modiloader | e91ac2d0ba2fd89b2a9db98834e9f9d378736376d18babfd24b5f19939c1ef06

Analysis

max time kernel
69s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe93f39a783d8d0a24d4679adc34675.exe
Size

196KB
MD5

6fe93f39a783d8d0a24d4679adc34675
SHA1

ce9425cdba52b35cf94eb9a34f20e5a36f754629
SHA256

e91ac2d0ba2fd89b2a9db98834e9f9d378736376d18babfd24b5f19939c1ef06
SHA512

865c3e799ddee0aac1970e7097e356cef9172b4e06b43f2fed1ab89b35e7c5ef1b027c81cc3b6e056fc933a7c6ce1711ae63787a0f2272d2a4a95bcf1ae8d701
SSDEEP

3072:BehvZ5uwVI0ecqWOgQmbNX/ZVC/5OoPM1mrkKFRrvPMQpetWgGrjgbaqqh7WeG7I:4hvDpGrgQShhyFMwrBFJUCe8/jMavq7I

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

ModiLoader Second Stage 22 IoCs

resource	yara_rule
behavioral1/memory/2052-34-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2052-35-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/844-44-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/844-45-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1952-54-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1952-53-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2388-57-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-63-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1584-64-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/3020-72-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/3020-73-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/964-84-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/964-82-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-96-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2388-94-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2388-89-0x0000000002240000-0x0000000002250000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-105-0x0000000076860000-0x0000000076950000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-125-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-133-0x0000000076860000-0x0000000076950000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-146-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-184-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1660-210-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 43 IoCs

pid	Process
2500	temp.exe
2388	temp2.exe
2648	temp.exe
2052	temp2.exe
1920	temp.exe
844	temp2.exe
960	temp.exe
1952	temp2.exe
892	temp.exe
1584	temp2.exe
3020	temp2.exe
2308	temp.exe
964	temp2.exe
1164	temp.exe
1660	svchost.exe
2096	temp.exe
2496	temp.exe
2756	temp.exe
2680	temp.exe
2864	temp.exe
2568	temp.exe
2604	temp.exe
1200	temp.exe
1648	temp.exe
2640	temp.exe
2924	temp.exe
2752	temp.exe
1964	temp.exe
1956	temp.exe
208	temp.exe
1104	temp.exe
2808	temp.exe
1632	temp.exe
2084	temp.exe
600	temp.exe
532	temp.exe
2456	temp.exe
1888	temp.exe
988	temp.exe
968	temp.exe
2036	temp.exe
780	temp.exe
1388	temp.exe

Loads dropped DLL 51 IoCs

pid	Process
3032	6fe93f39a783d8d0a24d4679adc34675.exe
3032	6fe93f39a783d8d0a24d4679adc34675.exe
3032	6fe93f39a783d8d0a24d4679adc34675.exe
3032	6fe93f39a783d8d0a24d4679adc34675.exe
2500	temp.exe
2500	temp.exe
2500	temp.exe
2648	temp.exe
2648	temp.exe
2648	temp.exe
1920	temp.exe
1920	temp.exe
1920	temp.exe
960	temp.exe
960	temp.exe
960	temp.exe
892	temp.exe
892	temp.exe
892	temp.exe
2308	temp.exe
2308	temp.exe
2308	temp.exe
2388	temp2.exe
1164	temp.exe
2096	temp.exe
2496	temp.exe
2756	temp.exe
2680	temp.exe
2864	temp.exe
2568	temp.exe
2604	temp.exe
1200	temp.exe
1648	temp.exe
2640	temp.exe
2924	temp.exe
2752	temp.exe
1964	temp.exe
1956	temp.exe
208	temp.exe
1104	temp.exe
2808	temp.exe
1632	temp.exe
2084	temp.exe
600	temp.exe
532	temp.exe
2456	temp.exe
1888	temp.exe
988	temp.exe
968	temp.exe
2036	temp.exe
780	temp.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0026000000016032-21.dat	upx
behavioral1/memory/2388-23-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2052-34-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2052-35-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/844-44-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/844-45-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1952-54-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1952-53-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2388-57-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1584-63-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1584-64-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/3020-72-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/3020-73-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/964-84-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/964-82-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1660-96-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2388-94-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2388-89-0x0000000002240000-0x0000000002250000-memory.dmp	upx
behavioral1/memory/1660-105-0x0000000076860000-0x0000000076950000-memory.dmp	upx
behavioral1/memory/1660-125-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2756-133-0x0000000076860000-0x0000000076950000-memory.dmp	upx
behavioral1/memory/1660-146-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1660-184-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1660-210-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\svchost.exe"	svchost.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	temp2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ntdtcstp.dll	svchost.exe
File created	C:\Windows\cmsetac.dll	svchost.exe
File created	C:\Windows\svchost.exe	temp2.exe
File opened for modification	C:\Windows\svchost.exe	temp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	temp2.exe
Token: SeBackupPrivilege	2376	vssvc.exe
Token: SeRestorePrivilege	2376	vssvc.exe
Token: SeAuditPrivilege	2376	vssvc.exe
Token: SeDebugPrivilege	1660	svchost.exe
Token: SeDebugPrivilege	1660	svchost.exe
Token: SeDebugPrivilege	1164	temp.exe
Token: SeDebugPrivilege	2096	temp.exe
Token: SeDebugPrivilege	2496	temp.exe
Token: SeDebugPrivilege	2756	temp.exe
Token: SeDebugPrivilege	2680	temp.exe
Token: SeDebugPrivilege	2864	temp.exe
Token: SeDebugPrivilege	2568	temp.exe
Token: SeDebugPrivilege	2604	temp.exe
Token: SeDebugPrivilege	1200	temp.exe
Token: SeDebugPrivilege	1648	temp.exe
Token: SeDebugPrivilege	2640	temp.exe
Token: SeDebugPrivilege	2924	temp.exe
Token: SeDebugPrivilege	2752	temp.exe
Token: SeDebugPrivilege	1964	temp.exe
Token: SeDebugPrivilege	1956	temp.exe
Token: SeDebugPrivilege	208	temp.exe
Token: SeDebugPrivilege	1104	temp.exe
Token: SeDebugPrivilege	2808	temp.exe
Token: SeDebugPrivilege	1632	temp.exe
Token: SeDebugPrivilege	2084	temp.exe
Token: SeDebugPrivilege	600	temp.exe
Token: SeDebugPrivilege	532	temp.exe
Token: SeDebugPrivilege	2456	temp.exe
Token: SeDebugPrivilege	1888	temp.exe
Token: SeDebugPrivilege	988	temp.exe
Token: SeDebugPrivilege	968	temp.exe
Token: SeDebugPrivilege	2036	temp.exe
Token: SeDebugPrivilege	780	temp.exe
Token: SeDebugPrivilege	1388	temp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	svchost.exe
1660	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2500	3032	6fe93f39a783d8d0a24d4679adc34675.exe	28
PID 3032 wrote to memory of 2500	3032	6fe93f39a783d8d0a24d4679adc34675.exe	28
PID 3032 wrote to memory of 2500	3032	6fe93f39a783d8d0a24d4679adc34675.exe	28
PID 3032 wrote to memory of 2500	3032	6fe93f39a783d8d0a24d4679adc34675.exe	28
PID 3032 wrote to memory of 2388	3032	6fe93f39a783d8d0a24d4679adc34675.exe	29
PID 3032 wrote to memory of 2388	3032	6fe93f39a783d8d0a24d4679adc34675.exe	29
PID 3032 wrote to memory of 2388	3032	6fe93f39a783d8d0a24d4679adc34675.exe	29
PID 3032 wrote to memory of 2388	3032	6fe93f39a783d8d0a24d4679adc34675.exe	29
PID 2500 wrote to memory of 2648	2500	temp.exe	33
PID 2500 wrote to memory of 2648	2500	temp.exe	33
PID 2500 wrote to memory of 2648	2500	temp.exe	33
PID 2500 wrote to memory of 2648	2500	temp.exe	33
PID 2500 wrote to memory of 2052	2500	temp.exe	34
PID 2500 wrote to memory of 2052	2500	temp.exe	34
PID 2500 wrote to memory of 2052	2500	temp.exe	34
PID 2500 wrote to memory of 2052	2500	temp.exe	34
PID 2648 wrote to memory of 1920	2648	temp.exe	35
PID 2648 wrote to memory of 1920	2648	temp.exe	35
PID 2648 wrote to memory of 1920	2648	temp.exe	35
PID 2648 wrote to memory of 1920	2648	temp.exe	35
PID 2648 wrote to memory of 844	2648	temp.exe	36
PID 2648 wrote to memory of 844	2648	temp.exe	36
PID 2648 wrote to memory of 844	2648	temp.exe	36
PID 2648 wrote to memory of 844	2648	temp.exe	36
PID 1920 wrote to memory of 960	1920	temp.exe	37
PID 1920 wrote to memory of 960	1920	temp.exe	37
PID 1920 wrote to memory of 960	1920	temp.exe	37
PID 1920 wrote to memory of 960	1920	temp.exe	37
PID 1920 wrote to memory of 1952	1920	temp.exe	38
PID 1920 wrote to memory of 1952	1920	temp.exe	38
PID 1920 wrote to memory of 1952	1920	temp.exe	38
PID 1920 wrote to memory of 1952	1920	temp.exe	38
PID 960 wrote to memory of 892	960	temp.exe	39
PID 960 wrote to memory of 892	960	temp.exe	39
PID 960 wrote to memory of 892	960	temp.exe	39
PID 960 wrote to memory of 892	960	temp.exe	39
PID 960 wrote to memory of 1584	960	temp.exe	40
PID 960 wrote to memory of 1584	960	temp.exe	40
PID 960 wrote to memory of 1584	960	temp.exe	40
PID 960 wrote to memory of 1584	960	temp.exe	40
PID 892 wrote to memory of 2308	892	temp.exe	41
PID 892 wrote to memory of 2308	892	temp.exe	41
PID 892 wrote to memory of 2308	892	temp.exe	41
PID 892 wrote to memory of 2308	892	temp.exe	41
PID 892 wrote to memory of 3020	892	temp.exe	42
PID 892 wrote to memory of 3020	892	temp.exe	42
PID 892 wrote to memory of 3020	892	temp.exe	42
PID 892 wrote to memory of 3020	892	temp.exe	42
PID 2308 wrote to memory of 1164	2308	temp.exe	43
PID 2308 wrote to memory of 1164	2308	temp.exe	43
PID 2308 wrote to memory of 1164	2308	temp.exe	43
PID 2308 wrote to memory of 1164	2308	temp.exe	43
PID 2308 wrote to memory of 964	2308	temp.exe	44
PID 2308 wrote to memory of 964	2308	temp.exe	44
PID 2308 wrote to memory of 964	2308	temp.exe	44
PID 2308 wrote to memory of 964	2308	temp.exe	44
PID 2388 wrote to memory of 1660	2388	temp2.exe	45
PID 2388 wrote to memory of 1660	2388	temp2.exe	45
PID 2388 wrote to memory of 1660	2388	temp2.exe	45
PID 2388 wrote to memory of 1660	2388	temp2.exe	45
PID 1164 wrote to memory of 2096	1164	temp.exe	46
PID 1164 wrote to memory of 2096	1164	temp.exe	46
PID 1164 wrote to memory of 2096	1164	temp.exe	46
PID 1164 wrote to memory of 2096	1164	temp.exe	46

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6fe93f39a783d8d0a24d4679adc34675.exe
"C:\Users\Admin\AppData\Local\Temp\6fe93f39a783d8d0a24d4679adc34675.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\temp.exe
  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\temp.exe
    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\temp.exe
      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:600
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        35⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        37⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        38⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        39⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        40⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        41⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        42⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        43⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        44⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        45⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        46⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        47⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        48⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        49⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        50⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        51⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        52⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        53⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        54⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        55⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        56⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        57⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        58⤵
        
        PID:280
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        59⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        60⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        61⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        62⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        63⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        64⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        65⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        66⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        67⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        68⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        69⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        70⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        71⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        72⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        73⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        74⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        75⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        76⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        77⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        78⤵
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        79⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        80⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        81⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\temp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        82⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\temp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
        8⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\temp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
        7⤵
        Executes dropped EXE
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\temp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\temp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
        5⤵
        Executes dropped EXE
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\temp2.exe
      "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
      4⤵
      Executes dropped EXE
      PID:844
- - C:\Users\Admin\AppData\Local\Temp\temp2.exe
    "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
    3⤵
    - Executes dropped EXE
    PID:2052
- C:\Users\Admin\AppData\Local\Temp\temp2.exe
  "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\svchost.exe
    "C:\Windows\svchost.exe" \melt "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp2.exe

Filesize
48B

MD5
5fb42cd754eaeadf6fdcd0948b970498

SHA1
7715163b2a7f9934cceb7b1f4da3ac1bc074b963

SHA256
3bfe1b780db37217db7a1c1b3b4d3fdb74dce6e5a80572736f14ea0a44d2e58d

SHA512
9f44ead8f7e9e727586be4a6fc7453a7f612f997723e84af8fbb1b685f1c91f56cbaae1c7697b6064ae089a06c1f3d74b7df85d9de809f86512e611b5a94483a

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp2.exe

Filesize
111KB

MD5
b16f972641cf340d4c4806ceb8e88e53

SHA1
a0ad98e52b15cd0a081610de69de86c2135d3011

SHA256
abb5d4fdaf5cc7f060b5020b2c9fc9dca648b7b7ef59e287880934660f0a156f

SHA512
5d79776458093d85cbf95db382d389ba49aa2bfed6ccbec4501da807a6e10f736a46c10ad945b78b47e75ae888352fc007d2da31892191b9d2eec002d6c0690f

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
c9a695cfae0332a2b1e11520869dacad

SHA1
5ecc96f7c90db01b38e8b0be7a67c8abcd247d1f

SHA256
746cae0c4d0565d7969a146768489aac96f697af5007597ece5236f616424f44

SHA512
02e2fee81961f2bc9850489117fb5cb19584b4a8630704a2e5f4f3c1a45ca6f381902503b1ecf8cc691e0369737dd397fc73e92d420eea4773c88e7670b44308

Download Submit
\Users\Admin\AppData\Local\Temp\temp.exe

Filesize
42KB

MD5
2ef23f269292a736c8da033a1fe96131

SHA1
e3e1b43b6459b429c5ba8681b3401446732eaac1

SHA256
93830a42953f1c80ebd50489b329efc3f817454581fc26583f83dac8838748d7

SHA512
866c330687c1d4dbe4cee9b178b5eacd977141c627d70bfb8b7cdc9be95b6c8bb8c404a9ed69d38245379f62b835d356d0ed92c25b50adf5bcbaf7fece3e23a9

Download Submit
memory/844-45-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/844-44-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/892-69-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/892-66-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/960-60-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/964-82-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/964-84-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1164-115-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/1164-112-0x0000000002740000-0x0000000002750000-memory.dmp

Filesize
64KB

Download
memory/1164-108-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1164-116-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1164-117-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1164-142-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1200-167-0x00000000003B0000-0x00000000003BE000-memory.dmp

Filesize
56KB

Download
memory/1200-172-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/1200-191-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/1584-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1584-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1648-196-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/1648-173-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/1660-125-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-96-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-104-0x0000000074DE0000-0x0000000074DF4000-memory.dmp

Filesize
80KB

Download
memory/1660-103-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1660-105-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1660-146-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-100-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/1660-210-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-184-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-113-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1660-132-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1920-51-0x00000000024F0000-0x0000000002540000-memory.dmp

Filesize
320KB

Download
memory/1920-50-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/1920-101-0x00000000024F0000-0x0000000002540000-memory.dmp

Filesize
320KB

Download
memory/1952-54-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1952-53-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1956-202-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/1956-199-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/1956-200-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/1964-195-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2052-34-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2052-35-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2096-139-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2096-147-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/2096-120-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/2308-78-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2308-81-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/2388-94-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2388-89-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/2388-124-0x0000000002240000-0x0000000002250000-memory.dmp

Filesize
64KB

Download
memory/2388-57-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2388-23-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2496-152-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/2496-126-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/2496-130-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2496-155-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2496-149-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2500-31-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2500-75-0x0000000002740000-0x0000000002790000-memory.dmp

Filesize
320KB

Download
memory/2500-33-0x0000000002740000-0x0000000002790000-memory.dmp

Filesize
320KB

Download
memory/2568-165-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/2568-162-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2604-186-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2604-163-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2640-182-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/2640-181-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2640-177-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2648-27-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2648-40-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2648-83-0x00000000021B0000-0x0000000002200000-memory.dmp

Filesize
320KB

Download
memory/2648-43-0x00000000021B0000-0x0000000002200000-memory.dmp

Filesize
320KB

Download
memory/2648-37-0x00000000021A0000-0x00000000021B0000-memory.dmp

Filesize
64KB

Download
memory/2680-144-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/2680-158-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2680-166-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/2756-131-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/2756-138-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/2756-133-0x0000000076860000-0x0000000076950000-memory.dmp

Filesize
960KB

Download
memory/2756-136-0x00000000024C0000-0x00000000024D0000-memory.dmp

Filesize
64KB

Download
memory/2756-137-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2808-218-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2808-215-0x00000000003C0000-0x00000000003CE000-memory.dmp

Filesize
56KB

Download
memory/2864-150-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2864-168-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2864-170-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2924-185-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/2924-188-0x00000000023B0000-0x00000000023C0000-memory.dmp

Filesize
64KB

Download
memory/2924-201-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/3020-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3020-73-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3032-5-0x0000000001F90000-0x0000000001FA0000-memory.dmp

Filesize
64KB

Download
memory/3032-0-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/3032-20-0x0000000000400000-0x000000000040FE00-memory.dmp

Filesize
63KB

Download
memory/3032-62-0x00000000024D0000-0x0000000002520000-memory.dmp

Filesize
320KB

Download
memory/3032-13-0x0000000001F90000-0x0000000001FA0000-memory.dmp

Filesize
64KB

Download
memory/3032-22-0x00000000024D0000-0x0000000002520000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads