gozi | 2140eb8fb75c67eb1a7ab305c07dd6bb1bc97fafda4b6632e5e7a58bb077f497

General

Target

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
Size

412KB
MD5

7d62e1b94f471c3d0dc01af8ef1070f2
SHA1

e49e8ba2aa87edf578ce603fc186b89e5f8ddfc3
SHA256

2140eb8fb75c67eb1a7ab305c07dd6bb1bc97fafda4b6632e5e7a58bb077f497
SHA512

8e953a842749bfebd81bb0785b733d5b3330fa4b265eecf0f01422d2d661ce6b7808f617aae5dcc908f3853bc5b74baa86537f7d5860f331f3a4e9bbef0ac59b
SSDEEP

6144:2rKd/9yO8EJKdRWWyU/PgJoK01tDWUej3dc9YJTVK1GHzbAW0tOpOZibXPU/gC9Z:zdl7iutsClIqSYhjKT7x/++U0Zdd

Score

10^/10

gozi banker discovery isfb spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
l2mymom#

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Detected Nirsoft tools 4 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/528-22-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral2/memory/184-27-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/184-29-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4664-37-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

winlogon.exe

pid process

3028 winlogon.exe
Executes dropped EXE 4 IoCs

Processes:

Java Update.exeWindows Defender.exeMicrosoft_Update.exewinlogon.exe

pid process

528 Java Update.exe
184 Windows Defender.exe
4664 Microsoft_Update.exe
3028 winlogon.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3028	winlogon.exe

pid	process
528	Java Update.exe
184	Windows Defender.exe
4664	Microsoft_Update.exe
3028	winlogon.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Java Update.exe	upx
behavioral2/memory/528-19-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/528-22-0x0000000000400000-0x0000000000425000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe	upx
behavioral2/memory/184-27-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/184-29-0x0000000000400000-0x000000000041B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe	upx
behavioral2/memory/4664-37-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Drops desktop.ini file(s) 2 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 whatismyip.com

flow	ioc
17	whatismyip.com

Drops file in System32 directory 11 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

description	ioc	process
File created	C:\WINDOWS\system32\explorer\winlogon.exe.exe	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\winlogon.exe.exe	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File created	C:\WINDOWS\system32\explorer\melt.txt	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\melt.txt	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\pic\Img%.jpeg	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File created	C:\Windows\System32\explorer\Windows Update.exe	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File created	C:\WINDOWS\System32\explorer\Decrypt.txt	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File created	C:\WINDOWS\System32\explorer\cd.txt	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\explorer\Windows Update.exe	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\system32\explorer\winlogon.exe	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File created	C:\Windows\assembly\Desktop.ini	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Java Update.exeWindows Defender.exeMicrosoft_Update.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Java Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft_Update.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exeJava Update.exewinlogon.exe

pid	process
3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
528	Java Update.exe
528	Java Update.exe
3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe
3028	winlogon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exeJava Update.exeWindows Defender.exewinlogon.exe

description	pid	process
Token: SeDebugPrivilege	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
Token: 33	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
Token: SeDebugPrivilege	528	Java Update.exe
Token: SeDebugPrivilege	184	Windows Defender.exe
Token: SeRestorePrivilege	184	Windows Defender.exe
Token: SeBackupPrivilege	184	Windows Defender.exe
Token: SeDebugPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe
Token: 33	3028	winlogon.exe
Token: SeIncBasePriorityPrivilege	3028	winlogon.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe

description	pid	process	target process
PID 3200 wrote to memory of 528	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Java Update.exe
PID 3200 wrote to memory of 528	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Java Update.exe
PID 3200 wrote to memory of 528	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Java Update.exe
PID 3200 wrote to memory of 184	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Windows Defender.exe
PID 3200 wrote to memory of 184	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Windows Defender.exe
PID 3200 wrote to memory of 184	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Windows Defender.exe
PID 3200 wrote to memory of 4664	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Microsoft_Update.exe
PID 3200 wrote to memory of 4664	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Microsoft_Update.exe
PID 3200 wrote to memory of 4664	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	Microsoft_Update.exe
PID 3200 wrote to memory of 3028	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	winlogon.exe
PID 3200 wrote to memory of 3028	3200	7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7d62e1b94f471c3d0dc01af8ef1070f2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200

C:\Users\Admin\AppData\Local\Temp\Java Update.exe
"C:\Users\Admin\AppData\Local\Temp\Java Update.exe" /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe" /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:184

C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe
C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\WINDOWS\system32\explorer\winlogon.exe
C:\WINDOWS\system32\explorer\winlogon.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ChromePass.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Java Update.exe

Filesize
63KB

MD5
fbb93d4c91453b06414d6973152d904e

SHA1
4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

SHA256
8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

SHA512
4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Update.exe

Filesize
125KB

MD5
9b3b1c0db965166319469b2afa6c4f0c

SHA1
9f1e65a3056dff872949329c4e5e70c007cc5621

SHA256
dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

SHA512
c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe

Filesize
42KB

MD5
28c110b8d0ad095131c8d06043678086

SHA1
c684cf321e890e0e766a97609a4cde866156d6c5

SHA256
dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

SHA512
065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

Download Submit
C:\WINDOWS\system32\explorer\melt.txt

Filesize
86B

MD5
59a761c211a2111802550482d5d26d0e

SHA1
b12c3fdc250696d634aa546d4a9c3e853ef61ba7

SHA256
68bdc4a244f3b984ec14cc13e539eaaef03df9e010eb2b4c9d333e307e93dfb1

SHA512
ff1d90d199e258c84b524d5be2aab9650146a2c422badaa98aba0736559e199fce666d4772d8f261116aaab72fdbbae7f395d90a8e1ad9b01cbe6d780dca1751

Download Submit
C:\Windows\System32\explorer\winlogon.exe

Filesize
412KB

MD5
7d62e1b94f471c3d0dc01af8ef1070f2

SHA1
e49e8ba2aa87edf578ce603fc186b89e5f8ddfc3

SHA256
2140eb8fb75c67eb1a7ab305c07dd6bb1bc97fafda4b6632e5e7a58bb077f497

SHA512
8e953a842749bfebd81bb0785b733d5b3330fa4b265eecf0f01422d2d661ce6b7808f617aae5dcc908f3853bc5b74baa86537f7d5860f331f3a4e9bbef0ac59b

Download Submit
C:\Windows\System32\explorer\winlogon.exe.exe

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
memory/184-29-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/184-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/528-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/528-19-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3200-7-0x000000001C580000-0x000000001C5CC000-memory.dmp

Filesize
304KB

Download
memory/3200-5-0x000000001C370000-0x000000001C40C000-memory.dmp

Filesize
624KB

Download
memory/3200-13-0x000000001DF60000-0x000000001DFA0000-memory.dmp

Filesize
256KB

Download
memory/3200-11-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-10-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-9-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-8-0x000000001C930000-0x000000001C992000-memory.dmp

Filesize
392KB

Download
memory/3200-0-0x00007FFE9EB85000-0x00007FFE9EB86000-memory.dmp

Filesize
4KB

Download
memory/3200-6-0x0000000001070000-0x0000000001078000-memory.dmp

Filesize
32KB

Download
memory/3200-12-0x000000001F340000-0x000000001F64E000-memory.dmp

Filesize
3.1MB

Download
memory/3200-1-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-4-0x000000001C220000-0x000000001C2C6000-memory.dmp

Filesize
664KB

Download
memory/3200-38-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-39-0x00007FFE9EB85000-0x00007FFE9EB86000-memory.dmp

Filesize
4KB

Download
memory/3200-3-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/3200-2-0x000000001BD50000-0x000000001C21E000-memory.dmp

Filesize
4.8MB

Download
memory/3200-64-0x00007FFE9E8D0000-0x00007FFE9F271000-memory.dmp

Filesize
9.6MB

Download
memory/4664-37-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads