darkcomet | 547832a55c6686cae074d6cf038493da2930962fd2c1e4dd176fee4c6d60abbf

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Size

1.7MB
MD5

45c31a6657d85a83a327a9b907843e67
SHA1

db82cb13bbb044eac8cbe2c26e6652c51d84740d
SHA256

547832a55c6686cae074d6cf038493da2930962fd2c1e4dd176fee4c6d60abbf
SHA512

dccef6bde2f5eb79252a64832c72adfcfe728844e28caf3a7be07f1bc3421724ee33bd5bd993513d2fb728b0f0ca47f134738422af7afcd188bc885dd043ecb4
SSDEEP

49152:/JZoQrbTFZY1iaBOkJmZeQvV/AvT6qzL9Uutxr7:/trbTA1SZeQYTFzL9UC7

Score

10^/10

darkcomet latentbot bot guest16 evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1608

Mutex

DC_MUTEX-DD5EEWG

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
1fP8x3gpGubE
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Extracted

Family

darkcomet

Botnet

BOT

kl0w.no-ip.org:1604

mozillaproxy.zapto.org:1604

Mutex

DC_MUTEX-A5603PV

Attributes

gencode
8UDgycR8v6YU
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

mozillaproxy.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4056	attrib.exe
4584	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
3988	file2.exe
4840	msdcsc.exe
4560	msdcsc.exe
2720	file2.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000002344c-20.dat	upx
behavioral2/memory/3988-23-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2720-105-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/2720-110-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-111-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-112-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-113-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-114-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-115-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-116-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-117-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-118-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-119-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-120-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-121-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-122-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-123-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-124-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3988-125-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe"	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msdcsc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe"	msdcsc.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002344f-29.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4032 set thread context of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4840 set thread context of 4560	4840	msdcsc.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4560	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeSecurityPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeBackupPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeRestorePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeShutdownPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeDebugPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeUndockPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: 33	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: 34	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: 35	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: 36	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	3988	file2.exe
Token: SeSecurityPrivilege	3988	file2.exe
Token: SeTakeOwnershipPrivilege	3988	file2.exe
Token: SeLoadDriverPrivilege	3988	file2.exe
Token: SeSystemProfilePrivilege	3988	file2.exe
Token: SeSystemtimePrivilege	3988	file2.exe
Token: SeProfSingleProcessPrivilege	3988	file2.exe
Token: SeIncBasePriorityPrivilege	3988	file2.exe
Token: SeCreatePagefilePrivilege	3988	file2.exe
Token: SeBackupPrivilege	3988	file2.exe
Token: SeRestorePrivilege	3988	file2.exe
Token: SeShutdownPrivilege	3988	file2.exe
Token: SeDebugPrivilege	3988	file2.exe
Token: SeSystemEnvironmentPrivilege	3988	file2.exe
Token: SeChangeNotifyPrivilege	3988	file2.exe
Token: SeRemoteShutdownPrivilege	3988	file2.exe
Token: SeUndockPrivilege	3988	file2.exe
Token: SeManageVolumePrivilege	3988	file2.exe
Token: SeImpersonatePrivilege	3988	file2.exe
Token: SeCreateGlobalPrivilege	3988	file2.exe
Token: 33	3988	file2.exe
Token: 34	3988	file2.exe
Token: 35	3988	file2.exe
Token: 36	3988	file2.exe
Token: SeIncreaseQuotaPrivilege	4560	msdcsc.exe
Token: SeSecurityPrivilege	4560	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4560	msdcsc.exe
Token: SeLoadDriverPrivilege	4560	msdcsc.exe
Token: SeSystemProfilePrivilege	4560	msdcsc.exe
Token: SeSystemtimePrivilege	4560	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4560	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4560	msdcsc.exe
Token: SeCreatePagefilePrivilege	4560	msdcsc.exe
Token: SeBackupPrivilege	4560	msdcsc.exe
Token: SeRestorePrivilege	4560	msdcsc.exe
Token: SeShutdownPrivilege	4560	msdcsc.exe
Token: SeDebugPrivilege	4560	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4560	msdcsc.exe
Token: SeChangeNotifyPrivilege	4560	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4560	msdcsc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3988	file2.exe
4560	msdcsc.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3560	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	86
PID 4032 wrote to memory of 3988	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	87
PID 4032 wrote to memory of 3988	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	87
PID 4032 wrote to memory of 3988	4032	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	87
PID 3560 wrote to memory of 2980	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	88
PID 3560 wrote to memory of 2980	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	88
PID 3560 wrote to memory of 2980	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	88
PID 3560 wrote to memory of 1996	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	89
PID 3560 wrote to memory of 1996	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	89
PID 3560 wrote to memory of 1996	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	89
PID 2980 wrote to memory of 4056	2980	cmd.exe	92
PID 2980 wrote to memory of 4056	2980	cmd.exe	92
PID 2980 wrote to memory of 4056	2980	cmd.exe	92
PID 1996 wrote to memory of 4584	1996	cmd.exe	93
PID 1996 wrote to memory of 4584	1996	cmd.exe	93
PID 1996 wrote to memory of 4584	1996	cmd.exe	93
PID 3560 wrote to memory of 4840	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	94
PID 3560 wrote to memory of 4840	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	94
PID 3560 wrote to memory of 4840	3560	45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe	94
PID 4840 wrote to memory of 4560	4840	msdcsc.exe	95
PID 4840 wrote to memory of 4560	4840	msdcsc.exe	95
PID 4840 wrote to memory of 4560	4840	msdcsc.exe	95
PID 4840 wrote to memory of 4560	4840	msdcsc.exe	95
PID 4840 wrote to memory of 4560	4840	msdcsc.exe	95
PID 4840 wrote to memory of 2720	4840	msdcsc.exe	96
PID 4840 wrote to memory of 2720	4840	msdcsc.exe	96
PID 4840 wrote to memory of 2720	4840	msdcsc.exe	96
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97
PID 4560 wrote to memory of 2892	4560	msdcsc.exe	97

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4056	attrib.exe
4584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\45c31a6657d85a83a327a9b907843e67_JaffaCakes118.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
    "C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\file2.exe
      C:\Users\Admin\AppData\Local\Temp\file2.exe
      4⤵
      Executes dropped EXE
      PID:2720
- C:\Users\Admin\AppData\Local\Temp\file2.exe
  C:\Users\Admin\AppData\Local\Temp\file2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe

Filesize
1.7MB

MD5
45c31a6657d85a83a327a9b907843e67

SHA1
db82cb13bbb044eac8cbe2c26e6652c51d84740d

SHA256
547832a55c6686cae074d6cf038493da2930962fd2c1e4dd176fee4c6d60abbf

SHA512
dccef6bde2f5eb79252a64832c72adfcfe728844e28caf3a7be07f1bc3421724ee33bd5bd993513d2fb728b0f0ca47f134738422af7afcd188bc885dd043ecb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ampere2.dat

Filesize
658KB

MD5
25d38f718beec7710b42aa6f7c943cc7

SHA1
938b4b54c9382d0e32280dfa7af9a3913ae93208

SHA256
f2f6ffd11982ca134735ef6f4a217025182b1ccbed33ade7a772aea2254dbad1

SHA512
3e4e629fdd0b2552bbf3da3456d43019a9845ed7498aea75a425e29925a1d31f18198435423d3b6aded6e97cdad9d9680ee95496f1249a63b963d407337f2761

Download Submit
C:\Users\Admin\AppData\Local\Temp\file2.exe

Filesize
251KB

MD5
a5ad8b98c7926fb36260d646b2a4ac84

SHA1
bdf2b831b7410302a9862b062e5df5ee8d291bb5

SHA256
fff90629f05521a70169667523060bd93f022518054983c889705273e59a2641

SHA512
21fdf907a36d98617f55d81249812ffcd95777da336071926c6a6126eba15ef79a4e0771157d9ec2b78b68af596fcbc2325b76f13f3e69a4f7740aae59547376

Download Submit
memory/2720-105-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2720-110-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2892-106-0x0000000001400000-0x0000000001401000-memory.dmp

Filesize
4KB

Download
memory/3560-8-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/3560-9-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/3560-10-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/3560-11-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/3560-22-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/3560-95-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/3988-27-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3988-116-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-125-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-124-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-123-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-23-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-111-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-112-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-113-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-114-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-115-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-122-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-117-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-118-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-119-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-120-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3988-121-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4560-99-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/4560-100-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/4560-107-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/4560-108-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads