modiloader | 4ed1fe6848f4109e6a542a904a4dd692e99fcf19937468eb6eb7cc17db0bc3fa

General

Target

3f01eb9b2443229c8afbb484a9e0ca69_JaffaCakes118.exe
Size

356KB
MD5

3f01eb9b2443229c8afbb484a9e0ca69
SHA1

22229316344b4a36d52d7b23ee5aff7bfc7dc9fc
SHA256

4ed1fe6848f4109e6a542a904a4dd692e99fcf19937468eb6eb7cc17db0bc3fa
SHA512

67d7a31e3753f501f43f488286034b4d756398e07e03ce4e2cd96a6aa8e8777c897acd9ae47f7f6a947136cec8843cf92bce4f4a28e1b345c2b188dd06f4b28f
SSDEEP

6144:smUdcds3QFSx8tWHTG7pYIGAKeBbCalBcDS00XxMOxz0hJGUKsvZVM5QiMtW:smlddw+MeBb5lBIPjOMJGOZV9E

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 2984 mshta.exe
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
evasion

File and Directory Discovery
T1083

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2984	mshta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	regsvr32.exe

description	ioc	process
File opened (read-only)	C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys	regsvr32.exe

ModiLoader Second Stage 57 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-1-0x0000000000400000-0x0000000000460710-memory.dmp	modiloader_stage2
behavioral1/memory/1728-0-0x0000000000400000-0x0000000000460710-memory.dmp	modiloader_stage2
behavioral1/memory/1728-2-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-6-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-5-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-4-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-7-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-3-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-8-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/2544-13-0x0000000006100000-0x00000000061DC000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-14-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2544-16-0x0000000006100000-0x00000000061DC000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-17-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-20-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-21-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-33-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-40-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-45-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-47-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-51-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-50-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-49-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-48-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-46-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-39-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-38-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/1728-54-0x0000000000260000-0x000000000033C000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-37-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-36-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-34-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-32-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-31-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-30-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-29-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-28-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-27-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-26-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-25-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-24-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-35-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-22-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-19-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-23-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/2424-18-0x0000000000220000-0x000000000036A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-63-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-66-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-72-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-70-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-69-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-67-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-65-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-62-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-61-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-71-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-68-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-64-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2
behavioral1/memory/1760-60-0x0000000000250000-0x000000000039A000-memory.dmp	modiloader_stage2

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe

Deletes itself 1 IoCs

Processes:

regsvr32.exe

pid process

2424 regsvr32.exe

pid	process
2424	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\d38b1\\f5332.bat\""	regsvr32.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exeregsvr32.exe

description	pid	process	target process
PID 2544 set thread context of 2424	2544	powershell.exe	regsvr32.exe
PID 2424 set thread context of 1760	2424	regsvr32.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International	regsvr32.exe

Modifies registry class 7 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\085b6	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\085b6\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\085b6\shell\open	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\085b6\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\085b6\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:mScm9=\"ci\";A6o=new ActiveXObject(\"WScript.Shell\");K1Ygm9=\"f41HN\";BDQS8=A6o.RegRead(\"HKCU\\\\software\\\\atqjps\\\\xawh\");rsnl54QAL=\"8H\";eval(BDQS8);VZ6tPZ7=\"lD0wN\";\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.108f08	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.108f08\ = "085b6"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeregsvr32.exe

pid	process
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe
2424	regsvr32.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

powershell.exeregsvr32.exe

pid process

2544 powershell.exe
2424 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2544 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2544	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

mshta.exepowershell.exeregsvr32.exe

description	pid	process	target process
PID 2668 wrote to memory of 2544	2668	mshta.exe	powershell.exe
PID 2668 wrote to memory of 2544	2668	mshta.exe	powershell.exe
PID 2668 wrote to memory of 2544	2668	mshta.exe	powershell.exe
PID 2668 wrote to memory of 2544	2668	mshta.exe	powershell.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2544 wrote to memory of 2424	2544	powershell.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe
PID 2424 wrote to memory of 1760	2424	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\3f01eb9b2443229c8afbb484a9e0ca69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3f01eb9b2443229c8afbb484a9e0ca69_JaffaCakes118.exe"
1⤵
PID:1728

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:or8KjxbQ="fnzpjz";O0p=new%20ActiveXObject("WScript.Shell");C0uC8WVqx="WOlX";rsxC01=O0p.RegRead("HKCU\\software\\MJGlR53ch\\rowkr4p");ImYC1z5K="ea1c6A6";eval(rsxC01);XBL9qwJG="7";
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:pykq
2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\SysWOW64\regsvr32.exe"
4⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

3

T1497

Credential Access

Discovery

File and Directory Discovery

1

T1083

Peripheral Device Discovery

Query Registry

Software Discovery

System Information Discovery

3

T1082

Virtualization/Sandbox Evasion

3

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\d38b1\2307a.108f08
Filesize
29KB

MD5
5b4c7b296457ccd1a421e79cf295b3e7

SHA1
62f9ae48becff2c87274b58439769c42b6ea77ff

SHA256
c7cf0e14aa77f4bf8d2e1490a9c7ee1894f20cb81f8b34e24462985398de536c

SHA512
0eb2ed41d68180bcae50ab28be223c5f00fcadd737309130e568b5f55cd477d360ff8422fa22fa28a11f52da204fbf74e7bdd059627d8242c534423a8b16ed01

Download Submit
C:\Users\Admin\AppData\Local\d38b1\f5332.bat
Filesize
66B

MD5
51ca88070719f69cfdf3518d30ef8313

SHA1
d7a08b6965a2c9862ca0c47b02c99f83cb035adb

SHA256
772b9b6045a5fd60f306eec621935086a0125fe00a1251d37a1ec244abcd01ff

SHA512
e69409cfd67942a1658a03d8aa62f7267332640bac225c65241328c778abdb4b2996d0a9c08e2dea17aa5ef509d7601c9155f90d13ac4f7cd499a95ecb5860bf

Download Submit
memory/1728-54-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-0-0x0000000000400000-0x0000000000460710-memory.dmp

Filesize
385KB

Download
memory/1728-2-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-6-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-5-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-4-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-7-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-3-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-8-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/1728-1-0x0000000000400000-0x0000000000460710-memory.dmp

Filesize
385KB

Download
memory/1760-64-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-68-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-71-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-60-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-61-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-62-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-65-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-67-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-69-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-70-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-72-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-66-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/1760-63-0x0000000000250000-0x000000000039A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-21-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-19-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-39-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-37-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-36-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-34-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-32-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-31-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-30-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-29-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-28-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-27-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-26-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-25-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-24-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-35-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-22-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-38-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-23-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-18-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-46-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-48-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-49-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-50-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-51-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-47-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-45-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-40-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-33-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-20-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-17-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2424-14-0x0000000000220000-0x000000000036A000-memory.dmp

Filesize
1.3MB

Download
memory/2544-16-0x0000000006100000-0x00000000061DC000-memory.dmp

Filesize
880KB

Download
memory/2544-13-0x0000000006100000-0x00000000061DC000-memory.dmp

Filesize
880KB

Download
memory/2544-12-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads