mystic | d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200

General

Target

d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
Size

639KB
MD5

92346d27eabac81e606d7153397e64e2
SHA1

fd2b60f3663a6ffe24db4d8bd4d244bfd7e0ecaa
SHA256

d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200
SHA512

446b3f391e6f55bd1fb69969e74c42ba298bd06ab9509130e639da3e03f2720fa753921a1aec5c8e7732928d125a97a9ae2e0a2dbe7b705c1e183ab8a41c3063
SSDEEP

12288:EMrWy90u8xoCoUCnq8yr2b2VmLKGQDzLfTf/1TW:ay9817x2wG+zHBW

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32

Signatures

Detect Mystic stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2720-50-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2720-51-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2720-49-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2720-53-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2720-67-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2720-55-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 4 IoCs

Processes:

ao8cz88.exe1Og26XL6.exe2cS3266.exe3dQ39Aq.exe

pid process

2072 ao8cz88.exe
1372 1Og26XL6.exe
2760 2cS3266.exe
2596 3dQ39Aq.exe

pid	process
2072	ao8cz88.exe
1372	1Og26XL6.exe
2760	2cS3266.exe
2596	3dQ39Aq.exe

Loads dropped DLL 11 IoCs

Processes:

d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exeao8cz88.exe1Og26XL6.exe2cS3266.exe3dQ39Aq.exe

pid	process
2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
2072	ao8cz88.exe
2072	ao8cz88.exe
2072	ao8cz88.exe
1372	1Og26XL6.exe
2072	ao8cz88.exe
2072	ao8cz88.exe
2760	2cS3266.exe
2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
2596	3dQ39Aq.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exeao8cz88.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ao8cz88.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1Og26XL6.exe2cS3266.exe

description	pid	process	target process
PID 1372 set thread context of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 2760 set thread context of 2720	2760	2cS3266.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2720 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2572	2720	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3dQ39Aq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dQ39Aq.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dQ39Aq.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dQ39Aq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3dQ39Aq.exeAppLaunch.exe

pid	process
2596	3dQ39Aq.exe
2596	3dQ39Aq.exe
2668	AppLaunch.exe
2668	AppLaunch.exe
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240
1240

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3dQ39Aq.exe

pid process

2596 3dQ39Aq.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2668 AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2668	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exeao8cz88.exe1Og26XL6.exe2cS3266.exeAppLaunch.exe

description	pid	process	target process
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2220 wrote to memory of 2072	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	ao8cz88.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 2072 wrote to memory of 1372	2072	ao8cz88.exe	1Og26XL6.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 1372 wrote to memory of 2668	1372	1Og26XL6.exe	AppLaunch.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2072 wrote to memory of 2760	2072	ao8cz88.exe	2cS3266.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2992	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2760 wrote to memory of 2720	2760	2cS3266.exe	AppLaunch.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2220 wrote to memory of 2596	2220	d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe	3dQ39Aq.exe
PID 2720 wrote to memory of 2572	2720	AppLaunch.exe	WerFault.exe
PID 2720 wrote to memory of 2572	2720	AppLaunch.exe	WerFault.exe
PID 2720 wrote to memory of 2572	2720	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe
"C:\Users\Admin\AppData\Local\Temp\d6069cb7acd4675b324603f2adc3e83fa7fa1829e73052a8d62a10f3d99a8200.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ao8cz88.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ao8cz88.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Og26XL6.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Og26XL6.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2cS3266.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2cS3266.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 268
5⤵
- Program crash
PID:2572

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dQ39Aq.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dQ39Aq.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dQ39Aq.exe
Filesize
31KB

MD5
6c37f769c720938dd2223863c71e961e

SHA1
32f2c9e51dd144da0023f4ef81fdc15e11fc02da

SHA256
0d68b15aed1853a449c5baf28d7cb6249a18a47e3559010814b82b5fccc21caa

SHA512
0cb767ca9faf107944e0dcd469750910df9b5df7d9ddae0d33dbe28f86bab57f37eadf1f2405296b19e03e884e6316528009bbc29ef2b0b78cbf722afaa286ee

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ao8cz88.exe
Filesize
515KB

MD5
a02e25299ae857551a4525647fc0533d

SHA1
72b43753b24d89b5383bfe1332dfec7413ddc00c

SHA256
fb9efd950ddab810501c8d3c22736d03896ef860696c06631c988c618f5bcf4c

SHA512
07877106f8540b38eda894fe7d67b1b99579bceee0d8e17e1fb191eabd95bdb45133509e6441e832dfe788132763aa2add4aef341b8f4f62fec2ddd3f5113dd0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Og26XL6.exe
Filesize
869KB

MD5
5f0632d60d00f8f6ab677ee7f8727416

SHA1
ab4db63850568f0d3ea91e0c2665b59317fa22c9

SHA256
7247d13084eea57e8d80d6fdb483bb8ec4ad8a96c846e9c1193390829daeb08d

SHA512
254af7965a2d6662afa77650a79954bd754bc7727384bf7b4d60cae49c49c3bbc6173f4b461a3f1af5cafb5b83531a6ffe9660cd92ee3824f896f8861c76dbc9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP001.TMP\2cS3266.exe
Filesize
1.0MB

MD5
a5a72ed79ae5e9780a11e88e6c6853c2

SHA1
9c59ba2bdb9066bedc108596ed94633c824edec8

SHA256
4d29c049f541cf4cfc30160228c05c981a115b3890004fb839ff261b99b62051

SHA512
84b85e7ce7701c18bffba0a76a289ab8f43dffaa77604d2c4e3682feb3dd8e937a70b00aba3213c5303d3ffa7bfc7e97008d39505087ace7c3cce9baac9b9d88

Download Submit
memory/1240-71-0x0000000002580000-0x0000000002596000-memory.dmp

Filesize
88KB

Download
memory/2220-70-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2220-58-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2596-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2596-69-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2596-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2668-31-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-34-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-23-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-25-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-29-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-32-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-36-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2720-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-51-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-46-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads