remcos | 16c979a370d8462983333c42c3db84a2d5205f20a6d7ee73adeb873a8858d5fe

Analysis

max time kernel
151s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbbdc832fe995e436b6d78b4343ce310.exe
Size

310KB
MD5

bbbdc832fe995e436b6d78b4343ce310
SHA1

55b556d9b81ce7801f48cb2d687b58bf60769e4f
SHA256

16c979a370d8462983333c42c3db84a2d5205f20a6d7ee73adeb873a8858d5fe
SHA512

1574941596632f99c0f062d2b721fde2fdd84c0bf4f315c9c4d7d6790a2aee6a89bd91cc6cdc6fe10384e754516f5fd842346da24e5ff1129fd23b9a66e60fb2
SSDEEP

6144:AvzzpCq0r7QjaxIlq/tsFNdXfgmMD8ARthapNPABPw+P7IDJ0Gla:Wzzpi/bxpUZoOABS10G

Score

10^/10

remcos zgrat host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

avira-antivirus.ydns.eu:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
iservice.exe
copy_folder
windows
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ycggdfmjebakyzc
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
iservice
take_screenshot_option
false
take_screenshot_time
5

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2216-5-0x0000000004F60000-0x0000000004FDC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-7-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-8-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-10-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-12-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-14-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-16-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-18-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-20-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-22-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-24-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-26-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-28-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-30-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-32-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-34-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-36-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-38-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-40-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-42-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-44-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-46-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-48-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-50-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-54-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-52-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-56-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-58-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-60-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-62-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-64-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-66-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-68-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2216-70-0x0000000004F60000-0x0000000004FD5000-memory.dmp	family_zgrat_v1

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 8 IoCs

Processes:

iservice.exeiservice.exeiservice.exeiservice.exeiservice.exeiservice.exeiservice.exeiservice.exe

pid process

2484 iservice.exe
2196 iservice.exe
1668 iservice.exe
2708 iservice.exe
2072 iservice.exe
2740 iservice.exe
2804 iservice.exe
1100 iservice.exe
Loads dropped DLL 5 IoCs

Processes:

cmd.exeiservice.exeiservice.exeiservice.exe

pid process

860 cmd.exe
2484 iservice.exe
1668 iservice.exe
2072 iservice.exe
2072 iservice.exe

pid	process
2484	iservice.exe
2196	iservice.exe
1668	iservice.exe
2708	iservice.exe
2072	iservice.exe
2740	iservice.exe
2804	iservice.exe
1100	iservice.exe

pid	process
860	cmd.exe
2484	iservice.exe
1668	iservice.exe
2072	iservice.exe
2072	iservice.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

iservice.exeiservice.exeiservice.exebbbdc832fe995e436b6d78b4343ce310.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\iservice = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\iservice.exe\""	iservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\iservice = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\iservice.exe\""	iservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\iservice = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\iservice.exe\""	iservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\iservice = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows\\iservice.exe\""	bbbdc832fe995e436b6d78b4343ce310.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

bbbdc832fe995e436b6d78b4343ce310.exeiservice.exeiservice.exeiservice.exe

description	pid	process	target process
PID 2216 set thread context of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2484 set thread context of 2196	2484	iservice.exe	iservice.exe
PID 1668 set thread context of 2708	1668	iservice.exe	iservice.exe
PID 2072 set thread context of 2804	2072	iservice.exe	iservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

936 PING.EXE
2872 PING.EXE
860 PING.EXE
952 PING.EXE

pid	process
936	PING.EXE
2872	PING.EXE
860	PING.EXE
952	PING.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

bbbdc832fe995e436b6d78b4343ce310.exeiservice.exeiservice.exeiservice.exe

pid	process
2216	bbbdc832fe995e436b6d78b4343ce310.exe
2216	bbbdc832fe995e436b6d78b4343ce310.exe
2484	iservice.exe
1668	iservice.exe
2072	iservice.exe
2072	iservice.exe
2072	iservice.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

bbbdc832fe995e436b6d78b4343ce310.exeiservice.exeiservice.exeiservice.exeiservice.exe

description	pid	process
Token: SeDebugPrivilege	2216	bbbdc832fe995e436b6d78b4343ce310.exe
Token: SeDebugPrivilege	2484	iservice.exe
Token: SeDebugPrivilege	1668	iservice.exe
Token: SeDebugPrivilege	2072	iservice.exe
Token: SeDebugPrivilege	1100	iservice.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bbbdc832fe995e436b6d78b4343ce310.exebbbdc832fe995e436b6d78b4343ce310.execmd.exeiservice.exeiservice.execmd.exeiservice.exeiservice.exe

description	pid	process	target process
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2216 wrote to memory of 2736	2216	bbbdc832fe995e436b6d78b4343ce310.exe	bbbdc832fe995e436b6d78b4343ce310.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 2736 wrote to memory of 860	2736	bbbdc832fe995e436b6d78b4343ce310.exe	cmd.exe
PID 860 wrote to memory of 936	860	cmd.exe	PING.EXE
PID 860 wrote to memory of 936	860	cmd.exe	PING.EXE
PID 860 wrote to memory of 936	860	cmd.exe	PING.EXE
PID 860 wrote to memory of 936	860	cmd.exe	PING.EXE
PID 860 wrote to memory of 2484	860	cmd.exe	iservice.exe
PID 860 wrote to memory of 2484	860	cmd.exe	iservice.exe
PID 860 wrote to memory of 2484	860	cmd.exe	iservice.exe
PID 860 wrote to memory of 2484	860	cmd.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2484 wrote to memory of 2196	2484	iservice.exe	iservice.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 2196 wrote to memory of 1472	2196	iservice.exe	cmd.exe
PID 1472 wrote to memory of 2872	1472	cmd.exe	PING.EXE
PID 1472 wrote to memory of 2872	1472	cmd.exe	PING.EXE
PID 1472 wrote to memory of 2872	1472	cmd.exe	PING.EXE
PID 1472 wrote to memory of 2872	1472	cmd.exe	PING.EXE
PID 1472 wrote to memory of 1668	1472	cmd.exe	iservice.exe
PID 1472 wrote to memory of 1668	1472	cmd.exe	iservice.exe
PID 1472 wrote to memory of 1668	1472	cmd.exe	iservice.exe
PID 1472 wrote to memory of 1668	1472	cmd.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 1668 wrote to memory of 2708	1668	iservice.exe	iservice.exe
PID 2708 wrote to memory of 2448	2708	iservice.exe	cmd.exe
PID 2708 wrote to memory of 2448	2708	iservice.exe	cmd.exe
PID 2708 wrote to memory of 2448	2708	iservice.exe	cmd.exe
PID 2708 wrote to memory of 2448	2708	iservice.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bbbdc832fe995e436b6d78b4343ce310.exe
"C:\Users\Admin\AppData\Local\Temp\bbbdc832fe995e436b6d78b4343ce310.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216

C:\Users\Admin\AppData\Local\Temp\bbbdc832fe995e436b6d78b4343ce310.exe
C:\Users\Admin\AppData\Local\Temp\bbbdc832fe995e436b6d78b4343ce310.exe
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:936

C:\Users\Admin\AppData\Roaming\windows\iservice.exe
"C:\Users\Admin\AppData\Roaming\windows\iservice.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\iservice.exe
C:\Users\Admin\AppData\Local\Temp\iservice.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
7⤵
- Runs ping.exe
PID:2872

C:\Users\Admin\AppData\Roaming\windows\iservice.exe
"C:\Users\Admin\AppData\Roaming\windows\iservice.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\iservice.exe
C:\Users\Admin\AppData\Local\Temp\iservice.exe
8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
9⤵
PID:2448

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
10⤵
- Runs ping.exe
PID:860

C:\Users\Admin\AppData\Roaming\windows\iservice.exe
"C:\Users\Admin\AppData\Roaming\windows\iservice.exe"
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Users\Admin\AppData\Local\Temp\iservice.exe
C:\Users\Admin\AppData\Local\Temp\iservice.exe
11⤵
- Executes dropped EXE
PID:2740

C:\Users\Admin\AppData\Local\Temp\iservice.exe
C:\Users\Admin\AppData\Local\Temp\iservice.exe
11⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2804

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
12⤵
PID:1204

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
13⤵
- Runs ping.exe
PID:952

C:\Users\Admin\AppData\Roaming\windows\iservice.exe
"C:\Users\Admin\AppData\Roaming\windows\iservice.exe"
13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1100

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
102B

MD5
b0aa76226f9a1f3e68e774b1b92208c3

SHA1
fe93a3b569a8afd07e4de7c73acbfcd4f210027c

SHA256
b1984164b246a5579a9f334d4ea1a817cbfd2fb69e718a7ab78c008bf9e3df14

SHA512
e2282bafb69c5715c0fcabe7c84476d23146d79f43bd82860d518f44c229c9df009f7093f4df972280df834576674268fa8dd0a28be445ad6629600e03590344

Download Submit
\Users\Admin\AppData\Roaming\windows\iservice.exe
Filesize
310KB

MD5
bbbdc832fe995e436b6d78b4343ce310

SHA1
55b556d9b81ce7801f48cb2d687b58bf60769e4f

SHA256
16c979a370d8462983333c42c3db84a2d5205f20a6d7ee73adeb873a8858d5fe

SHA512
1574941596632f99c0f062d2b721fde2fdd84c0bf4f315c9c4d7d6790a2aee6a89bd91cc6cdc6fe10384e754516f5fd842346da24e5ff1129fd23b9a66e60fb2

Download Submit
memory/1100-9861-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/1100-9860-0x00000000002E0000-0x0000000000334000-memory.dmp

Filesize
336KB

Download
memory/1100-9862-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/1100-9863-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-5311-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-4935-0x00000000000C0000-0x0000000000114000-memory.dmp

Filesize
336KB

Download
memory/1668-4936-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-4937-0x0000000000560000-0x00000000005A0000-memory.dmp

Filesize
256KB

Download
memory/1668-4938-0x0000000000810000-0x0000000000862000-memory.dmp

Filesize
328KB

Download
memory/1668-4939-0x00000000020F0000-0x0000000002142000-memory.dmp

Filesize
328KB

Download
memory/1668-7386-0x0000000074D70000-0x000000007545E000-memory.dmp

Filesize
6.9MB

Download
memory/1668-6760-0x0000000000560000-0x00000000005A0000-memory.dmp

Filesize
256KB

Download
memory/2072-9850-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-7396-0x0000000000E20000-0x0000000000E74000-memory.dmp

Filesize
336KB

Download
memory/2072-7397-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-7398-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2072-7399-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-7400-0x0000000000C10000-0x0000000000C62000-memory.dmp

Filesize
328KB

Download
memory/2072-8604-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2196-4932-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2196-4923-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2216-28-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-20-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-42-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-44-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-46-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-48-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-50-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-54-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-52-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-56-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-58-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-60-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-62-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-64-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-66-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-68-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-70-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-736-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/2216-2453-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2216-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2216-38-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-2-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/2216-36-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-3-0x0000000000650000-0x00000000006A2000-memory.dmp

Filesize
328KB

Download
memory/2216-4-0x0000000000800000-0x0000000000852000-memory.dmp

Filesize
328KB

Download
memory/2216-5-0x0000000004F60000-0x0000000004FDC000-memory.dmp

Filesize
496KB

Download
memory/2216-6-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2216-7-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-8-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-10-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-34-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-32-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-30-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-0-0x0000000000860000-0x00000000008B4000-memory.dmp

Filesize
336KB

Download
memory/2216-26-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-24-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-22-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-40-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-18-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-16-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-14-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2216-12-0x0000000004F60000-0x0000000004FD5000-memory.dmp

Filesize
468KB

Download
memory/2484-4920-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-3391-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/2484-2716-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-2473-0x0000000000DF0000-0x0000000000E42000-memory.dmp

Filesize
328KB

Download
memory/2484-2472-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/2484-2470-0x0000000000E40000-0x0000000000E94000-memory.dmp

Filesize
336KB

Download
memory/2484-2471-0x0000000074DA0000-0x000000007548E000-memory.dmp

Filesize
6.9MB

Download
memory/2736-2465-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2736-2454-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads