ramnit | 7c2d6857361e13e7324493776903df6a455695bf15e0452ab92001f1e200c419

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5dbb25fa983a695d1c13210e2ff0948.exe
Size 478KB
Sample240313-phhzqacg21
SHA256 7c2d6857361e13e7324493776903df6a455695bf15e0452ab92001f1e200c419
MD5 c5dbb25fa983a695d1c13210e2ff0948
SHA1 6c3803d46b259b684cb785ea71ea2196aabe9d61
SHA512 856c39a2b2c2296039d418c15e4eec368aebc9a8ea68bdfdaa4479f715e4b65903a1928c09fe71b3287b9c960693ffc5784a3c7d25cf48bd1260f151cebc20a5
SSDEEP 6144:xYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0B3pgSUGX1Y:xSNC80I+cR3R03VseuOiZgSNY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe chrome.exe"	c5dbb25fa983a695d1c13210e2ff0948.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	c5dbb25fa983a695d1c13210e2ff0948.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1364	c5dbb25fa983a695d1c13210e2ff0948mgr.exe
3732	WaterMark.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3028-0-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/1364-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1364-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3732-28-0x0000000000400000-0x0000000000459F7C-memory.dmp	upx
behavioral2/memory/3732-35-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3028-71-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/files/0x00080000000231ff-86.dat	upx
behavioral2/memory/3732-106-0x0000000000400000-0x0000000000459F7C-memory.dmp	upx
behavioral2/memory/3732-107-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3028-108-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3732-109-0x0000000000400000-0x0000000000459F7C-memory.dmp	upx
behavioral2/memory/3732-110-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3028-111-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-113-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-128-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-140-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-142-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-145-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-146-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral2/memory/3028-148-0x0000000000400000-0x00000000004FD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\chrome.exe"	c5dbb25fa983a695d1c13210e2ff0948.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\l:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\m:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\s:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\u:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\v:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\w:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\e:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\k:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\n:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\r:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\z:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\b:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\h:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\i:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\j:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\q:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\t:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\x:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\a:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\o:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\p:	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened (read-only)	\??\y:	c5dbb25fa983a695d1c13210e2ff0948.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3028-71-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-108-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-111-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-113-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-128-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-140-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-142-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-145-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-146-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe
behavioral2/memory/3028-148-0x0000000000400000-0x00000000004FD000-memory.dmp	autoit_exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\d:\autorun.inf	c5dbb25fa983a695d1c13210e2ff0948.exe
File created	\??\f:\autorun.inf	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened for modification	F:\\autorun.inf	c5dbb25fa983a695d1c13210e2ff0948.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\chrome.exe	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened for modification	C:\Windows\SysWOW64\chrome.exe	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened for modification	C:\Windows\SysWOW64\autorun.ini	c5dbb25fa983a695d1c13210e2ff0948.exe
File created	C:\Windows\SysWOW64\setting.ini	c5dbb25fa983a695d1c13210e2ff0948.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	c5dbb25fa983a695d1c13210e2ff0948.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	c5dbb25fa983a695d1c13210e2ff0948mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	c5dbb25fa983a695d1c13210e2ff0948mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px344E.tmp	c5dbb25fa983a695d1c13210e2ff0948mgr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\chrome.exe	c5dbb25fa983a695d1c13210e2ff0948.exe
File created	C:\Windows\chrome.exe	c5dbb25fa983a695d1c13210e2ff0948.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	4916	WerFault.exe	93

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	c5dbb25fa983a695d1c13210e2ff0948.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FB4494D3-E133-11EE-87B8-7AD2C9E555B0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3483670808"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3485857714"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3486639829"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3485388962"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://h1.ripway.com/poojasharma/index.html"	c5dbb25fa983a695d1c13210e2ff0948.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main	c5dbb25fa983a695d1c13210e2ff0948.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3486639829"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3483670808"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094080"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094080"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417097362"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094080"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094080"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FB3D6F5D-E133-11EE-87B8-7AD2C9E555B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://h1.ripway.com/poojasharma/index.html"	c5dbb25fa983a695d1c13210e2ff0948.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3485388962"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094080"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094080"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://h1.ripway.com/poojasharma/index.html"	c5dbb25fa983a695d1c13210e2ff0948.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://h1.ripway.com/poojasharma/index.html"	c5dbb25fa983a695d1c13210e2ff0948.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://h1.ripway.com/poojasharma/index.html"	c5dbb25fa983a695d1c13210e2ff0948.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3732	WaterMark.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe
3028	c5dbb25fa983a695d1c13210e2ff0948.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	WaterMark.exe
Token: 33	3028	c5dbb25fa983a695d1c13210e2ff0948.exe
Token: SeIncBasePriorityPrivilege	3028	c5dbb25fa983a695d1c13210e2ff0948.exe
Token: 33	3028	c5dbb25fa983a695d1c13210e2ff0948.exe
Token: SeIncBasePriorityPrivilege	3028	c5dbb25fa983a695d1c13210e2ff0948.exe
Token: 33	3028	c5dbb25fa983a695d1c13210e2ff0948.exe
Token: SeIncBasePriorityPrivilege	3028	c5dbb25fa983a695d1c13210e2ff0948.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
340	iexplore.exe
3244	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3244	iexplore.exe
3244	iexplore.exe
340	iexplore.exe
340	iexplore.exe
3340	IEXPLORE.EXE
3340	IEXPLORE.EXE
5084	IEXPLORE.EXE
5084	IEXPLORE.EXE
3340	IEXPLORE.EXE
3340	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1364	c5dbb25fa983a695d1c13210e2ff0948mgr.exe
3732	WaterMark.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1364	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	88
PID 3028 wrote to memory of 1364	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	88
PID 3028 wrote to memory of 1364	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	88
PID 3028 wrote to memory of 960	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	89
PID 3028 wrote to memory of 960	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	89
PID 3028 wrote to memory of 960	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	89
PID 1364 wrote to memory of 3732	1364	c5dbb25fa983a695d1c13210e2ff0948mgr.exe	91
PID 1364 wrote to memory of 3732	1364	c5dbb25fa983a695d1c13210e2ff0948mgr.exe	91
PID 1364 wrote to memory of 3732	1364	c5dbb25fa983a695d1c13210e2ff0948mgr.exe	91
PID 960 wrote to memory of 4524	960	cmd.exe	92
PID 960 wrote to memory of 4524	960	cmd.exe	92
PID 960 wrote to memory of 4524	960	cmd.exe	92
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3732 wrote to memory of 4916	3732	WaterMark.exe	93
PID 3028 wrote to memory of 4336	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	94
PID 3028 wrote to memory of 4336	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	94
PID 3028 wrote to memory of 4336	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	94
PID 4336 wrote to memory of 5088	4336	cmd.exe	98
PID 4336 wrote to memory of 5088	4336	cmd.exe	98
PID 4336 wrote to memory of 5088	4336	cmd.exe	98
PID 3732 wrote to memory of 340	3732	WaterMark.exe	104
PID 3732 wrote to memory of 340	3732	WaterMark.exe	104
PID 3732 wrote to memory of 3244	3732	WaterMark.exe	105
PID 3732 wrote to memory of 3244	3732	WaterMark.exe	105
PID 3244 wrote to memory of 5084	3244	iexplore.exe	106
PID 3244 wrote to memory of 5084	3244	iexplore.exe	106
PID 3244 wrote to memory of 5084	3244	iexplore.exe	106
PID 340 wrote to memory of 3340	340	iexplore.exe	107
PID 340 wrote to memory of 3340	340	iexplore.exe	107
PID 340 wrote to memory of 3340	340	iexplore.exe	107
PID 3028 wrote to memory of 4276	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	109
PID 3028 wrote to memory of 4276	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	109
PID 3028 wrote to memory of 4276	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	109
PID 4276 wrote to memory of 4748	4276	cmd.exe	111
PID 4276 wrote to memory of 4748	4276	cmd.exe	111
PID 4276 wrote to memory of 4748	4276	cmd.exe	111
PID 3028 wrote to memory of 2984	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	112
PID 3028 wrote to memory of 2984	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	112
PID 3028 wrote to memory of 2984	3028	c5dbb25fa983a695d1c13210e2ff0948.exe	112
PID 2984 wrote to memory of 1956	2984	cmd.exe	114
PID 2984 wrote to memory of 1956	2984	cmd.exe	114
PID 2984 wrote to memory of 1956	2984	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\c5dbb25fa983a695d1c13210e2ff0948.exe
"C:\Users\Admin\AppData\Local\Temp\c5dbb25fa983a695d1c13210e2ff0948.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\c5dbb25fa983a695d1c13210e2ff0948mgr.exe
  C:\Users\Admin\AppData\Local\Temp\c5dbb25fa983a695d1c13210e2ff0948mgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 204
        5⤵
        Program crash
        
        PID:4308
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:340
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3340
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3244 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe
    3⤵
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\system volume information" /e /g "Admin":f
    3⤵
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\system volume information" /e /g "Admin":f
    3⤵
    PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4916 -ip 4916
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RecoveryStore.{FB3D6F5D-E133-11EE-87B8-7AD2C9E555B0}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB3D6F5D-E133-11EE-87B8-7AD2C9E555B0}.dat
Size 5KB
SHA256 292536dfe96f3c51f9b79f06c321a57414f88318d0379328a15bf98341723076
MD5 f6d54e435dd6170754c8a36338150164
SHA1 09e6a6d4762091944add1b70ad4800e5191ffca7
SHA512 bb2e846f6cf5b09bbcc978e7b5222b599eee41a8cc705deacfcbdc3f58e36a4d04cce7bfb696b9b5406f02140054453e4590b2374f36c881c6f0881204b0c299
SSDEEP 24:r3Go/Qd9XDGo/p9X+9X879lW8lZv9lW8lZ:r3Go4d9TGoR9u9sC8lU8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{FB4494D3-E133-11EE-87B8-7AD2C9E555B0}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FB4494D3-E133-11EE-87B8-7AD2C9E555B0}.dat
Size 5KB
SHA256 8014e88e5545d08081b4d2f3e81d21647eeb9ef039c9951bd6a09cbc7f5ca6fd
MD5 2d26d085950761b0ce42a328932df33d
SHA1 c01dc9b8bab3a5c25fb192b7287d220ee4fbd474
SHA512 ea70301c6a3e5bd4febd7d89f7be405ee102a8822c436422fca792d19c4f7395f19286ebb49a864a2f3151bf945bdb59ce35b2d575a0c2182c8116245ec49dd9
SSDEEP 24:rQGo/Qt9XYGo/Z9X+9X879lWSlEEXS29lWSlEEXSw:rQGo4t9oGox9O9sCSlEE8SlEE
MD5 SHA1 SHA512 SSDEEP

Submit Download

verB853.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB853.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PL0BY74L\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5dbb25fa983a695d1c13210e2ff0948mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\c5dbb25fa983a695d1c13210e2ff0948mgr.exe
Size 95KB
SHA256 814fc401ecae8a232c94d8e073a2643a2b39e188ed5e468936a921fe33a7e975
MD5 0a70e0dc3e1a1dad88120391a049e589
SHA1 a703d480488e7336e12f4c4756edb39a9bc2354c
SHA512 e883030922734dffadd90465e513164d5092df5207a4c8116ae635b2b131892972fa05a69b85851f724761bf0d7309071dc47e8cbdec66460d20677bfc921006
SSDEEP 1536:Axf0u7YnqMGGGMZZZyVb1t9e4GNqBvrPzO7/YiMIATcji:Axf026qbJ1y4GNq5jz+/YiMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

autorun.ini

Path C:\Windows\SysWOW64\autorun.ini
Size 96B
SHA256 c8da3155d0b474769de322528adbca295dc27a4f93a6011a1170c7a4b616fe1a
MD5 5e378cdf3706edcff0170c387fb74ef5
SHA1 5da4ab639930d07cf20a532ad983e1ca909b195c
SHA512 6ee996a5b79b0658d2dc703c22a49c0b7e7176f32e89466e2703e66cf4b2a3063761a40539f34f949f0c7583396c4e6e05133dbac4d8cd0f04f6fef65811b413
MD5 SHA1 SHA512

Submit Download

setting.ini.old

Path C:\Windows\SysWOW64\setting.ini.old
Size 1KB
SHA256 6e9cd61a63b8eaa380ec765f08e4dc19738ad11320472b04dc3211588ae2b2e4
MD5 7af8f10ae0c41de53e5571dbd9335237
SHA1 a213b990a05c89e6dd90b0bf0002819ae4d9dad6
SHA512 bfb5a71bd2a86a731a355242dafa83c018b77616c655f849a40def2e5c1cec3ddbecacb8bceac94cbd752e75f4db717006bc6d9376571c4e4a7f35550f385f51
MD5 SHA1 SHA512

Submit Download

setting.ini.old

Path C:\Windows\SysWOW64\setting.ini.old
Size 1KB
SHA256 799785fad706dfa7b0b7ac82d5d5d5ebf67720163fdd121d2adde8b4f20cd51c
MD5 8441fdc3ad2a04757bd9331c81985c02
SHA1 fa6fa6eb40d9a2a0ed41e65603c398ee7fc5001a
SHA512 e4d21b657fe3aa52b8e1fd62bc79ffe8cd29de66ea90ecea815801c683a8d9235dd6d863dbc7e26bc122bb3b9007b9dd995d803ab7c318dd94d5743405550f08
MD5 SHA1 SHA512

Submit Download

setting.ini.old

Path C:\Windows\SysWOW64\setting.ini.old
Size 1KB
SHA256 b13b44237dc8faa6a3ad69c0334f21301f810a18b30ce7bdbcc2564f85ad0f5b
MD5 e20c213baa25d733fa29e26eef4a99ec
SHA1 1e3287a6ab746a3cb98e165eafda3636515da313
SHA512 9341cdfffb6e742f94208e694f301dee6279463bc45366d73e6de789b75594f5c7132835c4414bb9e631ec536fb98ed1f8ce137c9f9757d3589058d4117008b2
MD5 SHA1 SHA512

Submit Download

setting.ini.old

Path C:\Windows\SysWOW64\setting.ini.old
Size 1KB
SHA256 ad102a072f25078156cd6f3518be1e8d1b48380374770b555d2e50e1245b561d
MD5 75418b02c6bb3b34d8b1d45b1a01dd3b
SHA1 d6764db643adc9bd7e2baea916bb799fe13df031
SHA512 fb1733df8669936ea43a147bef7acb0709c9d75af381561105b6deb70d90824ba4a2216242e499f104a7bda6b5ef05b9cfdabbc12d4b85bba4bea98a7d4ec6b7
MD5 SHA1 SHA512

Submit Download

chrome.exe

Path C:\Windows\chrome.exe
Size 478KB
SHA256 7c2d6857361e13e7324493776903df6a455695bf15e0452ab92001f1e200c419
MD5 c5dbb25fa983a695d1c13210e2ff0948
SHA1 6c3803d46b259b684cb785ea71ea2196aabe9d61
SHA512 856c39a2b2c2296039d418c15e4eec368aebc9a8ea68bdfdaa4479f715e4b65903a1928c09fe71b3287b9c960693ffc5784a3c7d25cf48bd1260f151cebc20a5
SSDEEP 6144:xYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO0B3pgSUGX1Y:xSNC80I+cR3R03VseuOiZgSNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1364-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-7-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/1364-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-13-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-5-0x0000000000400000-0x0000000000459F7C-memory.dmp

Download

memory/1364-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1364-17-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3028-108-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-0-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-148-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-71-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-146-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-145-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-142-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-140-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-128-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-113-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3028-111-0x0000000000400000-0x00000000004FD000-memory.dmp

Download

memory/3732-34-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/3732-109-0x0000000000400000-0x0000000000459F7C-memory.dmp

Download

memory/3732-110-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3732-107-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3732-106-0x0000000000400000-0x0000000000459F7C-memory.dmp

Download

memory/3732-35-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3732-28-0x0000000000400000-0x0000000000459F7C-memory.dmp

Download

memory/3732-25-0x0000000000400000-0x0000000000459F7C-memory.dmp

Download

memory/3732-37-0x0000000077E72000-0x0000000077E73000-memory.dmp

Download

memory/3732-72-0x0000000077E72000-0x0000000077E73000-memory.dmp

Download

memory/3732-70-0x0000000000070000-0x0000000000071000-memory.dmp

Download

memory/4916-38-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/4916-39-0x0000000000470000-0x0000000000471000-memory.dmp

Download