formbook | e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6

General

Target

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
Size

814KB
MD5

8fc83cdc44075773ee401f010d2443b0
SHA1

96cd91bb463dcb0f7b56e94bf2cb15d7dc8f63b6
SHA256

220977b28fc847b8a2d7c65d3d19a3859e3e62dc5e19edaf4909965516a91694
SHA512

12a5cf0ee3c995faf09f821e4f4db1bf4f50c5ead57e72bf6e518b38c4d14a020724698e0930ea515ddeb810464ab9c9a616e3c8cd0a7e82ce64ab58a614f597
SSDEEP

12288:mj6mRlmDKClMfkrPEBuGKw3f+s2geR3VJ6wGllh5VelrQTydKp:m2a4KCycrPQIo+aePgDalrQTl

Score

10^/10

formbook kmge rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

kmge

Decoy

jia0752d.com

cq0jt.sbs

whimsicalweddingrentals.com

meetsex-here.life

hhe-crv220.com

bedbillionaire.com

soycmo.com

mrawkward.xyz

11ramshornroad.com

motoyonaturals.com

thischicloves.com

gacorbet.pro

ihsanid.com

pancaketurner.com

santanarstore.com

cr3dtv.com

negotools.com

landfillequip.com

sejasuapropriachefe.com

diamant-verkopen.store

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1900-32-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1900-36-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4420-41-0x0000000000690000-0x00000000006BF000-memory.dmp	formbook
behavioral2/memory/4420-43-0x0000000000690000-0x00000000006BF000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe

Drops startup file 3 IoCs

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype.lnk	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

skype.exe

pid process

4816 skype.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4816	skype.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

skype.exeAddInProcess32.execontrol.exe

description	pid	process	target process
PID 4816 set thread context of 1900	4816	skype.exe	AddInProcess32.exe
PID 1900 set thread context of 3456	1900	AddInProcess32.exe	Explorer.EXE
PID 4420 set thread context of 3456	4420	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

control.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	control.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

3724 PING.EXE
3884 PING.EXE

pid	process
3724	PING.EXE
3884	PING.EXE

Suspicious behavior: EnumeratesProcesses 63 IoCs

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.exeskype.exeAddInProcess32.execontrol.exe

pid	process
4492	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
2696	skype.exe
4816	skype.exe
4816	skype.exe
4816	skype.exe
4816	skype.exe
1900	AddInProcess32.exe
1900	AddInProcess32.exe
1900	AddInProcess32.exe
1900	AddInProcess32.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

AddInProcess32.execontrol.exe

pid process

1900 AddInProcess32.exe
1900 AddInProcess32.exe
1900 AddInProcess32.exe
4420 control.exe
4420 control.exe
4420 control.exe
4420 control.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe

pid process

4492 e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe

pid	process
1900	AddInProcess32.exe
1900	AddInProcess32.exe
1900	AddInProcess32.exe
4420	control.exe
4420	control.exe
4420	control.exe
4420	control.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.exeskype.exeAddInProcess32.execontrol.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4492	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
Token: SeDebugPrivilege	2696	skype.exe
Token: SeDebugPrivilege	4816	skype.exe
Token: SeDebugPrivilege	1900	AddInProcess32.exe
Token: SeDebugPrivilege	4420	control.exe
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE
Token: SeShutdownPrivilege	3456	Explorer.EXE
Token: SeCreatePagefilePrivilege	3456	Explorer.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exeskype.execmd.exeskype.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 4492 wrote to memory of 2696	4492	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe	skype.exe
PID 4492 wrote to memory of 2696	4492	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe	skype.exe
PID 4492 wrote to memory of 2696	4492	e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe	skype.exe
PID 2696 wrote to memory of 3424	2696	skype.exe	cmd.exe
PID 2696 wrote to memory of 3424	2696	skype.exe	cmd.exe
PID 2696 wrote to memory of 3424	2696	skype.exe	cmd.exe
PID 3424 wrote to memory of 3884	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 3884	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 3884	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 3724	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 3724	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 3724	3424	cmd.exe	PING.EXE
PID 3424 wrote to memory of 4816	3424	cmd.exe	skype.exe
PID 3424 wrote to memory of 4816	3424	cmd.exe	skype.exe
PID 3424 wrote to memory of 4816	3424	cmd.exe	skype.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 4300	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 4816 wrote to memory of 1900	4816	skype.exe	AddInProcess32.exe
PID 3456 wrote to memory of 4420	3456	Explorer.EXE	control.exe
PID 3456 wrote to memory of 4420	3456	Explorer.EXE	control.exe
PID 3456 wrote to memory of 4420	3456	Explorer.EXE	control.exe
PID 4420 wrote to memory of 4896	4420	control.exe	cmd.exe
PID 4420 wrote to memory of 4896	4420	control.exe	cmd.exe
PID 4420 wrote to memory of 4896	4420	control.exe	cmd.exe
PID 4420 wrote to memory of 1960	4420	control.exe	Firefox.exe
PID 4420 wrote to memory of 1960	4420	control.exe	Firefox.exe
PID 4420 wrote to memory of 1960	4420	control.exe	Firefox.exe

C:\Users\Admin\AppData\Local\Temp\e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe
"C:\Users\Admin\AppData\Local\Temp\e64a5a0e34ecb51c2c40cb84016354e096b7c5bc34f5a841d685e94844644ad6.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492

C:\Users\Admin\AppData\Local\Temp\skype.exe
"C:\Users\Admin\AppData\Local\Temp\skype.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\skype.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"
3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 11
4⤵
- Runs ping.exe
PID:3884

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 11
4⤵
- Runs ping.exe
PID:3724

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
5⤵
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:4896

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\skype.exe.log
Filesize
1KB

MD5
b18bd43958115cd3b7b22e45103c10c5

SHA1
ff9fd020e81b03fd84c878ea24f27e8b41389435

SHA256
67cb85ee85191bd3203adf49b1d0199867ac66f0b114a09a8392d5d5b1dd36d4

SHA512
5101dd146815472c878a05cd345eae6a7f730c2059a368c56673e9c3ec47696e788162f15390b54b4e1d066fd56cae56fc6e8bf7ea6e5af250aaf1e8c8e68c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logim.jpeg
Filesize
75KB

MD5
20e5c142fc1b1cbd25f252d9010ca228

SHA1
2d01a8311b1813e1ed9b07aa60d9d997bcf2bed9

SHA256
b5eac7bc81b4fdae6f8bccdc895115a1638813c5f35886c5ec96a6114897c110

SHA512
0baf4cd02d37b9a4693f8543f7d4be8424a8d169216a0898fea7fcc73d94a2eabf5b52ad7b18bdd790583a3769fc6f1f531500cb84510a32376b1326843559cb

Download Submit
C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrf.ini
Filesize
40B

MD5
2f245469795b865bdd1b956c23d7893d

SHA1
6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

SHA256
1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

SHA512
909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

Download Submit
C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrg.ini
Filesize
38B

MD5
4aadf49fed30e4c9b3fe4a3dd6445ebe

SHA1
1e332822167c6f351b99615eada2c30a538ff037

SHA256
75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

SHA512
eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

Download Submit
C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logri.ini
Filesize
40B

MD5
d63a82e5d81e02e399090af26db0b9cb

SHA1
91d0014c8f54743bba141fd60c9d963f869d76c9

SHA256
eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

SHA512
38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

Download Submit
C:\Users\Admin\AppData\Roaming\LK3BNUQ2\LK3logrv.ini
Filesize
872B

MD5
bbc41c78bae6c71e63cb544a6a284d94

SHA1
33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

SHA256
ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

SHA512
0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\skype\skype.exe
Filesize
814KB

MD5
8fc83cdc44075773ee401f010d2443b0

SHA1
96cd91bb463dcb0f7b56e94bf2cb15d7dc8f63b6

SHA256
220977b28fc847b8a2d7c65d3d19a3859e3e62dc5e19edaf4909965516a91694

SHA512
12a5cf0ee3c995faf09f821e4f4db1bf4f50c5ead57e72bf6e518b38c4d14a020724698e0930ea515ddeb810464ab9c9a616e3c8cd0a7e82ce64ab58a614f597

Download Submit
memory/1900-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-37-0x0000000001BE0000-0x0000000001BF4000-memory.dmp

Filesize
80KB

Download
memory/1900-34-0x0000000001750000-0x0000000001A9A000-memory.dmp

Filesize
3.3MB

Download
memory/1900-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-14-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/2696-11-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/2696-16-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/2696-13-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/3456-60-0x0000000008220000-0x0000000008331000-memory.dmp

Filesize
1.1MB

Download
memory/3456-65-0x0000000008340000-0x00000000084A1000-memory.dmp

Filesize
1.4MB

Download
memory/3456-38-0x0000000008220000-0x0000000008331000-memory.dmp

Filesize
1.1MB

Download
memory/3456-66-0x0000000008340000-0x00000000084A1000-memory.dmp

Filesize
1.4MB

Download
memory/3456-74-0x0000000008340000-0x00000000084A1000-memory.dmp

Filesize
1.4MB

Download
memory/4420-64-0x00000000023D0000-0x0000000002463000-memory.dmp

Filesize
588KB

Download
memory/4420-58-0x00000000023D0000-0x0000000002463000-memory.dmp

Filesize
588KB

Download
memory/4420-43-0x0000000000690000-0x00000000006BF000-memory.dmp

Filesize
188KB

Download
memory/4420-42-0x0000000002590000-0x00000000028DA000-memory.dmp

Filesize
3.3MB

Download
memory/4420-41-0x0000000000690000-0x00000000006BF000-memory.dmp

Filesize
188KB

Download
memory/4420-40-0x0000000000950000-0x0000000000977000-memory.dmp

Filesize
156KB

Download
memory/4420-39-0x0000000000950000-0x0000000000977000-memory.dmp

Filesize
156KB

Download
memory/4492-9-0x0000000007B90000-0x00000000080BC000-memory.dmp

Filesize
5.2MB

Download
memory/4492-5-0x0000000005790000-0x00000000057A0000-memory.dmp

Filesize
64KB

Download
memory/4492-7-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/4492-0-0x0000000000E50000-0x0000000000F22000-memory.dmp

Filesize
840KB

Download
memory/4492-1-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/4492-2-0x0000000005400000-0x000000000549C000-memory.dmp

Filesize
624KB

Download
memory/4492-3-0x0000000005A50000-0x0000000005FF4000-memory.dmp

Filesize
5.6MB

Download
memory/4492-4-0x0000000005540000-0x00000000055D2000-memory.dmp

Filesize
584KB

Download
memory/4492-6-0x00000000058A0000-0x00000000058E4000-memory.dmp

Filesize
272KB

Download
memory/4492-12-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/4816-27-0x00000000068E0000-0x00000000068FA000-memory.dmp

Filesize
104KB

Download
memory/4816-25-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4816-24-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4816-23-0x0000000000DD0000-0x0000000000EA2000-memory.dmp

Filesize
840KB

Download
memory/4816-26-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4816-28-0x0000000006880000-0x0000000006886000-memory.dmp

Filesize
24KB

Download
memory/4816-29-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/4816-30-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4816-31-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4816-33-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads