neshta | 7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f

General

Target

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
Size

765KB
MD5

1749d5406cf30364c3376881e6c7467f
SHA1

bfb8a8fd81ccf78bc91beed2cbced59aed2b81c3
SHA256

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f
SHA512

2ec83c992b7a850ae136f0131e0b4e43a90c5a10e9f9dd1b470351d0c803b69e40688c82040a586c37d830c03e901c95ebd0abb45f23b558f6901b6282624b05
SSDEEP

12288:JjhvN888888888888W88888888888yoh3S0bqB16ftOngUy8wDKyNtxv0ZrR9ntE:Jjh2ohiMcQ0ng3DKyNtxmrnkVuR0176s

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

Executes dropped EXE 2 IoCs

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp

pid	process
3384	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
4904	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

Drops file in Windows directory 1 IoCs

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

Modifies registry class 1 IoCs

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe

description	pid	process	target process
PID 3972 wrote to memory of 3384	3972	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
PID 3972 wrote to memory of 3384	3972	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
PID 3972 wrote to memory of 3384	3972	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
PID 3384 wrote to memory of 4904	3384	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp
PID 3384 wrote to memory of 4904	3384	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp
PID 3384 wrote to memory of 4904	3384	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe	7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp

C:\Users\Admin\AppData\Local\Temp\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
"C:\Users\Admin\AppData\Local\Temp\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\3582-490\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\is-CS0ID.tmp\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CS0ID.tmp\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp" /SL5="$80186,316825,139264,C:\Users\Admin\AppData\Local\Temp\3582-490\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe"
3⤵
- Executes dropped EXE
PID:4904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Filesize
2.4MB

MD5
d9e8a1fa55faebd36ed2342fedefbedd

SHA1
c25cc7f0035488de9c5df0121a09b5100e1c28e9

SHA256
bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

SHA512
134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.exe
Filesize
725KB

MD5
5c8ab927af4c5119480f4cb3be6e13a7

SHA1
66cd93c9f9430ee18606a643b6681c13a131c653

SHA256
e8775927961416c3e49b07df014a262a6df8c87889f0fbc98ff55cd2c9eefb66

SHA512
579d75e0fe6bd7906b10a9f730620bf17e1f0c489a1ffa76d0ac0d19997b2cffe3aa9c7183fd920cac923b1227b4915c8cd44cbe9dff45003a39924a025935e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CS0ID.tmp\7c5c77034e8c29d312ec81371ef40d83fe482b10e01d37102f932037e7c2372f.tmp
Filesize
1.1MB

MD5
e4b375d015d9c43b5ef761bbec21a04f

SHA1
6e2abab1865be0d3096dc3e4b3d9ca056f38b253

SHA256
4430a7c90ba70cb8e965497f955c30c3909a0a323dadc7bcbc1ff24d22c599af

SHA512
ff47307a4b96c0fbab5b4ae4dfc7dd0adf099d09983ff505762fe7d9a35d053fab3aa101bbb4bca76e6a90aea0026d95d2c446b22114aa39b3ef11986dc8af72

Download Submit
memory/3384-13-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3384-112-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3972-111-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3972-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3972-118-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4904-19-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/4904-113-0x0000000000400000-0x0000000000525000-memory.dmp

Filesize
1.1MB

Download
memory/4904-119-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads