ramnit | 0563ca3086dfa6d074e4bafb98354cc48862b36ec401e3db3d1f92be5095de4e

General

Target

55286139f96615ce3229adc5dd78e7a0_NeikiAnalytics.dll
Size

157KB
MD5

55286139f96615ce3229adc5dd78e7a0
SHA1

06bfe781382c208d04930959308e8a450e935f66
SHA256

0563ca3086dfa6d074e4bafb98354cc48862b36ec401e3db3d1f92be5095de4e
SHA512

c85a70011bc3311f633350c93c33f2dfd3715d0a424d1b0125b93b2c9a6e5a94fce594e41453e2521babdb048783101914d51d86f9067bd978e0b3e82b98c05c
SSDEEP

3072:IMr6N9WfdNAbxBk69VyZhDsHYZ3rDINcQR0n6ecZdGU1QLaLNmYqhPzxm1r:IMqWfdNANG6yEYZ7DVQgsQLPzo1r

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 4 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exe

pid process

2196 rundll32mgr.exe
3068 rundll32mgrmgr.exe
2868 WaterMark.exe
1696 WaterMark.exe

pid	process
2196	rundll32mgr.exe
3068	rundll32mgrmgr.exe
2868	WaterMark.exe
1696	WaterMark.exe

Loads dropped DLL 8 IoCs

Processes:

rundll32.exerundll32mgr.exerundll32mgrmgr.exe

pid	process
1884	rundll32.exe
1884	rundll32.exe
2196	rundll32mgr.exe
2196	rundll32mgr.exe
3068	rundll32mgrmgr.exe
3068	rundll32mgrmgr.exe
2196	rundll32mgr.exe
2196	rundll32mgr.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2196-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2196-37-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3068-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2868-61-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2868-56-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/3068-35-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2196-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2196-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2196-25-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2196-24-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2196-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1696-101-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2868-127-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

Processes:

rundll32.exerundll32mgr.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdarem.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\skchobj.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\wsdetect.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dt_shmem.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nss3.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

WaterMark.exe

pid process

2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
2868 WaterMark.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exeWaterMark.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1884 rundll32.exe
Token: SeDebugPrivilege 2868 WaterMark.exe
Token: SeDebugPrivilege 1940 svchost.exe
Suspicious use of UnmapMainImage 4 IoCs

Processes:

rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exe

pid process

2196 rundll32mgr.exe
3068 rundll32mgrmgr.exe
2868 WaterMark.exe
1696 WaterMark.exe

pid	process
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe
2868	WaterMark.exe

description	pid	process
Token: SeDebugPrivilege	1884	rundll32.exe
Token: SeDebugPrivilege	2868	WaterMark.exe
Token: SeDebugPrivilege	1940	svchost.exe

pid	process
2196	rundll32mgr.exe
3068	rundll32mgrmgr.exe
2868	WaterMark.exe
1696	WaterMark.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exerundll32mgrmgr.exeWaterMark.exe

description	pid	process	target process
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 2316 wrote to memory of 1884	2316	rundll32.exe	rundll32.exe
PID 1884 wrote to memory of 2196	1884	rundll32.exe	rundll32mgr.exe
PID 1884 wrote to memory of 2196	1884	rundll32.exe	rundll32mgr.exe
PID 1884 wrote to memory of 2196	1884	rundll32.exe	rundll32mgr.exe
PID 1884 wrote to memory of 2196	1884	rundll32.exe	rundll32mgr.exe
PID 2196 wrote to memory of 3068	2196	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2196 wrote to memory of 3068	2196	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2196 wrote to memory of 3068	2196	rundll32mgr.exe	rundll32mgrmgr.exe
PID 2196 wrote to memory of 3068	2196	rundll32mgr.exe	rundll32mgrmgr.exe
PID 3068 wrote to memory of 2868	3068	rundll32mgrmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 2868	3068	rundll32mgrmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 2868	3068	rundll32mgrmgr.exe	WaterMark.exe
PID 3068 wrote to memory of 2868	3068	rundll32mgrmgr.exe	WaterMark.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 2480	2868	WaterMark.exe	svchost.exe
PID 2196 wrote to memory of 1696	2196	rundll32mgr.exe	WaterMark.exe
PID 2196 wrote to memory of 1696	2196	rundll32mgr.exe	WaterMark.exe
PID 2196 wrote to memory of 1696	2196	rundll32mgr.exe	WaterMark.exe
PID 2196 wrote to memory of 1696	2196	rundll32mgr.exe	WaterMark.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe
PID 2868 wrote to memory of 1940	2868	WaterMark.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55286139f96615ce3229adc5dd78e7a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55286139f96615ce3229adc5dd78e7a0_NeikiAnalytics.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:2480
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of UnmapMainImage
      PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
132KB

MD5
7566547fef2e8ffed3281c9f501309e6

SHA1
0f49fd6811865481a0f32c288c2688acee423e10

SHA256
6e604f0d8511d11d19960680b5279955791edd0db1452923ba95ba9abf4c1dbf

SHA512
f06cd5db5e169d54389e27b0e66af59e6b21520f683b9f065a24e7282994892ffdc6af9567a90f3906d0bd9302a36c99fe69bf2268b9c5a797d3b580362eddd1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
128KB

MD5
c3d10fe73df0d5e0c4a3f2880147c55f

SHA1
6f81bbeee6175a11764a09b5fd069594870bdc1d

SHA256
195e7a3bc9934ea390fd156d30df57065d4ba665c3b3035334bab5d5ba57a545

SHA512
cc2f915cfe285248fcb17bd315a31a143f0845b516af96408c63ae07483b0ec4fa471bdcca64d194cd43193fdc9e387528a77b76675e59d80b4d325849173e50

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
122KB

MD5
c5255edf109342e3e1d1eb0990b2d094

SHA1
ba029b47b9b3a5ccccae3038d90382ec68a1dd44

SHA256
ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5

SHA512
6b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3

Download Submit
\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
59KB

MD5
f2c8b7e238a07cce22920efb1c8645a6

SHA1
cd2af4b30add747e222f938206b78d7730fdf346

SHA256
6b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e

SHA512
c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699

Download Submit
memory/1696-101-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1884-12-0x0000000077990000-0x0000000077991000-memory.dmp

Filesize
4KB

Download
memory/1884-1-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download
memory/1884-3-0x0000000000300000-0x0000000000333000-memory.dmp

Filesize
204KB

Download
memory/1884-11-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1884-10-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1940-116-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1940-106-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2196-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-20-0x0000000000120000-0x0000000000143000-memory.dmp

Filesize
140KB

Download
memory/2196-21-0x0000000000120000-0x0000000000143000-memory.dmp

Filesize
140KB

Download
memory/2196-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-24-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-36-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2196-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2196-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-67-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2480-65-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2480-75-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2480-88-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2480-87-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2480-86-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2480-80-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2480-84-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2868-62-0x000000007798F000-0x0000000077990000-memory.dmp

Filesize
4KB

Download
memory/2868-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-56-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2868-104-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2868-127-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2868-60-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3068-35-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3068-45-0x0000000000050000-0x0000000000073000-memory.dmp

Filesize
140KB

Download
memory/3068-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads