sality | b9c3adeb63e6be94b581a68b3b675737501283db663484bfc7e14bdecfc7e940

General

Target

dil.exe
Size

104KB
MD5

1c4eae5ef3e10ce0676618418ea9ed65
SHA1

26e7f992746b0e9b783d360c8cf9e475bd1ce015
SHA256

b9c3adeb63e6be94b581a68b3b675737501283db663484bfc7e14bdecfc7e940
SHA512

d459f72f5403941a7c1666dc91911446ac608faba8cae0a44ab8a2324536ed8db25f5a8c9e80cfcffd09df61a541ba181f94545404e62cf23f5e67e896bc2645
SSDEEP

1536:sKSowsA2YQWZzF90K/m2eMJN6tOwSDW7tyQPjccFl3kvQhMuJlAGGk/l:s1JsACe3uNM6tXb7tyOjtb3OQrEDW

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	dil.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dil.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3016-4-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-7-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-10-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-9-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-8-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-6-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-5-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-3-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-11-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-28-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-27-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-29-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-30-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-31-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-33-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-47-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-49-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-50-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-52-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-55-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-56-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-57-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-60-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-62-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-65-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx
behavioral1/memory/3016-79-0x0000000001CF0000-0x0000000002D7E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	dil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	dil.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dil.exe

description	ioc	process
File opened (read-only)	\??\P:	dil.exe
File opened (read-only)	\??\T:	dil.exe
File opened (read-only)	\??\N:	dil.exe
File opened (read-only)	\??\I:	dil.exe
File opened (read-only)	\??\J:	dil.exe
File opened (read-only)	\??\L:	dil.exe
File opened (read-only)	\??\O:	dil.exe
File opened (read-only)	\??\Q:	dil.exe
File opened (read-only)	\??\U:	dil.exe
File opened (read-only)	\??\E:	dil.exe
File opened (read-only)	\??\K:	dil.exe
File opened (read-only)	\??\M:	dil.exe
File opened (read-only)	\??\V:	dil.exe
File opened (read-only)	\??\W:	dil.exe
File opened (read-only)	\??\X:	dil.exe
File opened (read-only)	\??\Z:	dil.exe
File opened (read-only)	\??\G:	dil.exe
File opened (read-only)	\??\R:	dil.exe
File opened (read-only)	\??\S:	dil.exe
File opened (read-only)	\??\Y:	dil.exe
File opened (read-only)	\??\H:	dil.exe

Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

dil.exe

description ioc process

File opened for modification C:\autorun.inf dil.exe
File opened for modification F:\autorun.inf dil.exe

description	ioc	process
File opened for modification	C:\autorun.inf	dil.exe
File opened for modification	F:\autorun.inf	dil.exe

Drops file in Program Files directory 5 IoCs

Processes:

dil.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	dil.exe

Drops file in Windows directory 1 IoCs

Processes:

dil.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI dil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

dil.exe

pid process

3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe
3016 dil.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	dil.exe

pid	process
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe
3016	dil.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

dil.exe

description	pid	process
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe
Token: SeDebugPrivilege	3016	dil.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

dil.exe

description	pid	process	target process
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1028	3016	dil.exe	DllHost.exe
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE
PID 3016 wrote to memory of 1124	3016	dil.exe	taskhost.exe
PID 3016 wrote to memory of 1184	3016	dil.exe	Dwm.exe
PID 3016 wrote to memory of 1208	3016	dil.exe	Explorer.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\dil.exe
"C:\Users\Admin\AppData\Local\Temp\dil.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3016

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1028

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Modify Registry

5

T1112

Impair Defenses

4

T1562

Disable or Modify Tools

3

T1562.001

Disable or Modify System Firewall

1

T1562.004

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

F:\dggkns.exe
Filesize
100KB

MD5
5bcab855470d6f779af9f696f521b570

SHA1
8d9e69146187ceaff354ec2feaebd98ae7880a14

SHA256
336564064d0de23af06402b841f1bc1a28b11069f3de0bc9994119a46ec64a30

SHA512
bd46b073aa56cd8d56da183adea69b1c60f3566747a7297529528fadb78ccf5186fe3443509dc3127ced46a42d15006205cfebd379501487c5663da479e303a0

Download Submit
memory/1124-12-0x0000000000450000-0x0000000000452000-memory.dmp

Filesize
8KB

Download
memory/3016-29-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-106-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/3016-10-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-31-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-24-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/3016-22-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/3016-21-0x0000000003E50000-0x0000000003E52000-memory.dmp

Filesize
8KB

Download
memory/3016-7-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-8-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-6-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-5-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-3-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-11-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-26-0x0000000003E50000-0x0000000003E52000-memory.dmp

Filesize
8KB

Download
memory/3016-28-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-27-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3016-30-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-9-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-25-0x0000000003E50000-0x0000000003E52000-memory.dmp

Filesize
8KB

Download
memory/3016-44-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/3016-45-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

Filesize
4KB

Download
memory/3016-46-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/3016-47-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-49-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-50-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-52-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-55-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-56-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-57-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-60-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-62-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-65-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-79-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-91-0x0000000003E50000-0x0000000003E52000-memory.dmp

Filesize
8KB

Download
memory/3016-33-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download
memory/3016-4-0x0000000001CF0000-0x0000000002D7E000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads