768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d

Analysis

max time kernel
144s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Size

352KB
MD5

5af42ba72a2d6cff62e3073f5e61b13f
SHA1

56c85cbb2ae189e631a6e4fcffde4e424ecdabcd
SHA256

768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d
SHA512

d15f93b2caa785a272c951f8060c8b5cd988a5065b33647c9ebc19c7a7089097ae0e8af7c3e4f9cd57b845b79ec7cb63321c63cd9955fcad3234da863ef74ad1
SSDEEP

6144:2Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:LKofHfHTXQLzgvnzHPowYbvrjD/L7QPs

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000018780-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2984	ctfmen.exe
2780	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
2984	ctfmen.exe
2984	ctfmen.exe
2780	smnss.exe
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\smnss.exe	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\shervans.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File created	C:\Windows\SysWOW64\satornas.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
File created	C:\Windows\SysWOW64\grcopy.dll	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2780	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2984	2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe	30
PID 2372 wrote to memory of 2984	2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe	30
PID 2372 wrote to memory of 2984	2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe	30
PID 2372 wrote to memory of 2984	2372	768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe	30
PID 2984 wrote to memory of 2780	2984	ctfmen.exe	31
PID 2984 wrote to memory of 2780	2984	ctfmen.exe	31
PID 2984 wrote to memory of 2780	2984	ctfmen.exe	31
PID 2984 wrote to memory of 2780	2984	ctfmen.exe	31
PID 2780 wrote to memory of 1088	2780	smnss.exe	32
PID 2780 wrote to memory of 1088	2780	smnss.exe	32
PID 2780 wrote to memory of 1088	2780	smnss.exe	32
PID 2780 wrote to memory of 1088	2780	smnss.exe	32

C:\Users\Admin\AppData\Local\Temp\768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe
"C:\Users\Admin\AppData\Local\Temp\768fa2837f1f7869fc07c4cbb28cbd20ac368983f5c3c63c19788b071ac51c8d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 928
      4⤵
      Loads dropped DLL
      Program crash
      PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
6e4c6dc5dab3a35099116d7ae282fa52

SHA1
1015347353e678b426c6f05d46caab65dc266eec

SHA256
12feb58553c06db0d36ee86a7cdcffe45ecb7ec8ac22a3ba344686b96f4e7dc7

SHA512
e3a2e56c2b8d3cba1d7c5678e8f5a1a513099b7f221ff1b0ca4a5f2559d34ee0400748c55f05134b9be68cdc124cdcb6459aaf93c45c9bba62865cd6eab45847

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
eb9307eb0917ef96cdf9231c27c7509d

SHA1
044c4e3773087fc90e8e3d6812c4b8e151d702a3

SHA256
6ea197fcaf8613800eca6e2f2ae100a41c86fd03bc772dd302c62e24e5df2bff

SHA512
73cf67c4ae6022beaf75e8c214573157b765cd011e8a4285b31eba2d9cf75e9cc852cf216d5b9aed3dace865f7c2e909d972c22fb246191136ba2a9e91028073

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
66730e3020373397920eef29d9e2a08c

SHA1
27c27affb4404a1b754993ac62017e14dca8804f

SHA256
d983c92bf3fc75641f43afd2d2f990069bd4455ef9437f63a87821452d923a06

SHA512
b2678f17ad2c7d5b8695de2d89682867ffdc691e1bb0c3a4358992a968e03f02b645310d1dee25a1327880ed898cb706f626e19109587b6a552839dc3c76a964

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
352KB

MD5
5f477a0fa921eac8dffc4ff43d92d7f4

SHA1
b5bb1fcf01e7863a46587a92bf379391fd653005

SHA256
c8361c036623b45ef3991cc110f1f70b9eed7601502207dbcb10c0617042df26

SHA512
52b40423f3f0edd747a7fc0b9cba2dfeb53981143f8df03565cc29b523d429a33000e4496e7809d16a119d74d180ffc6cc9ad7f7fe08446750d9c2952aed477e

Download Submit
memory/2372-24-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2372-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2372-16-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2372-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2780-33-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2780-42-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2780-45-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2984-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2984-29-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/2984-35-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads