ramnit | 9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c

General

Target

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll
Size

6.4MB
MD5

8adb83307ae6216a76e6287e0fc3ce41
SHA1

f0f8340c3ad4a8d2b5c1b9ac18cdee135f96402f
SHA256

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
SHA512

85f5e4e3c3b092fba0e395303ffe2d9b55544e2e817f681b0024dac2fbae71f788f68714d78fab29ca83d0c617fd17b3eec5ebcd74fe7576f35e668e2fde1278
SSDEEP

98304:l0bENqXyMP0OSU/DktQJ54niDXQNUw40DlSDB7lZz3mZg+9d7Kvos2UvMcXyI:l04DIrRFbQmD0DlSdlZ3mZgyxxsQ0

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

2148 rundll32mgr.exe
Loads dropped DLL 2 IoCs

Processes:

rundll32.exe

pid process

2208 rundll32.exe
2208 rundll32.exe

pid	process
2148	rundll32mgr.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\rundll32mgr.exe	upx
C:\Windows\SysWOW64\rundll32mgr.exe	upx
C:\Windows\SysWOW64\rundll32mgr.exe	upx
\Windows\SysWOW64\rundll32mgr.exe	upx
behavioral1/memory/2148-18-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2148-27-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2208 rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407782708"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7330A81-91F8-11EE-BDDB-62E05E806CC4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C73A2EA1-91F8-11EE-BDDB-62E05E806CC4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

rundll32.exerundll32mgr.exe

pid	process
2208	rundll32.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe
2148	rundll32mgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3024 iexplore.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32mgr.exe

description pid process

Token: SeDebugPrivilege 2148 rundll32mgr.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

2644 iexplore.exe
3024 iexplore.exe

pid	process
3024	iexplore.exe

description	pid	process
Token: SeDebugPrivilege	2148	rundll32mgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2644	iexplore.exe
2644	iexplore.exe
3024	iexplore.exe
3024	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 320 wrote to memory of 2208	320	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2148	2208	rundll32.exe	rundll32mgr.exe
PID 2208 wrote to memory of 2148	2208	rundll32.exe	rundll32mgr.exe
PID 2208 wrote to memory of 2148	2208	rundll32.exe	rundll32mgr.exe
PID 2208 wrote to memory of 2148	2208	rundll32.exe	rundll32mgr.exe
PID 2148 wrote to memory of 3024	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 3024	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 3024	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 3024	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 2644	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 2644	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 2644	2148	rundll32mgr.exe	iexplore.exe
PID 2148 wrote to memory of 2644	2148	rundll32mgr.exe	iexplore.exe
PID 2644 wrote to memory of 2356	2644	iexplore.exe	IEXPLORE.EXE
PID 2644 wrote to memory of 2356	2644	iexplore.exe	IEXPLORE.EXE
PID 2644 wrote to memory of 2356	2644	iexplore.exe	IEXPLORE.EXE
PID 2644 wrote to memory of 2356	2644	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2544	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2544	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2544	3024	iexplore.exe	IEXPLORE.EXE
PID 3024 wrote to memory of 2544	3024	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C73A2EA1-91F8-11EE-BDDB-62E05E806CC4}.dat
Filesize
5KB

MD5
e8dbdabd156744e71211c288ffac9120

SHA1
0ca63d3fc31d4c236bb2f4b86d1fd829d2b0f3e6

SHA256
30da83db85e30c1734833a39c3d031094dbe1577f733f3256ed6352d0e67ff89

SHA512
4eb01e0597b6fd7429f957ca708109f3d30d56e466346e4ba9c1afacc8b825a75a154901107adc47869aaea21253a77cb9260f2a542d71550c125c63f1e5ad92

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
99KB

MD5
f3873258a4258a6761dc54d47463182f

SHA1
fbbf8bca739ca4e9745e5224662b33b437a52461

SHA256
63b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5

SHA512
eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
99KB

MD5
f3873258a4258a6761dc54d47463182f

SHA1
fbbf8bca739ca4e9745e5224662b33b437a52461

SHA256
63b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5

SHA512
eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
99KB

MD5
f3873258a4258a6761dc54d47463182f

SHA1
fbbf8bca739ca4e9745e5224662b33b437a52461

SHA256
63b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5

SHA512
eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4

Download Submit
\Windows\SysWOW64\rundll32mgr.exe
Filesize
99KB

MD5
f3873258a4258a6761dc54d47463182f

SHA1
fbbf8bca739ca4e9745e5224662b33b437a52461

SHA256
63b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5

SHA512
eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4

Download Submit
memory/2148-18-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2148-27-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2148-11-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2148-21-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2148-23-0x000000007753F000-0x0000000077540000-memory.dmp

Filesize
4KB

Download
memory/2148-12-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2208-15-0x0000000074520000-0x0000000074B93000-memory.dmp

Filesize
6.4MB

Download
memory/2208-20-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2208-24-0x0000000000930000-0x0000000000984000-memory.dmp

Filesize
336KB

Download
memory/2208-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2208-25-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2208-19-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2208-9-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2208-8-0x0000000074520000-0x0000000074B93000-memory.dmp

Filesize
6.4MB

Download
memory/2208-17-0x0000000000930000-0x0000000000984000-memory.dmp

Filesize
336KB

Download
memory/2208-13-0x0000000073EA0000-0x0000000074513000-memory.dmp

Filesize
6.4MB

Download
memory/2208-28-0x0000000000930000-0x0000000000984000-memory.dmp

Filesize
336KB

Download
memory/2208-29-0x0000000000930000-0x0000000000984000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads