ramnit | 346c3500bce7c7ed4c1445898a7cc4ed2bf9087bbcd303b512ca2dcbb7eda807

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03502741723690ab02f84fc35802d80b_JaffaCakes118.exe
Size 104KB
Sample240620-gc411awfjp
SHA256 346c3500bce7c7ed4c1445898a7cc4ed2bf9087bbcd303b512ca2dcbb7eda807
MD5 03502741723690ab02f84fc35802d80b
SHA1 1469698c8049c7849543f0ee9a45e254df9b5cd7
SHA512 31cd11b741ee0ff60ed9925cca817f8352b78c3f7e51befd87825d330b12ec6c5b63f72efca5578be67b3926395531ce2bd489c218889d1b5ec79dd530d6d70b
SSDEEP 3072:L4uvdzGfptdgPVKWVzc5jwaaHw7Koj4rR:Opvg8WVzc0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	ntbyrlfiyuhaesxk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3732	1588	WerFault.exe	91
4616	1652	WerFault.exe	100

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2271356640"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113940"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2217919046"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425627045"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AD6BA300-2EC7-11EF-B9F7-D2E65CF77D40} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113940"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113940"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2217919046"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113940"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2345732426"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe
Token: SeDebugPrivilege	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe
Token: SeSecurityPrivilege	4356	ntbyrlfiyuhaesxk.exe
Token: SeLoadDriverPrivilege	4356	ntbyrlfiyuhaesxk.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE
3096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 1588	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	91
PID 4656 wrote to memory of 3216	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	95
PID 4656 wrote to memory of 3216	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	95
PID 4656 wrote to memory of 3216	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	95
PID 3216 wrote to memory of 1752	3216	iexplore.exe	96
PID 3216 wrote to memory of 1752	3216	iexplore.exe	96
PID 1752 wrote to memory of 1252	1752	IEXPLORE.EXE	99
PID 1752 wrote to memory of 1252	1752	IEXPLORE.EXE	99
PID 1752 wrote to memory of 1252	1752	IEXPLORE.EXE	99
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 1652	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	100
PID 4656 wrote to memory of 2868	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	106
PID 4656 wrote to memory of 2868	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	106
PID 4656 wrote to memory of 2868	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	106
PID 2868 wrote to memory of 2080	2868	iexplore.exe	107
PID 2868 wrote to memory of 2080	2868	iexplore.exe	107
PID 1752 wrote to memory of 3096	1752	IEXPLORE.EXE	108
PID 1752 wrote to memory of 3096	1752	IEXPLORE.EXE	108
PID 1752 wrote to memory of 3096	1752	IEXPLORE.EXE	108
PID 4656 wrote to memory of 4356	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	113
PID 4656 wrote to memory of 4356	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	113
PID 4656 wrote to memory of 4356	4656	03502741723690ab02f84fc35802d80b_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\03502741723690ab02f84fc35802d80b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03502741723690ab02f84fc35802d80b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 204
    3⤵
    - Program crash
    PID:3732
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1252
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:82948 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3096
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 204
    3⤵
    - Program crash
    PID:4616
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\ntbyrlfiyuhaesxk.exe
  "C:\Users\Admin\AppData\Local\Temp\ntbyrlfiyuhaesxk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1588 -ip 1588
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1652 -ip 1652
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 009768e52ded8da33ac7d96d521e882eef9765278997f2ce47311f637696d9c7
MD5 a20dcdd581a69f44e7dcbeeab5084fb4
SHA1 61e152b89ab8a04af1843bbfee557d193924ec51
SHA512 77de84bf9c5480e704991bc16d8f555dc10891e3a5a7044fe2b133cc49d20ebb78c68bbdd4c9a4acd8e7424bce28a00bd3651f3b852a2a726f3f879a741cc7ae
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 bc1b55ad0dab8f66faad7c7fa168ae5efcdc8543c742007610b64ebf7dae48c4
MD5 6a1661cf955b88d2adb475cb50674f84
SHA1 bc50f87545f50158aeed2a051827854b96ce7b5e
SHA512 c3a6960bde17f2f1a06d4b59c059b88525d7879c4431a5a8c8a48d3d1a0b52ce24ecbba5df06b040744ea1ce94a3b0a97fdeff241dba4edce518fd5a7636545f
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntbyrlfiyuhaesxk.exe

Path C:\Users\Admin\AppData\Local\Temp\ntbyrlfiyuhaesxk.exe
Size 104KB
SHA256 346c3500bce7c7ed4c1445898a7cc4ed2bf9087bbcd303b512ca2dcbb7eda807
MD5 03502741723690ab02f84fc35802d80b
SHA1 1469698c8049c7849543f0ee9a45e254df9b5cd7
SHA512 31cd11b741ee0ff60ed9925cca817f8352b78c3f7e51befd87825d330b12ec6c5b63f72efca5578be67b3926395531ce2bd489c218889d1b5ec79dd530d6d70b
SSDEEP 3072:L4uvdzGfptdgPVKWVzc5jwaaHw7Koj4rR:Opvg8WVzc0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1588-8-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/1588-9-0x0000000000D10000-0x0000000000D11000-memory.dmp

Download

memory/4356-34-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4356-35-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4356-31-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-16-0x00000000775C2000-0x00000000775C3000-memory.dmp

Download

memory/4656-0-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-17-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-19-0x00000000775C2000-0x00000000775C3000-memory.dmp

Download

memory/4656-11-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4656-29-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4656-28-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-10-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-6-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-4-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/4656-5-0x00000000021B0000-0x00000000021B1000-memory.dmp

Download

memory/4656-2-0x0000000000400000-0x000000000043A060-memory.dmp

Download

memory/4656-1-0x0000000000400000-0x000000000043B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads