outsteel | ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c

General

Target

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
Size

990KB
MD5

c96cfe462657240c155d4b1842292a4c
SHA1

e94483c338213c667720a44d89c12a3f50547c71
SHA256

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c
SHA512

7c8b24dcd2a5d7227ba25bcbc23fda63f851f5bf71662201c4bd237f0a94ad1f20a877ab7276a4cd22fba0068a5df3dd7de9a33f6afffe2fb13c7d477cce798e
SSDEEP

12288:9GRx1eEHiQ5/lLXYsQwYfKu+eYbVcOoUv5hKo9HdwQCQBC7rD8kkSuEdz5s61qj:1EHiQf5+fZ+eYxcZO1jo7XuEDs9

Score

10^/10

outsteel spyware stealer

Malware Config

Signatures

OutSteel
OutSteel is a file uploader and document stealer written in AutoIT.
stealer outsteel
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	ioc	process
File opened (read-only)	\??\g:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\m:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\o:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\s:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\t:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\w:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\n:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\x:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\a:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\b:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\e:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\i:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\j:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\k:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\y:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\h:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\p:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\r:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\u:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\v:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\l:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\q:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
File opened (read-only)	\??\z:	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

AutoIT Executable 23 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3732-7-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-9-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-10-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-12-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-13-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-15-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-27-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-31-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-35-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-39-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-43-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-47-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-48-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-51-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-52-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-55-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-59-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-63-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-64-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-67-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-71-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-72-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe
behavioral2/memory/3732-81-0x0000000000400000-0x00000000004E2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process	target process
PID 60 set thread context of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description pid process

Token: SeDebugPrivilege 60 ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process
Token: SeDebugPrivilege	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exeff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe

description	pid	process	target process
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 60 wrote to memory of 3732	60	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
PID 3732 wrote to memory of 412	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 412	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 412	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 5072	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 5072	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 5072	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1384	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1384	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1384	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4328	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4328	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4328	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 408	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 408	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 408	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1844	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1844	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1844	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4268	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4268	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4268	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4848	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4848	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4848	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 740	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 740	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 740	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2952	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2952	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2952	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4768	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4768	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4768	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2684	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2684	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2684	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4484	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4484	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 4484	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 3984	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 3984	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 3984	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2280	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2280	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2280	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1940	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1940	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 1940	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2660	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2660	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe
PID 3732 wrote to memory of 2660	3732	ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
"C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60
- C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
  C:\Users\Admin\AppData\Local\Temp\ff07325f5454c46e883fefc7106829f75c27e3aaf312eb3ab50525faba51c23c.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A
    3⤵
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A
    3⤵
    PID:408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A
    3⤵
    PID:740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A
    3⤵
    PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A
    3⤵
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-11-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/60-1-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/60-2-0x0000000005590000-0x0000000005B34000-memory.dmp

Filesize
5.6MB

Download
memory/60-3-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/60-4-0x0000000005070000-0x0000000005080000-memory.dmp

Filesize
64KB

Download
memory/60-5-0x0000000005050000-0x000000000505A000-memory.dmp

Filesize
40KB

Download
memory/60-6-0x0000000005410000-0x0000000005432000-memory.dmp

Filesize
136KB

Download
memory/60-0-0x0000000000540000-0x000000000063C000-memory.dmp

Filesize
1008KB

Download
memory/3732-27-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-47-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-9-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-12-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-13-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-15-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-7-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-31-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-35-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-39-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-43-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-10-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-48-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-51-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-52-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-55-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-59-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-63-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-64-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-67-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-71-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-72-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/3732-81-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads