nanocore | 510c92f4ed90b092940d8d47585e2a55d1ad71e7ecd87b3e6ec783ab23fc9ed9

General

Target

NaxorCrypter.exe
Size

2.2MB
MD5

b29c154b97950a07caf5aa3e3795a4a1
SHA1

8940008c6630ad14a42f76c72b63341adb406736
SHA256

51a39194cd5c21c1de6e9724f9b5890a2b50f9d7e3b7fa003a5e50beb9559fb4
SHA512

c21b40a6e412f0022da398212ddcf6cfdf51522715297d0275fb2983d936a1ace29f4f8a54f751617fc92121b825424389bdd096b9c59c4cff6a58a57bde7bc3
SSDEEP

24576:NkGGdafLtcWAjB9XvdBqLP2XDBxkdgGAQjdhnF61A5w/8yYBBifgqH3P64F7:G4ovIbqxCTx5w/Xf5f

Score

10^/10

nanocore njrat hacked evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

1337day.ddns.net:1900

Mutex

93979016-0516-4417-b883-a0edc923fe85

Attributes

activate_away_mode
true
backup_connection_host
1337day.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-07-29T17:12:59.761069736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1900
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
93979016-0516-4417-b883-a0edc923fe85
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

fal92.duckdns.org:10142

Mutex

3d25feee885880d8ab876c66d8b91d84

Attributes

reg_key
3d25feee885880d8ab876c66d8b91d84
splitter
|'|'|

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2688 netsh.exe

pid	process
2688	netsh.exe

Drops startup file 2 IoCs

Processes:

Cooporation Nvidia.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d25feee885880d8ab876c66d8b91d84.exe	Cooporation Nvidia.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d25feee885880d8ab876c66d8b91d84.exe	Cooporation Nvidia.exe

Executes dropped EXE 6 IoCs

Processes:

Naxor.exeCooporation Nvidia.exeNaxor Crypter.exeCooporation Nvidia.exeCooporation Nvidia.exeCooporation Nvidia.exe

pid process

2628 Naxor.exe
2728 Cooporation Nvidia.exe
2540 Naxor Crypter.exe
2936 Cooporation Nvidia.exe
1088 Cooporation Nvidia.exe
1736 Cooporation Nvidia.exe

pid	process
2628	Naxor.exe
2728	Cooporation Nvidia.exe
2540	Naxor Crypter.exe
2936	Cooporation Nvidia.exe
1088	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe

Loads dropped DLL 11 IoCs

Processes:

NaxorCrypter.exeNaxor.exeCooporation Nvidia.exeCooporation Nvidia.exe

pid	process
2880	NaxorCrypter.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2628	Naxor.exe
2728	Cooporation Nvidia.exe
2936	Cooporation Nvidia.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Cooporation Nvidia.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\3d25feee885880d8ab876c66d8b91d84 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cooporation Nvidia.exe\" .."	Cooporation Nvidia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3d25feee885880d8ab876c66d8b91d84 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cooporation Nvidia.exe\" .."	Cooporation Nvidia.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

NaxorCrypter.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NaxorCrypter.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NaxorCrypter.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

NaxorCrypter.exeCooporation Nvidia.exeCooporation Nvidia.exe

description	pid	process	target process
PID 2880 set thread context of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2728 set thread context of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 set thread context of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2948 schtasks.exe

pid	process
2948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

NaxorCrypter.exeNaxorCrypter.exeCooporation Nvidia.exeCooporation Nvidia.exeCooporation Nvidia.exe

pid	process
2880	NaxorCrypter.exe
2880	NaxorCrypter.exe
2880	NaxorCrypter.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
2728	Cooporation Nvidia.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
1088	Cooporation Nvidia.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
2140	NaxorCrypter.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe
1736	Cooporation Nvidia.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

NaxorCrypter.exe

pid process

2140 NaxorCrypter.exe

pid	process
2140	NaxorCrypter.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

NaxorCrypter.exeNaxorCrypter.exeCooporation Nvidia.exeCooporation Nvidia.exeCooporation Nvidia.exe

description	pid	process
Token: SeDebugPrivilege	2880	NaxorCrypter.exe
Token: SeDebugPrivilege	2140	NaxorCrypter.exe
Token: SeDebugPrivilege	2728	Cooporation Nvidia.exe
Token: SeDebugPrivilege	1088	Cooporation Nvidia.exe
Token: SeDebugPrivilege	1736	Cooporation Nvidia.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

NaxorCrypter.exeNaxor.exeCooporation Nvidia.exeCooporation Nvidia.exeCooporation Nvidia.exeCooporation Nvidia.exe

description	pid	process	target process
PID 2880 wrote to memory of 2948	2880	NaxorCrypter.exe	schtasks.exe
PID 2880 wrote to memory of 2948	2880	NaxorCrypter.exe	schtasks.exe
PID 2880 wrote to memory of 2948	2880	NaxorCrypter.exe	schtasks.exe
PID 2880 wrote to memory of 2948	2880	NaxorCrypter.exe	schtasks.exe
PID 2880 wrote to memory of 3032	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 3032	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 3032	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 3032	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 1720	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 1720	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 1720	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 1720	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2140	2880	NaxorCrypter.exe	NaxorCrypter.exe
PID 2880 wrote to memory of 2628	2880	NaxorCrypter.exe	Naxor.exe
PID 2880 wrote to memory of 2628	2880	NaxorCrypter.exe	Naxor.exe
PID 2880 wrote to memory of 2628	2880	NaxorCrypter.exe	Naxor.exe
PID 2880 wrote to memory of 2628	2880	NaxorCrypter.exe	Naxor.exe
PID 2628 wrote to memory of 2728	2628	Naxor.exe	Cooporation Nvidia.exe
PID 2628 wrote to memory of 2728	2628	Naxor.exe	Cooporation Nvidia.exe
PID 2628 wrote to memory of 2728	2628	Naxor.exe	Cooporation Nvidia.exe
PID 2628 wrote to memory of 2728	2628	Naxor.exe	Cooporation Nvidia.exe
PID 2628 wrote to memory of 2540	2628	Naxor.exe	Naxor Crypter.exe
PID 2628 wrote to memory of 2540	2628	Naxor.exe	Naxor Crypter.exe
PID 2628 wrote to memory of 2540	2628	Naxor.exe	Naxor Crypter.exe
PID 2628 wrote to memory of 2540	2628	Naxor.exe	Naxor Crypter.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2728 wrote to memory of 2936	2728	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2936 wrote to memory of 1088	2936	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2936 wrote to memory of 1088	2936	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2936 wrote to memory of 1088	2936	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 2936 wrote to memory of 1088	2936	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1088 wrote to memory of 1736	1088	Cooporation Nvidia.exe	Cooporation Nvidia.exe
PID 1736 wrote to memory of 2688	1736	Cooporation Nvidia.exe	netsh.exe
PID 1736 wrote to memory of 2688	1736	Cooporation Nvidia.exe	netsh.exe
PID 1736 wrote to memory of 2688	1736	Cooporation Nvidia.exe	netsh.exe
PID 1736 wrote to memory of 2688	1736	Cooporation Nvidia.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe
"C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Crypter\Crypter" /XML "C:\Users\Admin\AppData\Roaming\Crypter\aooooo.xml"
2⤵
- Creates scheduled task(s)
PID:2948

C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe
"C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe"
2⤵
PID:3032

C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe
"C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe"
2⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe
"C:\Users\Admin\AppData\Local\Temp\NaxorCrypter.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Users\Admin\AppData\Local\Temp\Naxor.exe
"C:\Users\Admin\AppData\Local\Temp\Naxor.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\Cooporation Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Cooporation Nvidia.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728

C:\Users\Admin\AppData\Local\Temp\Cooporation Nvidia.exe
"C:\Users\Admin\AppData\Local\Temp\Cooporation Nvidia.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Roaming\Cooporation Nvidia.exe
"C:\Users\Admin\AppData\Roaming\Cooporation Nvidia.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Roaming\Cooporation Nvidia.exe
"C:\Users\Admin\AppData\Roaming\Cooporation Nvidia.exe"
6⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Cooporation Nvidia.exe" "Cooporation Nvidia.exe" ENABLE
7⤵
- Modifies Windows Firewall
PID:2688

C:\Users\Admin\AppData\Local\Temp\Naxor Crypter.exe
"C:\Users\Admin\AppData\Local\Temp\Naxor Crypter.exe"
3⤵
- Executes dropped EXE
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cooporation Nvidia.exe
Filesize
286KB

MD5
2bb4aaf47de772b665bdab87fa48ee60

SHA1
ccddbd80107f4b854826c92d7e8088d6c3736684

SHA256
a939480354a35391d3b4c970ef4cfa48acbdcabb3c7992b21f947ac9029b9500

SHA512
4e75c2d36e753dd7bc192b2d4575a45a336179659573733dea6c484051c6efda25f4bb7412190c201e3f0f06a785409d130932df588dd69f199da8e9ae81daf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe
Filesize
85KB

MD5
2e5f1cf69f92392f8829fc9c9263ae9b

SHA1
97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5

SHA256
51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b

SHA512
f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

Download Submit
C:\Users\Admin\AppData\Roaming\Crypter\aooooo.xml
Filesize
1KB

MD5
e2306bb05524698f22f8bf81958388f6

SHA1
607012e8986d5e0f7c9281498e424fae725e83d2

SHA256
51a089fcf171b96a3966d0ff1b1caa6e18a344be90bc343e53499e0d932ea4ce

SHA512
b4ddb014c175e7c5c9d4fb64df646f1cbc344e24dac793b10aa98ab077df22fc78bea23476aee66e2a56e552965b44a51c5933d0d9bc175026478af3eae662bf

Download Submit
\Users\Admin\AppData\Local\Temp\Naxor Crypter.exe
Filesize
1.9MB

MD5
eb62d522aa83250770fb5dfbe3136bda

SHA1
8e1b0a19575ef93cbe4f98b6ed252cf7a450ccdc

SHA256
f2936d5c363aca1604c2daacbfd086572c5956a0796a92f0d8f92001b9d0b971

SHA512
1b24cb54b5c3f907356e402afedee3603e81ceb5858bd3fcb52c349c42afbf6a426e9236d2c871b4191c21a4e799c5af0db0773822dfa6a3be128d776ec78be5

Download Submit
\Users\Admin\AppData\Local\Temp\Naxor.exe
Filesize
1.1MB

MD5
33dbbf2d55dc60f7c88638c145d0f716

SHA1
36bc559e602d931a6255c4286b7eeb7baf01bf11

SHA256
9333f355306caaf9d0b292c7268e3d3475b297533437a4fa7568b7743be30db6

SHA512
09d88f26867fb8dd1d11e5eecd16d5f952c9c8786ccd6a637ac65da0e2ed127d5ed819110ce344b38cdeec4b2219ead868ea75d3b6a9a6cb8fa53862ec7a7157

Download Submit
memory/1736-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-25-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2140-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2140-104-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-102-0x0000000000900000-0x0000000000AF6000-memory.dmp

Filesize
2.0MB

Download
memory/2880-31-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2880-0-0x0000000074C61000-0x0000000074C62000-memory.dmp

Filesize
4KB

Download
memory/2880-2-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2880-1-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2936-79-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-77-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2936-74-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-72-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-70-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-68-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2936-80-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads