bumblebee | 33a57eed92fa4acf1be788ce387d0f6f3804aab316d04bcfe8b43cccaf08bdbf

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6309e1.msi
Size

4.1MB
MD5

9159f9fb42365dc0a492ece7ec9aa546
SHA1

8b8426ade01c916bb1f08f69dee611d4cd2379b5
SHA256

33a57eed92fa4acf1be788ce387d0f6f3804aab316d04bcfe8b43cccaf08bdbf
SHA512

d40dcb370495edfe29c4eb488f7ca628a284a69de1d0aa8485d1c92659ab4a80839ce773f1f8b938f2333587019cb42831dd6ea2e349ae4bf7d096a09da657c5
SSDEEP

49152:2DxTgxjSwdT55PZUdV0Du9WsVFPLYLeyCtw50kqKKAf5Q8+5eNBA:bxjSwdqswLYKy0wpqKKAf5Q

Score

10^/10

bumblebee test101234 loader

Malware Config

Extracted

Family

bumblebee

Botnet

test101234

Attributes

dga
n64c2akw.life

zefawfb0.life

dph3pby8.life

hx0hysyg.life

1qa3k743.life

luw8ubf2.life

rbvsf6io.life

4huoqrsp.life

8qwcvseh.life

37zi55wc.life

i9f44mju.life

aqnx9c9h.life

3nmeg5wa.life

r5ue5rok.life

et53yjoc.life

tvgco82h.life

0xtmu3tz.life

6xhpschv.life

6o26tws0.life

0oz7923s.life

54y2q50j.life

9hh7hq5r.life

r0ca080m.life

43vtghfz.life

qal55els.life

p5e68m36.life

x698iah6.life

kqn0zkig.life

wq6w8jkq.life

i6n08gx7.life

yykdmh0r.life

is45ipqt.life

btycmaq0.life

bei9dppm.life

3jhcm6ou.life

1q04n1r6.life

10ciy2hb.life

11ou1grl.life

83b0leyy.life

t31jn4t1.life

b24f19ne.life

igak9l9s.life

hkgd9kar.life

02uhomlq.life

zpy1vssg.life

j57fzy12.life

zmlly8xo.life

pe6r5tzc.life

cg4cuoyi.life

pyjijjlm.life

m3vc2ce4.life

p1p97dov.life

ep0kbvph.life

0rlxan4o.life

zdx0i18o.life

7kmzys39.life

e97igyz6.life

hjcbhzd8.life

az77sw77.life

d0k4fdaa.life

c9l8ri53.life

ay03u2te.life

t99iv15x.life

6a1fbhay.life

zna5lybe.life

vxyojl27.life

mddoknvi.life

2z2dl1og.life

vojg90l2.life

awr5omre.life

tcjcv520.life

aqjjchti.life

6qwim2j8.life

1p34o0do.life

8hxwl72r.life

wykpnxcx.life

o10qz4xe.life

7564a2mg.life

aiv8bb2b.life

jwyxm0f3.life

4soexc4m.life

3xqy6csn.life

3k8iq1nb.life

w2hje2t7.life

fra3xqrx.life

4r3inwrt.life

qhfoevow.life

a9nhflze.life

jpngew6a.life

baunjh6t.life

yqofro9q.life

uq034w07.life

oq36weoi.life

vv5sfo80.life

0req10rd.life

m4v4xq2f.life

1p24echu.life

ohwv1vpp.life

z2tp7x2v.life

q65io756.life
dga_seed
anjd78ka
domain_length
8
num_dga_domains
100
port
443

rc4.plain

Signatures

BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Loads dropped DLL 5 IoCs

pid	Process
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4892	MsiExec.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
44	4892	MsiExec.exe
54	4892	MsiExec.exe
56	4892	MsiExec.exe
58	4892	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4892	MsiExec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8BE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI944E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI94DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9644.tmp	msiexec.exe
File created	C:\Windows\Installer\e588ac6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e588ac6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000064ad0c2742b1dab0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000064ad0c20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900064ad0c2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d064ad0c2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000064ad0c200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4312	msiexec.exe
Token: SeSecurityPrivilege	4636	msiexec.exe
Token: SeCreateTokenPrivilege	4312	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4312	msiexec.exe
Token: SeLockMemoryPrivilege	4312	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4312	msiexec.exe
Token: SeMachineAccountPrivilege	4312	msiexec.exe
Token: SeTcbPrivilege	4312	msiexec.exe
Token: SeSecurityPrivilege	4312	msiexec.exe
Token: SeTakeOwnershipPrivilege	4312	msiexec.exe
Token: SeLoadDriverPrivilege	4312	msiexec.exe
Token: SeSystemProfilePrivilege	4312	msiexec.exe
Token: SeSystemtimePrivilege	4312	msiexec.exe
Token: SeProfSingleProcessPrivilege	4312	msiexec.exe
Token: SeIncBasePriorityPrivilege	4312	msiexec.exe
Token: SeCreatePagefilePrivilege	4312	msiexec.exe
Token: SeCreatePermanentPrivilege	4312	msiexec.exe
Token: SeBackupPrivilege	4312	msiexec.exe
Token: SeRestorePrivilege	4312	msiexec.exe
Token: SeShutdownPrivilege	4312	msiexec.exe
Token: SeDebugPrivilege	4312	msiexec.exe
Token: SeAuditPrivilege	4312	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4312	msiexec.exe
Token: SeChangeNotifyPrivilege	4312	msiexec.exe
Token: SeRemoteShutdownPrivilege	4312	msiexec.exe
Token: SeUndockPrivilege	4312	msiexec.exe
Token: SeSyncAgentPrivilege	4312	msiexec.exe
Token: SeEnableDelegationPrivilege	4312	msiexec.exe
Token: SeManageVolumePrivilege	4312	msiexec.exe
Token: SeImpersonatePrivilege	4312	msiexec.exe
Token: SeCreateGlobalPrivilege	4312	msiexec.exe
Token: SeBackupPrivilege	3840	vssvc.exe
Token: SeRestorePrivilege	3840	vssvc.exe
Token: SeAuditPrivilege	3840	vssvc.exe
Token: SeBackupPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeRestorePrivilege	4636	msiexec.exe
Token: SeTakeOwnershipPrivilege	4636	msiexec.exe
Token: SeBackupPrivilege	2204	srtasks.exe
Token: SeRestorePrivilege	2204	srtasks.exe
Token: SeSecurityPrivilege	2204	srtasks.exe
Token: SeTakeOwnershipPrivilege	2204	srtasks.exe
Token: SeBackupPrivilege	2204	srtasks.exe
Token: SeRestorePrivilege	2204	srtasks.exe
Token: SeSecurityPrivilege	2204	srtasks.exe
Token: SeTakeOwnershipPrivilege	2204	srtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4312	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2204	4636	msiexec.exe	100
PID 4636 wrote to memory of 2204	4636	msiexec.exe	100
PID 4636 wrote to memory of 4640	4636	msiexec.exe	102
PID 4636 wrote to memory of 4640	4636	msiexec.exe	102
PID 4636 wrote to memory of 4640	4636	msiexec.exe	102
PID 4636 wrote to memory of 4892	4636	msiexec.exe	103
PID 4636 wrote to memory of 4892	4636	msiexec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6309e1.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4312

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F94DC99D4D39F28CED2429BC42F79E95
  2⤵
  - Loads dropped DLL
  PID:4640
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8E0232315172FB1357092ABB2C796391
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI8BE0.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI8BE0.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI92D6.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI92D6.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI944E.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI944E.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI944E.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI94DB.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI94DB.tmp

Filesize
721KB

MD5
5a1f2196056c0a06b79a77ae981c7761

SHA1
a880ae54395658f129e24732800e207ecd0b5603

SHA256
52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

SHA512
9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

Download Submit
C:\Windows\Installer\MSI9644.tmp

Filesize
2.1MB

MD5
b6e50a33a2f3caa5346db94ab198ee99

SHA1
3734be87824bdce42c6f83115fde40a82bb42615

SHA256
353fda6e116118809b49dd3001ee532ddfacacaa40a43b951c9f1dd69c8e7491

SHA512
e849b0bf1b49030bc21584384908fd44a6400a1db8ad75dbc9241d53765dca4b0e9407838ee20945e038a23e70e02b74903ed1109e0c0eda5d2d2f044a9d6ad6

Download Submit
C:\Windows\Installer\MSI9644.tmp

Filesize
2.1MB

MD5
b6e50a33a2f3caa5346db94ab198ee99

SHA1
3734be87824bdce42c6f83115fde40a82bb42615

SHA256
353fda6e116118809b49dd3001ee532ddfacacaa40a43b951c9f1dd69c8e7491

SHA512
e849b0bf1b49030bc21584384908fd44a6400a1db8ad75dbc9241d53765dca4b0e9407838ee20945e038a23e70e02b74903ed1109e0c0eda5d2d2f044a9d6ad6

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
7994c688249f87a2310ed41d91d4cb24

SHA1
a1a53d63cef2033541082c28ebc26db99aae7fd2

SHA256
1bede9161568bc5bcb39e5810fecc93f875eb222bf284068384638b5fbafd906

SHA512
6d7c74f99f8f31f76d37066e22bf63e5caee1843efe0deced1b89a78f99003a14af69f7bf721b9e3d46a1bb13d49c4b6ccda9aaab0c68a8db967b3f1aeabaf8f

Download Submit
\??\Volume{c2d04a06-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{23c66889-5659-4ed0-8c44-7876a34b9946}_OnDiskSnapshotProp

Filesize
5KB

MD5
84069d52dcc9df8f7222cb40e05699c6

SHA1
7b933e04a51051dbd3629c003e4f0cb99a7b72c5

SHA256
4602798aa105b88851de1807a906e8a63683da527d277914871854df3262a7ba

SHA512
37d980ac44adf6ff428c829dd8e1981b46cc2ff36a076cc22a0c464397682fbeb939afa91706c6e2677d2ecc544c7bd6704004dd3f26de5cedade8fdae637938

Download Submit
memory/4892-33-0x000002E204590000-0x000002E2047A8000-memory.dmp

Filesize
2.1MB

Download
memory/4892-35-0x000002E204590000-0x000002E2047A8000-memory.dmp

Filesize
2.1MB

Download
memory/4892-36-0x00007FFC7D5B0000-0x00007FFC7D7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4892-37-0x000002E204590000-0x000002E2047A8000-memory.dmp

Filesize
2.1MB

Download
memory/4892-34-0x00007FFC7D5B0000-0x00007FFC7D7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4892-38-0x000002E204590000-0x000002E2047A8000-memory.dmp

Filesize
2.1MB

Download
memory/4892-39-0x00007FFC7D5B0000-0x00007FFC7D7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4892-32-0x00007FFC7D5B0000-0x00007FFC7D7A5000-memory.dmp

Filesize
2.0MB

Download
memory/4892-31-0x000002E204280000-0x000002E204367000-memory.dmp

Filesize
924KB

Download
memory/4892-42-0x000002E204280000-0x000002E204367000-memory.dmp

Filesize
924KB

Download
memory/4892-43-0x00007FFC7D5B0000-0x00007FFC7D7A5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads