xtremerat | 3e97b2fc541b3a23e2fb612f7b272a9619b25cd446e288bbb0a4c94944712513

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe
Size 194KB
Sample240711-ylldpateqd
SHA256 3e97b2fc541b3a23e2fb612f7b272a9619b25cd446e288bbb0a4c94944712513
MD5 3a819e1ce4c18ecce8115195043a0c50
SHA1 462f26db8f151bb0f77882ca788f864c7f767aa6
SHA512 786ece052f1272062cfe060a9e06ec3b8381f8e79c0ec433d5193a928b63c32fa4611f3eaa1befb4d27957b431af0addd9a6456ffba6e88b6daa2f95b74fdd3a
SSDEEP 3072:L3gbjAOEY4TjVzg8252TDH+U0p+Cjey9NxOjCzYsKF8ttY8QoQAEJ0by:T+81Y4TZg8ZH+U0hj19NxECzYBKMq/u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xtremerat evasion persistence rat spyware upx

Malware Config

Extracted

Family

xtremerat

wolfwolf3007.no-ip.org

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000800000002342f-20.dat	family_xtremerat
behavioral2/memory/2712-30-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/2424-31-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat
behavioral2/memory/2712-32-0x0000000010000000-0x0000000010048000-memory.dmp	family_xtremerat

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\abc1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\abc1.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\wolf.exe = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe:*:Enabled:Windows Messanger"	reg.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	abc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe"	abc1.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4195D6B-BE6B-ABD8-EDEA-BFEDAF11B12F}	abc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4195D6B-BE6B-ABD8-EDEA-BFEDAF11B12F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe"	abc1.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{A4195D6B-BE6B-ABD8-EDEA-BFEDAF11B12F}	abc1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{A4195D6B-BE6B-ABD8-EDEA-BFEDAF11B12F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe"	abc1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4116	abc1.exe
2424	abc2.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000002325a-12.dat	upx
behavioral2/memory/4116-18-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-33-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-34-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-36-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-37-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-38-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-40-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-41-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-44-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-45-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-47-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-49-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4116-50-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe"	abc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\wolf.exe"	abc1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4336	2712	WerFault.exe	93
1588	2712	WerFault.exe	93

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4000	reg.exe
5056	reg.exe
1864	reg.exe
3940	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	4116	abc1.exe
Token: SeCreateTokenPrivilege	4116	abc1.exe
Token: SeAssignPrimaryTokenPrivilege	4116	abc1.exe
Token: SeLockMemoryPrivilege	4116	abc1.exe
Token: SeIncreaseQuotaPrivilege	4116	abc1.exe
Token: SeMachineAccountPrivilege	4116	abc1.exe
Token: SeTcbPrivilege	4116	abc1.exe
Token: SeSecurityPrivilege	4116	abc1.exe
Token: SeTakeOwnershipPrivilege	4116	abc1.exe
Token: SeLoadDriverPrivilege	4116	abc1.exe
Token: SeSystemProfilePrivilege	4116	abc1.exe
Token: SeSystemtimePrivilege	4116	abc1.exe
Token: SeProfSingleProcessPrivilege	4116	abc1.exe
Token: SeIncBasePriorityPrivilege	4116	abc1.exe
Token: SeCreatePagefilePrivilege	4116	abc1.exe
Token: SeCreatePermanentPrivilege	4116	abc1.exe
Token: SeBackupPrivilege	4116	abc1.exe
Token: SeRestorePrivilege	4116	abc1.exe
Token: SeShutdownPrivilege	4116	abc1.exe
Token: SeDebugPrivilege	4116	abc1.exe
Token: SeAuditPrivilege	4116	abc1.exe
Token: SeSystemEnvironmentPrivilege	4116	abc1.exe
Token: SeChangeNotifyPrivilege	4116	abc1.exe
Token: SeRemoteShutdownPrivilege	4116	abc1.exe
Token: SeUndockPrivilege	4116	abc1.exe
Token: SeSyncAgentPrivilege	4116	abc1.exe
Token: SeEnableDelegationPrivilege	4116	abc1.exe
Token: SeManageVolumePrivilege	4116	abc1.exe
Token: SeImpersonatePrivilege	4116	abc1.exe
Token: SeCreateGlobalPrivilege	4116	abc1.exe
Token: 31	4116	abc1.exe
Token: 32	4116	abc1.exe
Token: 33	4116	abc1.exe
Token: 34	4116	abc1.exe
Token: 35	4116	abc1.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4116	abc1.exe
4116	abc1.exe
4116	abc1.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4116	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	85
PID 2920 wrote to memory of 4116	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	85
PID 2920 wrote to memory of 4116	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	85
PID 2920 wrote to memory of 2424	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	86
PID 2920 wrote to memory of 2424	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	86
PID 2920 wrote to memory of 2424	2920	3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe	86
PID 4116 wrote to memory of 792	4116	abc1.exe	87
PID 4116 wrote to memory of 792	4116	abc1.exe	87
PID 4116 wrote to memory of 792	4116	abc1.exe	87
PID 4116 wrote to memory of 5100	4116	abc1.exe	88
PID 4116 wrote to memory of 5100	4116	abc1.exe	88
PID 4116 wrote to memory of 5100	4116	abc1.exe	88
PID 4116 wrote to memory of 4276	4116	abc1.exe	89
PID 4116 wrote to memory of 4276	4116	abc1.exe	89
PID 4116 wrote to memory of 4276	4116	abc1.exe	89
PID 4116 wrote to memory of 3004	4116	abc1.exe	90
PID 4116 wrote to memory of 3004	4116	abc1.exe	90
PID 4116 wrote to memory of 3004	4116	abc1.exe	90
PID 2424 wrote to memory of 2712	2424	abc2.exe	93
PID 2424 wrote to memory of 2712	2424	abc2.exe	93
PID 2424 wrote to memory of 2712	2424	abc2.exe	93
PID 3004 wrote to memory of 4000	3004	cmd.exe	96
PID 3004 wrote to memory of 4000	3004	cmd.exe	96
PID 3004 wrote to memory of 4000	3004	cmd.exe	96
PID 2424 wrote to memory of 2712	2424	abc2.exe	93
PID 2424 wrote to memory of 5072	2424	abc2.exe	97
PID 2424 wrote to memory of 5072	2424	abc2.exe	97
PID 792 wrote to memory of 5056	792	cmd.exe	98
PID 792 wrote to memory of 5056	792	cmd.exe	98
PID 792 wrote to memory of 5056	792	cmd.exe	98
PID 5100 wrote to memory of 3940	5100	cmd.exe	100
PID 5100 wrote to memory of 3940	5100	cmd.exe	100
PID 5100 wrote to memory of 3940	5100	cmd.exe	100
PID 4276 wrote to memory of 1864	4276	cmd.exe	101
PID 4276 wrote to memory of 1864	4276	cmd.exe	101
PID 4276 wrote to memory of 1864	4276	cmd.exe	101
PID 2424 wrote to memory of 5072	2424	abc2.exe	97

C:\Users\Admin\AppData\Local\Temp\3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Local\Temp\abc1.exe
  "C:\Users\Admin\AppData\Local\Temp\abc1.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\abc1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\abc1.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\abc1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\abc1.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\wolf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\wolf.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\wolf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\wolf.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4000
- C:\Users\Admin\AppData\Local\Temp\abc2.exe
  "C:\Users\Admin\AppData\Local\Temp\abc2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    PID:2712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 484
      4⤵
      Program crash
      PID:4336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 492
      4⤵
      Program crash
      PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2712 -ip 2712
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2712 -ip 2712
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abc1.exe

Path C:\Users\Admin\AppData\Local\Temp\abc1.exe
Size 113KB
SHA256 0ba4cbfab6470cdf91b616be53af002a6d99329abc45371e63dfc39493a2f0f6
MD5 82805e4f9baddb787a2f94635c47e4a3
SHA1 fac7ba94e0d2ce74da1219753847f6bcbde80df5
SHA512 9d41d79a812a5620515e4f27584c91bb116678111458e91ce361fb31f4f4cbb4383a6861333bf19be18a76b5620827a1220c8a4e7d2c355af38588d13ebb2681
SSDEEP 3072:xOEY4TjVzg8252TDH+U0p+Cjey9NxOjCzYsKF8t:x1Y4TZg8ZH+U0hj19NxECzYBK
MD5 SHA1 SHA512 SSDEEP

Submit Download

abc2.exe

Path C:\Users\Admin\AppData\Local\Temp\abc2.exe
Size 65KB
SHA256 e4fc7a02a191853604cc170c97b05e12eb4d8bb468aeecff1b5a6690fd7bcaf6
MD5 c2a608b49ee909733839cb54a07ecffa
SHA1 cc8dac87a9c71fab0468cd66a399a73004ea745c
SHA512 518eb069fcbcac2c504dd3c73840acdc950ee3911d0a852139e58fac3650a889fa17722588b71d51180fab6e6e36b463fdff28b1792c91d8d56f5f5a9ab32eaa
SSDEEP 768:d9m1Sq4NQkrBsH1U8z05DeeQuMVTyN8ipHo37Vmd6AeXVtWAJ7A+7voNwdSOB+K1:asq+Q1aZQuIyJp0mgA+FJ0LNwUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2424-31-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/2712-32-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/2712-30-0x0000000010000000-0x0000000010048000-memory.dmp

Download

memory/2920-6-0x0000000001570000-0x0000000001578000-memory.dmp

Download

memory/2920-1-0x000000001BB90000-0x000000001BC36000-memory.dmp

Download

memory/2920-7-0x000000001C830000-0x000000001C87C000-memory.dmp

Download

memory/2920-5-0x00007FFD25520000-0x00007FFD25EC1000-memory.dmp

Download

memory/2920-0-0x00007FFD257D5000-0x00007FFD257D6000-memory.dmp

Download

memory/2920-4-0x000000001C710000-0x000000001C7AC000-memory.dmp

Download

memory/2920-29-0x00007FFD25520000-0x00007FFD25EC1000-memory.dmp

Download

memory/2920-3-0x000000001C1A0000-0x000000001C66E000-memory.dmp

Download

memory/2920-2-0x00007FFD25520000-0x00007FFD25EC1000-memory.dmp

Download

memory/4116-34-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-33-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-18-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-36-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-37-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-38-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-40-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-41-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-44-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-45-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-47-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-49-0x0000000000400000-0x000000000045D000-memory.dmp

Download

memory/4116-50-0x0000000000400000-0x000000000045D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads