7a0bd91b7d9613662c5019252c87d7e565e4660a26df6e6914039b0eb27c8086

General

Target

Luxury Macro Exploit.exe
Size

4.4MB
MD5

22bb8853289bed446fc3d4bfc52cfc45
SHA1

f021536fbc904c9a2a1cae09902c1c2660a4c8c5
SHA256

7a0bd91b7d9613662c5019252c87d7e565e4660a26df6e6914039b0eb27c8086
SHA512

aea422c54e0e73c2a6203a2b62fa4a5d6a4d7da31371ca42ddf41d2e3db844171d7ce21db63fa85705f83a913600dbbb172d65ed105066e776b7ee10a3c3cdcc
SSDEEP

98304:CVjdab58u1eCwZsX72zzTvtqrYujRv5i0MVs+fRrBKyXq/iGyEZcn8RF2nB8SH:CH88u1twZsLKt4RiHnK

Score

8^/10

agilenet

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

cscript.exe

flow pid process

60 908 cscript.exe

flow	pid	process
60	908	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Luxury Macro Exploit.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Luxury Macro Exploit.exe

Loads dropped DLL 2 IoCs

Processes:

Luxury Macro Exploit.exeLuxury Macro Exploit.exe

pid process

3740 Luxury Macro Exploit.exe
212 Luxury Macro Exploit.exe

pid	process
3740	Luxury Macro Exploit.exe
212	Luxury Macro Exploit.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/3740-10-0x0000000006D10000-0x0000000006F5C000-memory.dmp	agile_net
behavioral1/memory/3740-41-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-61-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-73-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-83-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-81-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-79-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-77-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-76-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-71-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-69-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-67-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-65-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-63-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-59-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-57-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-55-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-53-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-51-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-49-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-47-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-43-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-45-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-39-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-37-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-33-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-31-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-29-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-27-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-25-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-23-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-22-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net
behavioral1/memory/3740-35-0x0000000006D10000-0x0000000006F58000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

cscript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	cscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	cscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	cscript.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Luxury Macro Exploit.exe

description pid process

Token: SeDebugPrivilege 3740 Luxury Macro Exploit.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Luxury Macro Exploit.exeLuxury Macro Exploit.exe

pid process

3740 Luxury Macro Exploit.exe
3740 Luxury Macro Exploit.exe
212 Luxury Macro Exploit.exe
212 Luxury Macro Exploit.exe

description	pid	process
Token: SeDebugPrivilege	3740	Luxury Macro Exploit.exe

pid	process
3740	Luxury Macro Exploit.exe
3740	Luxury Macro Exploit.exe
212	Luxury Macro Exploit.exe
212	Luxury Macro Exploit.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Luxury Macro Exploit.exe

description	pid	process	target process
PID 3740 wrote to memory of 908	3740	Luxury Macro Exploit.exe	cscript.exe
PID 3740 wrote to memory of 908	3740	Luxury Macro Exploit.exe	cscript.exe
PID 3740 wrote to memory of 908	3740	Luxury Macro Exploit.exe	cscript.exe
PID 3740 wrote to memory of 212	3740	Luxury Macro Exploit.exe	Luxury Macro Exploit.exe
PID 3740 wrote to memory of 212	3740	Luxury Macro Exploit.exe	Luxury Macro Exploit.exe
PID 3740 wrote to memory of 212	3740	Luxury Macro Exploit.exe	Luxury Macro Exploit.exe

C:\Users\Admin\AppData\Local\Temp\Luxury Macro Exploit.exe
"C:\Users\Admin\AppData\Local\Temp\Luxury Macro Exploit.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Roaming\WK.Libraries.FontsInstaller\\Unavailable\Installer.vbs"
2⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:908

C:\Users\Admin\AppData\Local\Temp\Luxury Macro Exploit.exe
"C:\Users\Admin\AppData\Local\Temp\Luxury Macro Exploit.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Luxury Macro Exploit.exe.log
Filesize
1KB

MD5
5772429ccc0bed603acd01dfefe03c32

SHA1
e91b4b1656373eb24c954aa518d2ae42af61299a

SHA256
64538fa06bd1ec8ed6a764bd50101473311af527fa0ed9bcef9ce5a7ce740eaa

SHA512
bd18570e660c783b000b1656d62387b5af2dfd5014cbe77f347388532f50972a5fe0e18c6727602a5366cc566ff436c92cb87dc2ab90cde882195fd79ecedf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll
Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
C:\Users\Admin\AppData\Roaming\WK.Libraries.FontsInstaller\Unavailable\Installer.vbs
Filesize
15KB

MD5
f3040d44a71f07e4117dbf0755391d90

SHA1
099fb8bbb44b1d83b9c0e942d3530870c32ffc47

SHA256
590538e3897a340f3e9549155f93152afaf378d2cbee8027d3fb23bf5265a475

SHA512
20385d05d2701a101069f760a1ca09cd8fc332daf4000c0d4e9e35d0d5d647c0cc7197e6a52ec796644f5fd5d9f3e07d2d54ea311633ce0c7ea44cb9f0df877a

Download Submit
C:\Users\Admin\AppData\Roaming\WK.Libraries.FontsInstaller\Unavailable\Karla.ttf
Filesize
37KB

MD5
871b31793a538de46b8ffaf916a5080b

SHA1
0f239aa4f2a6cd8a69d5cc71e0c05601c80b62d0

SHA256
08a5aa42ebf8c0cd1aef8d76a0227e919c5f70f54c3c246dd53bc2e91ef14d53

SHA512
1b9972a665fd4783b17ed63a9cf2d84fdd5294c72592e0412e53454b744eb07e8a73184ba153e85feacc38178b062d014067f1cfa52e265a193d0df61a1fb057

Download Submit
memory/212-10683-0x0000000071110000-0x0000000071147000-memory.dmp

Filesize
220KB

Download
memory/212-21279-0x0000000071110000-0x0000000071147000-memory.dmp

Filesize
220KB

Download
memory/3740-63-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-7-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-3-0x0000000006660000-0x0000000006C04000-memory.dmp

Filesize
5.6MB

Download
memory/3740-4-0x0000000005D60000-0x0000000005DF2000-memory.dmp

Filesize
584KB

Download
memory/3740-5-0x0000000005C00000-0x0000000005C0A000-memory.dmp

Filesize
40KB

Download
memory/3740-6-0x0000000005E00000-0x0000000005E56000-memory.dmp

Filesize
344KB

Download
memory/3740-51-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-8-0x0000000005FA0000-0x0000000006368000-memory.dmp

Filesize
3.8MB

Download
memory/3740-9-0x0000000006370000-0x000000000648A000-memory.dmp

Filesize
1.1MB

Download
memory/3740-10-0x0000000006D10000-0x0000000006F5C000-memory.dmp

Filesize
2.3MB

Download
memory/3740-11-0x00000000064D0000-0x0000000006532000-memory.dmp

Filesize
392KB

Download
memory/3740-12-0x00000000065B0000-0x0000000006616000-memory.dmp

Filesize
408KB

Download
memory/3740-41-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-61-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-73-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-83-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-81-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-79-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-77-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-49-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-71-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-69-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-67-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-65-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-1-0x0000000000DF0000-0x0000000001254000-memory.dmp

Filesize
4.4MB

Download
memory/3740-59-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-57-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-55-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-53-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-2-0x0000000005C20000-0x0000000005CBC000-memory.dmp

Filesize
624KB

Download
memory/3740-76-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-47-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-43-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-45-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-39-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-37-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-33-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-31-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-29-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-27-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-25-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-23-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-22-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-21-0x0000000073330000-0x00000000733B9000-memory.dmp

Filesize
548KB

Download
memory/3740-35-0x0000000006D10000-0x0000000006F58000-memory.dmp

Filesize
2.3MB

Download
memory/3740-20-0x0000000071040000-0x0000000071077000-memory.dmp

Filesize
220KB

Download
memory/3740-10618-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-10619-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-10620-0x0000000008830000-0x000000000883A000-memory.dmp

Filesize
40KB

Download
memory/3740-10621-0x00000000088D0000-0x00000000088F6000-memory.dmp

Filesize
152KB

Download
memory/3740-10622-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-10623-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/3740-10624-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-10625-0x0000000071040000-0x0000000071077000-memory.dmp

Filesize
220KB

Download
memory/3740-0-0x000000007492E000-0x000000007492F000-memory.dmp

Filesize
4KB

Download
memory/3740-10674-0x000000000CA10000-0x000000000CB96000-memory.dmp

Filesize
1.5MB

Download
memory/3740-10677-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads