gozi | 6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d

Analysis

max time kernel
0s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d.exe
Size 3.8MB
Sample240107-w3mxqscfa3
SHA256 6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d
MD5 47000b94531ad6b652797c1f2e525752
SHA1 58de952fe5d182294e5e6d5141567b9ce61a331e
SHA512 eb9795ad340d101c5d1412ed1206ff97ecb75ea79da3a3030e175d6d2926ab47e67944bd5e660b3e0c4f017f9b28f8ec7f7004a35a5c5446edf55dca7ec51dd4
SSDEEP 98304:yktaLYOV0bHarm4/UIL8HCKqq/4bB5jIlEK:yOakOObqtRz0lEK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gozi nullmixer smokeloader vidar 706 backdoor banker dropper isfb stealer trojan

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

nullmixer

http://sornx.xyz/

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/2304-190-0x0000000003A30000-0x0000000003ACD000-memory.dmp	family_vidar
behavioral2/memory/2304-206-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar
behavioral2/memory/2304-235-0x0000000000400000-0x0000000001DDD000-memory.dmp	family_vidar

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
3272	688	WerFault.exe
4564	2304	WerFault.exe	41
932	2304	WerFault.exe	41
4208	2304	WerFault.exe	41
1132	2304	WerFault.exe	41
4504	2304	WerFault.exe	41
2704	2304	WerFault.exe	41
4404	2304	WerFault.exe	41
3464	2304	WerFault.exe	41
4552	2304	WerFault.exe	41
4404	3980	WerFault.exe	53
2704	2304	WerFault.exe	41
4640	2304	WerFault.exe	41
852	2304	WerFault.exe	41
1736	2304	WerFault.exe	41
852	2304	WerFault.exe	41
5188	2304	WerFault.exe	41
5248	2304	WerFault.exe	41
5896	4616	WerFault.exe	66
5924	960	WerFault.exe	63
5940	4152	WerFault.exe	54
6124	4304	WerFault.exe	35
4824	5448	WerFault.exe	163
1684	3520	WerFault.exe	178
5500	5304	WerFault.exe	183
5908	4344	WerFault.exe	187
2024	4248	WerFault.exe	192
1300	5280	WerFault.exe	200
5440	5424	WerFault.exe	207

C:\Users\Admin\AppData\Local\Temp\6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d.exe
"C:\Users\Admin\AppData\Local\Temp\6bd2d5f2630ce91d3d93d5a686d0ea381b6efa2b25d0dbd0f509a17f7ed3788d.exe"
1⤵
PID:4840
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  PID:3748
- - C:\Users\Admin\AppData\Local\Temp\7zS4AE57307\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4AE57307\setup_install.exe"
    3⤵
    PID:4208

C:\Users\Admin\AppData\Local\Temp\5350ad3bc3d6e68.exe
C:\Users\Admin\AppData\Local\Temp\5350ad3bc3d6e68.exe
1⤵
PID:540
- C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\setup_install.exe"
  2⤵
  PID:688

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10d95ada86e6c1786.exe
Mon10d95ada86e6c1786.exe
1⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10716eec3c629f745.exe
Mon10716eec3c629f745.exe
1⤵
PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 832
  2⤵
  - Program crash
  PID:6124

C:\Users\Admin\AppData\Local\Temp\is-JGSO7.tmp\Mon10c1a120fed696e5.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JGSO7.tmp\Mon10c1a120fed696e5.tmp" /SL5="$40200,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10c1a120fed696e5.exe"
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 688 -ip 688
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 584
1⤵
- Program crash
PID:3272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:4052

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon1064e3e790b.exe
Mon1064e3e790b.exe
1⤵
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 824
  2⤵
  - Program crash
  PID:4564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 832
  2⤵
  - Program crash
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 876
  2⤵
  - Program crash
  PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\5350ad3bc3d6e68.exe
    3⤵
    PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 884
  2⤵
  - Program crash
  PID:1132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1040
  2⤵
  - Program crash
  PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1096
  2⤵
  - Program crash
  PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1520
  2⤵
  - Program crash
  PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1532
  2⤵
  - Program crash
  PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1780
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1488
  2⤵
  - Program crash
  PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1560
  2⤵
  - Program crash
  PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1804
  2⤵
  - Program crash
  PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1516
  2⤵
  - Program crash
  PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1564
  2⤵
  - Program crash
  PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1516
  2⤵
  - Program crash
  PID:5188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1748
  2⤵
  - Program crash
  PID:5248

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10ef626df85c57.exe
Mon10ef626df85c57.exe
1⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10ec395ae192.exe
Mon10ec395ae192.exe
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2304 -ip 2304
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10c1a120fed696e5.exe
Mon10c1a120fed696e5.exe
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2304 -ip 2304
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2304 -ip 2304
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2304 -ip 2304
1⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon107ce740ef0.exe
Mon107ce740ef0.exe
1⤵
PID:3980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 372
  2⤵
  - Program crash
  PID:4404

C:\Users\Admin\AppData\Local\Temp\7zSC12AD967\Mon10509f710deaa1c.exe
Mon10509f710deaa1c.exe
1⤵
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 32564
  2⤵
  - Program crash
  PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2304 -ip 2304
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2304 -ip 2304
1⤵
PID:4040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10ef626df85c57.exe
1⤵
PID:2992
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:3520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1144
      4⤵
      Program crash
      PID:1684
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:5304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 1132
      4⤵
      Program crash
      PID:5500
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:5612
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1140
      4⤵
      Program crash
      PID:5908
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:4248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1116
      4⤵
      Program crash
      PID:2024
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:1180
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:5280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 1144
      4⤵
      Program crash
      PID:1300
- C:\ProgramData\Java Updater\5o9k5yus37o7s.exe
  /prstb
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    PID:5424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 1140
      4⤵
      Program crash
      PID:5440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10ec395ae192.exe
1⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10716eec3c629f745.exe
1⤵
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 368
  2⤵
  - Program crash
  PID:5924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10c1a120fed696e5.exe
1⤵
PID:932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon1064e3e790b.exe
1⤵
PID:804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10d95ada86e6c1786.exe
1⤵
PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 372
  2⤵
  - Program crash
  PID:5896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon107ce740ef0.exe
1⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Mon10509f710deaa1c.exe
1⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2304 -ip 2304
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2304 -ip 2304
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2304 -ip 2304
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3980 -ip 3980
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2304 -ip 2304
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2304 -ip 2304
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2304 -ip 2304
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2304 -ip 2304
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2304 -ip 2304
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2304 -ip 2304
1⤵
PID:5164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2304 -ip 2304
1⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\B6DC.exe
C:\Users\Admin\AppData\Local\Temp\B6DC.exe
1⤵
PID:5372
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:5448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 1128
    3⤵
    - Program crash
    PID:4824

C:\Users\Admin\AppData\Local\Temp\BC9A.exe
C:\Users\Admin\AppData\Local\Temp\BC9A.exe
1⤵
PID:5512
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4152 -ip 4152
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 960 -ip 960
1⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4616 -ip 4616
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4304 -ip 4304
1⤵
PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5448 -ip 5448
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3520 -ip 3520
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5304 -ip 5304
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4344 -ip 4344
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4248 -ip 4248
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5280 -ip 5280
1⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5424 -ip 5424
1⤵
PID:5412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4AE57307\setup_install.exe
Size 92KB
SHA256 26d1de68fdd588516ddf0f672991611695f9e3f4d82c8a35e566caa8a2e31f3b
MD5 89fb44d2b0c5ee169bd8e95f4094475c
SHA1 d69c41993d08b4a172cffdf5f309e223d2746df8
SHA512 98c26f5119463a31dc7f361ddf1b9b3bdf9fa7afada0e3db8d5f6f81aa1f42966643647791f510c384f12d38ac6fd23d12f96498c294da7275507ff702c9c5a3
SSDEEP 1536:VFwOkU+wUQJpqK+Z9UAGmZX1r5jWdr2EszGAgisUq/63eVpk+Jps:ViOHTJpqR9mmBl5jsr7ZirqS3OG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-106-0x0000000000770000-0x00000000007FF000-memory.dmp

Download

memory/688-112-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-202-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/688-105-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/688-111-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-115-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-114-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-113-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/688-192-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/688-104-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/688-185-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/688-204-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-186-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/688-110-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/688-109-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/688-117-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/688-189-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/688-107-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/688-116-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/864-161-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/864-178-0x0000000000400000-0x0000000000516000-memory.dmp

Download

memory/960-302-0x0000000000CA0000-0x0000000000D64000-memory.dmp

Download

memory/960-294-0x0000000000CA0000-0x0000000000D64000-memory.dmp

Download

memory/1100-143-0x0000000000F50000-0x0000000000F7A000-memory.dmp

Download

memory/1100-224-0x00007FFEDBDB0000-0x00007FFEDC871000-memory.dmp

Download

memory/1100-149-0x00000000018C0000-0x00000000018DE000-memory.dmp

Download

memory/1100-150-0x00007FFEDBDB0000-0x00007FFEDC871000-memory.dmp

Download

memory/1872-180-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1872-134-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2248-298-0x0000000001010000-0x00000000010D4000-memory.dmp

Download

memory/2248-313-0x0000000001010000-0x00000000010D4000-memory.dmp

Download

memory/2248-292-0x0000000001010000-0x00000000010D4000-memory.dmp

Download

memory/2292-159-0x000000001B6C0000-0x000000001B6D0000-memory.dmp

Download

memory/2292-236-0x00007FFEDBDB0000-0x00007FFEDC871000-memory.dmp

Download

memory/2292-241-0x000000001B6C0000-0x000000001B6D0000-memory.dmp

Download

memory/2292-132-0x00000000008C0000-0x00000000008C8000-memory.dmp

Download

memory/2292-141-0x00007FFEDBDB0000-0x00007FFEDC871000-memory.dmp

Download

memory/2304-211-0x0000000001DE0000-0x0000000001EE0000-memory.dmp

Download

memory/2304-190-0x0000000003A30000-0x0000000003ACD000-memory.dmp

Download

memory/2304-206-0x0000000000400000-0x0000000001DDD000-memory.dmp

Download

memory/2304-235-0x0000000000400000-0x0000000001DDD000-memory.dmp

Download

memory/2992-295-0x0000000001690000-0x0000000001754000-memory.dmp

Download

memory/2992-315-0x0000000001690000-0x0000000001754000-memory.dmp

Download

memory/2992-299-0x0000000001690000-0x0000000001754000-memory.dmp

Download

memory/3488-225-0x00000000030A0000-0x00000000030B5000-memory.dmp

Download

memory/3980-183-0x0000000002000000-0x0000000002100000-memory.dmp

Download

memory/3980-187-0x0000000000400000-0x0000000001D81000-memory.dmp

Download

memory/3980-228-0x0000000000400000-0x0000000001D81000-memory.dmp

Download

memory/3980-184-0x0000000001EE0000-0x0000000001EE9000-memory.dmp

Download

memory/4052-181-0x0000000006440000-0x000000000645E000-memory.dmp

Download

memory/4052-218-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

Download

memory/4052-219-0x0000000007A90000-0x0000000007A98000-memory.dmp

Download

memory/4052-217-0x00000000079B0000-0x00000000079C4000-memory.dmp

Download

memory/4052-188-0x00000000073B0000-0x00000000073E2000-memory.dmp

Download

memory/4052-216-0x00000000079A0000-0x00000000079AE000-memory.dmp

Download

memory/4052-207-0x0000000007DB0000-0x000000000842A000-memory.dmp

Download

memory/4052-208-0x0000000007770000-0x000000000778A000-memory.dmp

Download

memory/4052-210-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/4052-215-0x0000000007970000-0x0000000007981000-memory.dmp

Download

memory/4052-214-0x00000000079E0000-0x0000000007A76000-memory.dmp

Download

memory/4052-212-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/4052-213-0x00000000077F0000-0x00000000077FA000-memory.dmp

Download

memory/4052-209-0x000000007FC10000-0x000000007FC20000-memory.dmp

Download

memory/4052-203-0x00000000073F0000-0x000000000740E000-memory.dmp

Download

memory/4052-222-0x0000000073140000-0x00000000738F0000-memory.dmp

Download

memory/4052-168-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/4052-139-0x0000000004F00000-0x0000000004F36000-memory.dmp

Download

memory/4052-145-0x0000000005570000-0x0000000005B98000-memory.dmp

Download

memory/4052-162-0x0000000005BD0000-0x0000000005BF2000-memory.dmp

Download

memory/4052-174-0x0000000006070000-0x00000000063C4000-memory.dmp

Download

memory/4052-160-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/4052-147-0x0000000073140000-0x00000000738F0000-memory.dmp

Download

memory/4052-148-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/4052-169-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/4052-191-0x0000000073AC0000-0x0000000073B0C000-memory.dmp

Download

memory/4052-182-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/4052-205-0x0000000007420000-0x00000000074C3000-memory.dmp

Download

memory/4152-300-0x0000000003C70000-0x0000000003D34000-memory.dmp

Download

memory/4152-305-0x0000000003C70000-0x0000000003D34000-memory.dmp

Download

memory/4208-49-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4208-42-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4208-53-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/4208-41-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4208-48-0x0000000000400000-0x00000000007EA000-memory.dmp

Download

memory/4208-40-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4208-43-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/4208-50-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4208-51-0x0000000061B80000-0x0000000061B98000-memory.dmp

Download

memory/4208-39-0x0000000061880000-0x00000000618B7000-memory.dmp

Download

memory/4304-303-0x00000000034A0000-0x0000000003564000-memory.dmp

Download

memory/4616-297-0x0000000000CD0000-0x0000000000D94000-memory.dmp

Download

memory/4616-293-0x0000000000CD0000-0x0000000000D94000-memory.dmp

Download

memory/5372-265-0x00000000026F0000-0x00000000026F1000-memory.dmp

Download

memory/5372-252-0x0000000000510000-0x0000000000576000-memory.dmp

Download

memory/5372-257-0x0000000000510000-0x0000000000576000-memory.dmp

Download

memory/5372-248-0x0000000000010000-0x000000000006D000-memory.dmp

Download

memory/5372-267-0x0000000000510000-0x0000000000576000-memory.dmp

Download

memory/5372-256-0x0000000002700000-0x000000000270C000-memory.dmp

Download

memory/5372-255-0x00000000026D0000-0x00000000026D1000-memory.dmp

Download

memory/5372-254-0x00000000772E4000-0x00000000772E5000-memory.dmp

Download

memory/5372-250-0x0000000000510000-0x0000000000576000-memory.dmp

Download

memory/5372-251-0x0000000002500000-0x000000000250D000-memory.dmp

Download

memory/5448-264-0x0000000000600000-0x00000000006C4000-memory.dmp

Download

memory/5448-258-0x0000000000B80000-0x0000000000FB4000-memory.dmp

Download

memory/5448-260-0x0000000000B80000-0x0000000000FB4000-memory.dmp

Download

memory/5448-262-0x0000000000600000-0x00000000006C4000-memory.dmp

Download

memory/5448-261-0x0000000000600000-0x00000000006C4000-memory.dmp

Download

memory/5512-273-0x00007FF725E00000-0x00007FF7264C5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads