blackmoon | 94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c

General

Target

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Size

13.3MB
MD5

73fe097b71eaa10a8ce651cf7026db93
SHA1

ed711d0d68173869fb523eec521a50eafe097401
SHA256

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c
SHA512

dab9d34861f5ed3fd74a15c98f5ebf01ddf2698180951057a1dfe55d8332bf91535383275ecd8e0103969cebb2e8247517f1faf55f5164493c494a5c34675253
SSDEEP

393216:3k9bzy/+6xDMmAsFqJrEHmgGqvr2FaL/g8b:L/HNXFq9jgGeKFI/Xb

Score

10^/10

blackmoon aspackv2 banker trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-25-0x0000000004F90000-0x00000000069D7000-memory.dmp	family_blackmoon
behavioral1/memory/1664-6-0x00000000036E0000-0x0000000003820000-memory.dmp	family_blackmoon
behavioral1/memory/1664-9-0x00000000036E0000-0x0000000003820000-memory.dmp	family_blackmoon
behavioral1/memory/2356-45-0x0000000001E50000-0x0000000001F90000-memory.dmp	family_blackmoon
behavioral1/memory/2356-43-0x0000000001E50000-0x0000000001F90000-memory.dmp	family_blackmoon

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	aspack_v212_v242

Deletes itself 1 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid process

1212 94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Executes dropped EXE 2 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Loads dropped DLL 2 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

description	ioc	process
File opened (read-only)	\??\Y:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\E:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\I:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\L:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\O:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\P:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\Q:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\R:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\A:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\H:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\N:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\S:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\U:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\V:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\X:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\J:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\M:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\T:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\W:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\Z:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\B:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\G:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\K:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
File opened (read-only)	\??\a:	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

description	pid	process
Token: SeDebugPrivilege	2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Token: SeDebugPrivilege	1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

pid	process
2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
1212	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
"C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
2⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532

C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
"C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe" 2532 "C:\Users\Admin\AppData\Local\Temp\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356

C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
C:\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lsm.tmp
Filesize
80B

MD5
463add58265e10186a741e3531f628c5

SHA1
faffb51fe27dc160a3ad545b577ffa7969346b51

SHA256
f87545551ad6ead943b4d393b5bd3cc6ea8e780cdb0b98115545bda7fe739aac

SHA512
927eb6de03aa3ffe33a87143ae948f5b145ac602a2612af36dfdb677cebe43f9b8c1c99e7693e77819e1e85e0b5b8122f7cbb28d2e3eb04ae708277cb0c90d3b

Download Submit
\µÀÌì¸´¹Å\94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
Filesize
13.3MB

MD5
73fe097b71eaa10a8ce651cf7026db93

SHA1
ed711d0d68173869fb523eec521a50eafe097401

SHA256
94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c

SHA512
dab9d34861f5ed3fd74a15c98f5ebf01ddf2698180951057a1dfe55d8332bf91535383275ecd8e0103969cebb2e8247517f1faf55f5164493c494a5c34675253

Download Submit
memory/1212-63-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/1664-3-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-4-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-0-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-2-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-5-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1664-25-0x0000000004F90000-0x00000000069D7000-memory.dmp

Filesize
26.3MB

Download
memory/1664-23-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-29-0x0000000000380000-0x00000000003EC000-memory.dmp

Filesize
432KB

Download
memory/1664-1-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/1664-9-0x00000000036E0000-0x0000000003820000-memory.dmp

Filesize
1.2MB

Download
memory/1664-10-0x0000000000380000-0x00000000003EC000-memory.dmp

Filesize
432KB

Download
memory/1664-6-0x00000000036E0000-0x0000000003820000-memory.dmp

Filesize
1.2MB

Download
memory/1664-7-0x000000007EED0000-0x000000007EF50000-memory.dmp

Filesize
512KB

Download
memory/2356-37-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2356-38-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2356-40-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2356-45-0x0000000001E50000-0x0000000001F90000-memory.dmp

Filesize
1.2MB

Download
memory/2356-41-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2356-43-0x0000000001E50000-0x0000000001F90000-memory.dmp

Filesize
1.2MB

Download
memory/2356-58-0x0000000000400000-0x0000000001E47000-memory.dmp

Filesize
26.3MB

Download
memory/2532-13-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2532-39-0x0000000005A10000-0x0000000007457000-memory.dmp

Filesize
26.3MB

Download
memory/2532-36-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/2532-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-28-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/2532-15-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2532-27-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/2532-26-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/2532-18-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/2532-19-0x00000000001D0000-0x00000000001F9000-memory.dmp

Filesize
164KB

Download
memory/2532-21-0x00000000001D0000-0x00000000001F9000-memory.dmp

Filesize
164KB

Download

description	pid	process	target process
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 1664 wrote to memory of 2532	1664	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2532 wrote to memory of 2356	2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2532 wrote to memory of 2356	2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2532 wrote to memory of 2356	2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2532 wrote to memory of 2356	2532	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe
PID 2356 wrote to memory of 1212	2356	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe	94b72a7c841f2dcadb28162bfe99c6f6b1050f3dcbe37af67bbea5cb40b2961c.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads