84e31f373208d9700000000020000000000106600000001000020000000106b306662d3dc53d3a3ab297d132bf74d9f87f6a7df0ea61c767afd4f34ad73000000000e8000000002000020000000ce5837859fa4cedac68e01ffbc672d24eed69e728e594166f583d2846051b340200000000bdb74f9f201dce251911cb1fff84ab6c636e3b11065885492c169df278bc618400000007b6cd29520a946a790f5a46911d95f665ea423f316e4161d9d84f7ddcbb23d1ff64f3a3af858bcc48dbea7571bbd6440ef3e1d7fa5a13b7ace6de6c8c6e079cd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a050c99bcad6d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035bca1fda3dd0a4bb84e31f373208d9700000000020000000000106600000001000020000000dfd33b423efaf599f0622669f99943bd2b76135cab0202e43c1dd41ce47dd47f000000000e80000000020000200000007995131735bfc543964fa88d7f704c50b2666c8c9600fa2f0f3c7618c80012ab20000000dbac166ba8277d742561f5e5b320068a10e83529fdaca9ad72e88d6a9c9265d14000000012f5b0186c9f98883a7c88fa99fb869d37511cd0c97a561130972bb096bbaabed45ab89e024a00394fe0cbaac965a07468fdeffc35d65227b0bfcbe121884c17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31053514"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c2a0a3cad6d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035bca1fda3dd0a4bb84e31f373208d9700000000020000000000106600000001000020000000c289c0e499e4c4bc1e8cbea99704124142ed2c03ef6a5b85a084b8b5c23dba5d000000000e8000000002000020000000f43f57cc2646008f36276bc2e235dc6b07b49d02612c8508f6297ea0e5bf954b20000000899241dc752788878d720862584367e2218bd317ce6a1e7b0001154225f90b124000000000f45af1c0c02585a9192d840eb5974e6b65a6e563dc4e5460b9e47242f65b15d34cb2db86c9900c21c05076ddc55ebdbd395f13fa85810970327a3905dacec0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ccb39bcad6d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DFD25529-42BD-11EE-877E-E6666E41704E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{ED93C122-42BD-11EE-877E-E6666E41704E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2570696533"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2570540807"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31053514"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C4A7A7C3-42BD-11EE-877E-E6666E41704E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401167b1cad6d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035bca1fda3dd0a4bb84e31f373208d970000000002000000000010660000000100002000000040f5dc92e6a6c5eb4265130e36249a8556173c32b1ba543653b8421b97157372000000000e800000000200002000000090c410fa46b556158d8bec2724fe9761a83136c10df516a852f0b7b3a453337a2000000062d8413617811c4160103bf7a5de7beba01cdaa5b84769b484d3bd392c72c188400000000a58c15af873427f62885902859ebe8781f0149b540ac569336553b5e00e65fcd3c4f734fd663dbf0b7f00da2d17cd526294f97c23e09be6ed91643162a7e3bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-642304425-1816607141-2958861556-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exe

pid process

2440 iexplore.exe
3068 iexplore.exe
1740 iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
2440	iexplore.exe
2440	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
3068	iexplore.exe
3068	iexplore.exe
1584	IEXPLORE.EXE
1584	IEXPLORE.EXE
1740	iexplore.exe
1740	iexplore.exe
3892	IEXPLORE.EXE
3892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

WScript.exerundll32.exeiexplore.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 5068 wrote to memory of 1932	5068	WScript.exe	rundll32.exe
PID 5068 wrote to memory of 1932	5068	WScript.exe	rundll32.exe
PID 1932 wrote to memory of 2860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2860	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 2860	1932	rundll32.exe	rundll32.exe
PID 2440 wrote to memory of 2604	2440	iexplore.exe	IEXPLORE.EXE
PID 2440 wrote to memory of 2604	2440	iexplore.exe	IEXPLORE.EXE
PID 2440 wrote to memory of 2604	2440	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1584	3068	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1584	3068	iexplore.exe	IEXPLORE.EXE
PID 3068 wrote to memory of 1584	3068	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 3892	1740	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 3892	1740	iexplore.exe	IEXPLORE.EXE
PID 1740 wrote to memory of 3892	1740	iexplore.exe	IEXPLORE.EXE

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b334e0d09cea851bd72d2346526a8bfd15a5dbd5ed4a36f0d0fd603a04b4e48f.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\Music\\9493.dll",DllRegisterServer
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\Music\\9493.dll",DllRegisterServer
3⤵
- Loads dropped DLL
PID:2860

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DF50DDEA1C86614517.TMP
Filesize
16KB

MD5
6e4790626240b7caa9ff850536d6d8a0

SHA1
8d5ce65d18cc1d8b6533f92066f48f399170a7b3

SHA256
4e4b7690af1eba6462afe6132f3013d13ac8c32297cab4225db2d386f80ff986

SHA512
3ee43cf2b64cae55d48e14dc4a7739155ff3c6eb732a69a2bbc6e135a9596cacd561b8dee1298ed540da3e086e16b5ebd9738bfcf7c3f0b9f1778061f46354a8

Download Submit
C:\Users\Admin\Music\9493.dll
Filesize
196KB

MD5
08a9e5f418b4d6e1eb79c07793c0ed67

SHA1
fd27aaa177355c6d8ddedfab6442f4649c0533e9

SHA256
dd8ddc5335cf5e9ebf26f58310078237c2711e58ff03691379fd81c1b14bda78

SHA512
312d24df3a1f4294962c40b6a375fced5b5806d3b7080740c862846cae9d7cce3dceafd5993a3d96dc17907d991e9dfc946771c126d69ab7e1c8d4fa8dd2b2a0

Download Submit
C:\Users\Admin\Music\9493.dll
Filesize
196KB

MD5
08a9e5f418b4d6e1eb79c07793c0ed67

SHA1
fd27aaa177355c6d8ddedfab6442f4649c0533e9

SHA256
dd8ddc5335cf5e9ebf26f58310078237c2711e58ff03691379fd81c1b14bda78

SHA512
312d24df3a1f4294962c40b6a375fced5b5806d3b7080740c862846cae9d7cce3dceafd5993a3d96dc17907d991e9dfc946771c126d69ab7e1c8d4fa8dd2b2a0

Download Submit
memory/2860-4-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2860-3-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2860-5-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/2860-6-0x00000000035D0000-0x00000000035E2000-memory.dmp

Filesize
72KB

Download
memory/2860-10-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads