quasar | 4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019

General

Target

Update.exe
Size

20.4MB
MD5

88246c2a001042481486e559a6d10d91
SHA1

e64a646ba23b7795ec3dfb5ae4d80b02c7dd274f
SHA256

4a424271b9a191afc76110e2bccd45f23cc281853f223d3e27756e16c14b5019
SHA512

f3daab1877324bc8ac1f52bc9d1c7327230840fc53899aed47b69dd6b7e996cf3fde70c7efe209fa6fb9d80d58687abbd2f144a66e26de17b99b539d20f6e5ad
SSDEEP

393216:XlHpZSFSVTVyVSJXSUEJRnpyQnXUWJjv0xamVNA3guo9N:9p0FmyVSNSUE7npyQnkWJjv0DV23o

Score

10^/10

quasar emmassub discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

85.23.24.170:4782

85.23.109.34:4782

82.128.254.93:4782

Mutex

f82c7021-f558-4f6f-bbb3-fbe420c708e5

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
WindowsSecureManager

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\MyFolder\RunMe.exe	family_quasar
behavioral2/memory/1696-85-0x00000000004D0000-0x00000000007F4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3484 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

Update.tmpRunMe.exeRuntimeBroker.exe

pid process

2596 Update.tmp
1696 RunMe.exe
1020 RuntimeBroker.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3484	powershell.exe

Drops file in System32 directory 5 IoCs

Processes:

RuntimeBroker.exeRunMe.exe

description	ioc	process
File opened for modification	C:\Windows\system32\WindowsSecureManager	RuntimeBroker.exe
File created	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager	RunMe.exe
File opened for modification	C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe	RuntimeBroker.exe

Drops file in Program Files directory 8 IoCs

Processes:

Update.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\MyFolder\RunMe.exe	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\creal.exe	Update.tmp
File created	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-TE750.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-G3NH6.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-I24NC.tmp	Update.tmp
File created	C:\Program Files (x86)\MyFolder\is-B9N4J.tmp	Update.tmp
File opened for modification	C:\Program Files (x86)\MyFolder\unins000.dat	Update.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2888 schtasks.exe
2044 schtasks.exe

pid	process
2888	schtasks.exe
2044	schtasks.exe

Modifies registry class 19 IoCs

Processes:

Update.tmp

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\ = "Tst File"	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe\SupportedTypes\.myp	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\DefaultIcon	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\MyFolder\\RunMe.exe,0"	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TstFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\MyFolder\\RunMe.exe\" \"%1\""	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\RunMe.exe\SupportedTypes	Update.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\TstFile.myp\shell\open\command	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	Update.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\RunMe.exe	Update.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\TstFile.myp	Update.tmp

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

Update.tmppowershell.exetaskmgr.exe

pid	process
2596	Update.tmp
2596	Update.tmp
3484	powershell.exe
3484	powershell.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

powershell.exeRunMe.exeRuntimeBroker.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	1696	RunMe.exe
Token: SeDebugPrivilege	1020	RuntimeBroker.exe
Token: SeDebugPrivilege	1164	taskmgr.exe
Token: SeSystemProfilePrivilege	1164	taskmgr.exe
Token: SeCreateGlobalPrivilege	1164	taskmgr.exe
Token: 33	1164	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1164	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

Update.tmptaskmgr.exe

pid	process
2596	Update.tmp
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe
1164	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RuntimeBroker.exe

pid process

1020 RuntimeBroker.exe

pid	process
1020	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Update.exeUpdate.tmpcmd.exeRunMe.exeRuntimeBroker.exe

description	pid	process	target process
PID 668 wrote to memory of 2596	668	Update.exe	Update.tmp
PID 668 wrote to memory of 2596	668	Update.exe	Update.tmp
PID 668 wrote to memory of 2596	668	Update.exe	Update.tmp
PID 2596 wrote to memory of 3664	2596	Update.tmp	cmd.exe
PID 2596 wrote to memory of 3664	2596	Update.tmp	cmd.exe
PID 2596 wrote to memory of 3664	2596	Update.tmp	cmd.exe
PID 3664 wrote to memory of 3484	3664	cmd.exe	powershell.exe
PID 3664 wrote to memory of 3484	3664	cmd.exe	powershell.exe
PID 3664 wrote to memory of 3484	3664	cmd.exe	powershell.exe
PID 2596 wrote to memory of 1696	2596	Update.tmp	RunMe.exe
PID 2596 wrote to memory of 1696	2596	Update.tmp	RunMe.exe
PID 1696 wrote to memory of 2888	1696	RunMe.exe	schtasks.exe
PID 1696 wrote to memory of 2888	1696	RunMe.exe	schtasks.exe
PID 1696 wrote to memory of 1020	1696	RunMe.exe	RuntimeBroker.exe
PID 1696 wrote to memory of 1020	1696	RunMe.exe	RuntimeBroker.exe
PID 1020 wrote to memory of 2044	1020	RuntimeBroker.exe	schtasks.exe
PID 1020 wrote to memory of 2044	1020	RuntimeBroker.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\is-35RJD.tmp\Update.tmp
"C:\Users\Admin\AppData\Local\Temp\is-35RJD.tmp\Update.tmp" /SL5="$501CC,20549816,832512,C:\Users\Admin\AppData\Local\Temp\Update.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\MyFolder\me.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:3664

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionProcess 'C:\WINDOWS\system32\WindowsSecureManager\RuntimeBroker.exe'"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Program Files (x86)\MyFolder\RunMe.exe
"C:\Program Files (x86)\MyFolder\RunMe.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe
"C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\WindowsSecureManager\RuntimeBroker.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:800

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MyFolder\RunMe.exe
Filesize
3.1MB

MD5
392a6ea0718747e4ad443f730047715b

SHA1
808d682efeb32bd7f98e49b7b99350683162059e

SHA256
36be936ba0fc160a314bfaf9be4c8689730ad9c11c3cf6fb7d066c43a934b257

SHA512
b033da7b04a2dc9a342de4970ae1fe26cda4d82bd3fe4a2a2f34507675832912cc6d66456a8a846f75a705523514d4b52bbd120e7b629c3d38467d999d2e95b4

Download Submit
C:\Program Files (x86)\MyFolder\me.bat
Filesize
130B

MD5
0829830a1636e2958b07fc827cb5d3d7

SHA1
6051bfbf49df5f44c41f20104a079a8d0f7acb94

SHA256
b2fce48164d3196f4ec0d85766cb37a9dd12e5a2b478a10583d38c2561616f6b

SHA512
ac40f48729c6b14e3d43c55f46a12584de8e48b74473f8011071d4869fbdfac30aa27f91e73d99584b88c88e02d7a03901a168c3403566fb40c1d3198cf91755

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iyfu3kmx.53y.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-35RJD.tmp\Update.tmp
Filesize
3.1MB

MD5
6a4ac87c4331dc724e6fea16e0ab4b7e

SHA1
3dcab7b5fc73352c01eb24e827626670fa323cec

SHA256
3b9ccf0ba93ecc3640ec5637d3bcfa030c260e6a6222ac7a4bebdd0a91af9a66

SHA512
dc8e3c8a90cd7751f069c5e00c40abbd66a407eeea783829c82242ff9d52fa9389220aed896705dd81911a9d007d3a394cb24c7c3c1e08020bbc2d3c371a9eb6

Download Submit
memory/668-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/668-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/668-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/668-89-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1020-96-0x000000001D170000-0x000000001D1C0000-memory.dmp

Filesize
320KB

Download
memory/1020-97-0x000000001D7C0000-0x000000001D872000-memory.dmp

Filesize
712KB

Download
memory/1020-98-0x000000001E0F0000-0x000000001E618000-memory.dmp

Filesize
5.2MB

Download
memory/1164-109-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-101-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-111-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-110-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-105-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-99-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-100-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-106-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-107-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1164-108-0x000001394C270000-0x000001394C271000-memory.dmp

Filesize
4KB

Download
memory/1696-85-0x00000000004D0000-0x00000000007F4000-memory.dmp

Filesize
3.1MB

Download
memory/2596-65-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-6-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2596-88-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/3484-37-0x00000000060D0000-0x0000000006136000-memory.dmp

Filesize
408KB

Download
memory/3484-53-0x0000000006DC0000-0x0000000006DF2000-memory.dmp

Filesize
200KB

Download
memory/3484-71-0x0000000007B10000-0x0000000007B2A000-memory.dmp

Filesize
104KB

Download
memory/3484-72-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

Filesize
40KB

Download
memory/3484-73-0x0000000007DB0000-0x0000000007E46000-memory.dmp

Filesize
600KB

Download
memory/3484-74-0x0000000007D30000-0x0000000007D41000-memory.dmp

Filesize
68KB

Download
memory/3484-75-0x0000000007D60000-0x0000000007D6E000-memory.dmp

Filesize
56KB

Download
memory/3484-76-0x0000000007D70000-0x0000000007D84000-memory.dmp

Filesize
80KB

Download
memory/3484-77-0x0000000007E70000-0x0000000007E8A000-memory.dmp

Filesize
104KB

Download
memory/3484-78-0x0000000007E50000-0x0000000007E58000-memory.dmp

Filesize
32KB

Download
memory/3484-81-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-69-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-68-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-70-0x0000000008160000-0x00000000087DA000-memory.dmp

Filesize
6.5MB

Download
memory/3484-67-0x00000000079E0000-0x0000000007A83000-memory.dmp

Filesize
652KB

Download
memory/3484-64-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-66-0x00000000079B0000-0x00000000079CE000-memory.dmp

Filesize
120KB

Download
memory/3484-54-0x0000000070260000-0x00000000702AC000-memory.dmp

Filesize
304KB

Download
memory/3484-51-0x0000000006820000-0x000000000686C000-memory.dmp

Filesize
304KB

Download
memory/3484-50-0x00000000067E0000-0x00000000067FE000-memory.dmp

Filesize
120KB

Download
memory/3484-49-0x0000000006220000-0x0000000006574000-memory.dmp

Filesize
3.3MB

Download
memory/3484-48-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-38-0x00000000061B0000-0x0000000006216000-memory.dmp

Filesize
408KB

Download
memory/3484-36-0x0000000005FE0000-0x0000000006002000-memory.dmp

Filesize
136KB

Download
memory/3484-35-0x00000000059B0000-0x0000000005FD8000-memory.dmp

Filesize
6.2MB

Download
memory/3484-34-0x0000000073DB0000-0x0000000074560000-memory.dmp

Filesize
7.7MB

Download
memory/3484-33-0x0000000003240000-0x0000000003276000-memory.dmp

Filesize
216KB

Download
memory/3484-32-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads