sality | 0ab9b4361d5a9477a10cd5f519dccd4d8051f11e42f68499f4de682b46728d16

General

Target

9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll
Size

120KB
MD5

9da8dc6ea4dff5fc6fd253fb07ea2ad0
SHA1

9e1397bbfe62548dd6848bfe69efde2ca8f82075
SHA256

0ab9b4361d5a9477a10cd5f519dccd4d8051f11e42f68499f4de682b46728d16
SHA512

0c3e5b9f0059b422e0b17dec792f12a10e4df94ad4885e70f682e54752cc767fac0ce7228d82b432125e815bbbb118104abea1ff1699e1f20daec833c5750d70
SSDEEP

3072:LOYquyjQuTEUE9ULBw4oMq/fhr/oEVGx:L1VyEuAj92w4obfhrQyK

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f766a57.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

f766a57.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766a57.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766a57.exe

Executes dropped EXE 3 IoCs

Processes:

f766a57.exef766cd7.exef768508.exe

pid process

3020 f766a57.exe
2636 f766cd7.exe
656 f768508.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

3008 rundll32.exe
3008 rundll32.exe
3008 rundll32.exe
3008 rundll32.exe
3008 rundll32.exe
3008 rundll32.exe

pid	process
3020	f766a57.exe
2636	f766cd7.exe
656	f768508.exe

pid	process
3008	rundll32.exe
3008	rundll32.exe
3008	rundll32.exe
3008	rundll32.exe
3008	rundll32.exe
3008	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3020-11-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-17-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-13-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-20-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-16-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-14-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-18-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-21-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-19-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-15-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-59-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-58-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-60-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-62-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-61-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-64-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-66-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-79-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-80-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-83-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-84-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-102-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-103-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-106-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx
behavioral1/memory/3020-138-0x00000000006F0000-0x00000000017AA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766a57.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766a57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f766a57.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

f766a57.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766a57.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f766a57.exe

description	ioc	process
File opened (read-only)	\??\I:	f766a57.exe
File opened (read-only)	\??\J:	f766a57.exe
File opened (read-only)	\??\K:	f766a57.exe
File opened (read-only)	\??\L:	f766a57.exe
File opened (read-only)	\??\M:	f766a57.exe
File opened (read-only)	\??\O:	f766a57.exe
File opened (read-only)	\??\E:	f766a57.exe
File opened (read-only)	\??\G:	f766a57.exe
File opened (read-only)	\??\H:	f766a57.exe
File opened (read-only)	\??\N:	f766a57.exe

Drops file in Windows directory 2 IoCs

Processes:

f766a57.exe

description ioc process

File created C:\Windows\f766b22 f766a57.exe
File opened for modification C:\Windows\SYSTEM.INI f766a57.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f766a57.exe

pid process

3020 f766a57.exe
3020 f766a57.exe

description	ioc	process
File created	C:\Windows\f766b22	f766a57.exe
File opened for modification	C:\Windows\SYSTEM.INI	f766a57.exe

pid	process
3020	f766a57.exe
3020	f766a57.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f766a57.exe

description	pid	process
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe
Token: SeDebugPrivilege	3020	f766a57.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef766a57.exe

description	pid	process	target process
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 840 wrote to memory of 3008	840	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3020	3008	rundll32.exe	f766a57.exe
PID 3008 wrote to memory of 3020	3008	rundll32.exe	f766a57.exe
PID 3008 wrote to memory of 3020	3008	rundll32.exe	f766a57.exe
PID 3008 wrote to memory of 3020	3008	rundll32.exe	f766a57.exe
PID 3020 wrote to memory of 1096	3020	f766a57.exe	taskhost.exe
PID 3020 wrote to memory of 1152	3020	f766a57.exe	Dwm.exe
PID 3020 wrote to memory of 1192	3020	f766a57.exe	Explorer.EXE
PID 3020 wrote to memory of 804	3020	f766a57.exe	DllHost.exe
PID 3020 wrote to memory of 840	3020	f766a57.exe	rundll32.exe
PID 3020 wrote to memory of 3008	3020	f766a57.exe	rundll32.exe
PID 3020 wrote to memory of 3008	3020	f766a57.exe	rundll32.exe
PID 3008 wrote to memory of 2636	3008	rundll32.exe	f766cd7.exe
PID 3008 wrote to memory of 2636	3008	rundll32.exe	f766cd7.exe
PID 3008 wrote to memory of 2636	3008	rundll32.exe	f766cd7.exe
PID 3008 wrote to memory of 2636	3008	rundll32.exe	f766cd7.exe
PID 3008 wrote to memory of 656	3008	rundll32.exe	f768508.exe
PID 3008 wrote to memory of 656	3008	rundll32.exe	f768508.exe
PID 3008 wrote to memory of 656	3008	rundll32.exe	f768508.exe
PID 3008 wrote to memory of 656	3008	rundll32.exe	f768508.exe
PID 3020 wrote to memory of 1096	3020	f766a57.exe	taskhost.exe
PID 3020 wrote to memory of 1152	3020	f766a57.exe	Dwm.exe
PID 3020 wrote to memory of 1192	3020	f766a57.exe	Explorer.EXE
PID 3020 wrote to memory of 2636	3020	f766a57.exe	f766cd7.exe
PID 3020 wrote to memory of 2636	3020	f766a57.exe	f766cd7.exe
PID 3020 wrote to memory of 656	3020	f766a57.exe	f768508.exe
PID 3020 wrote to memory of 656	3020	f766a57.exe	f768508.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

f766a57.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f766a57.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766a57.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1096

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1152

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008

C:\Users\Admin\AppData\Local\Temp\f766a57.exe
C:\Users\Admin\AppData\Local\Temp\f766a57.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3020

C:\Users\Admin\AppData\Local\Temp\f766cd7.exe
C:\Users\Admin\AppData\Local\Temp\f766cd7.exe
4⤵
- Executes dropped EXE
PID:2636

C:\Users\Admin\AppData\Local\Temp\f768508.exe
C:\Users\Admin\AppData\Local\Temp\f768508.exe
4⤵
- Executes dropped EXE
PID:656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:804

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Modify Registry

5

T1112

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

3

T1562.001

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f766a57.exe
Filesize
97KB

MD5
51de760e39f29cb0c5341463737b351d

SHA1
6fb12948b4e3afc7403c416add8716a56bf085d3

SHA256
cf70535b617a8db4f17448aea1c508739849a7761f8eefde029369344f027872

SHA512
46da291bc8095d366e737807ec30af55c310ccec7405e8204bed9ced25a54a31078a4c014361f60261d64162359b2d94963e3346e7d4670534c11ff2a0826501

Download Submit
memory/656-143-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/656-95-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/656-96-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/656-97-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/656-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1096-22-0x0000000001BC0000-0x0000000001BC2000-memory.dmp

Filesize
8KB

Download
memory/2636-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2636-91-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2636-99-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2636-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2636-98-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/3008-28-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/3008-29-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3008-4-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/3008-10-0x00000000001D0000-0x00000000001E2000-memory.dmp

Filesize
72KB

Download
memory/3008-52-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/3008-37-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3008-55-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/3008-54-0x00000000002B0000-0x00000000002C2000-memory.dmp

Filesize
72KB

Download
memory/3008-73-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/3008-77-0x00000000001D0000-0x00000000001D2000-memory.dmp

Filesize
8KB

Download
memory/3008-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/3020-21-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-84-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-59-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-58-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-60-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-62-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-61-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-64-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-19-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-40-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3020-66-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-18-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-79-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-80-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-83-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-15-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-17-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-53-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/3020-14-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-45-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/3020-16-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-11-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-102-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-103-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-106-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3020-20-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-138-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download
memory/3020-13-0x00000000006F0000-0x00000000017AA000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads