darkcomet | 828bf06da890c926bcfec850972e98ef358b5def95ca47da2c0ab931a6202aab

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Size

758KB
MD5

bad3375c1afb85e12eaa4f872e640c58
SHA1

d279596e7fbc990d2ee51649aa2e4f79bcd51bf1
SHA256

828bf06da890c926bcfec850972e98ef358b5def95ca47da2c0ab931a6202aab
SHA512

ff7c03887def0abf56aca3a814020e8a699fef48b02e5844a1ec7d2c63db847578cf2017cb86f4a5aa19c75e76710f1d0c850c6ffe26b715f90116d463720631
SSDEEP

12288:I3GnbxJJobfq8zKx2p3c9n9X4Lj/Ajiam4KLPzdRnSR5MmB:I21roDz26c9n9oHDC

Score

10^/10

darkcomet discovery evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\iexplorer.exe"	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplorer.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplorer.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2528	attrib.exe
3236	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4456	iexplorer.exe
4120	iexplorer.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplorer = "C:\\Users\\Admin\\AppData\\Roaming\\iexplorer.exe"	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplorer = "C:\\Users\\Admin\\AppData\\Roaming\\iexplorer.exe"	iexplorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 4456 set thread context of 4120	4456	iexplorer.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4120	iexplorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeSecurityPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeBackupPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeRestorePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeShutdownPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeDebugPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeUndockPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: 33	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: 34	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: 35	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: 36	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4120	iexplorer.exe
Token: SeSecurityPrivilege	4120	iexplorer.exe
Token: SeTakeOwnershipPrivilege	4120	iexplorer.exe
Token: SeLoadDriverPrivilege	4120	iexplorer.exe
Token: SeSystemProfilePrivilege	4120	iexplorer.exe
Token: SeSystemtimePrivilege	4120	iexplorer.exe
Token: SeProfSingleProcessPrivilege	4120	iexplorer.exe
Token: SeIncBasePriorityPrivilege	4120	iexplorer.exe
Token: SeCreatePagefilePrivilege	4120	iexplorer.exe
Token: SeBackupPrivilege	4120	iexplorer.exe
Token: SeRestorePrivilege	4120	iexplorer.exe
Token: SeShutdownPrivilege	4120	iexplorer.exe
Token: SeDebugPrivilege	4120	iexplorer.exe
Token: SeSystemEnvironmentPrivilege	4120	iexplorer.exe
Token: SeChangeNotifyPrivilege	4120	iexplorer.exe
Token: SeRemoteShutdownPrivilege	4120	iexplorer.exe
Token: SeUndockPrivilege	4120	iexplorer.exe
Token: SeManageVolumePrivilege	4120	iexplorer.exe
Token: SeImpersonatePrivilege	4120	iexplorer.exe
Token: SeCreateGlobalPrivilege	4120	iexplorer.exe
Token: 33	4120	iexplorer.exe
Token: 34	4120	iexplorer.exe
Token: 35	4120	iexplorer.exe
Token: 36	4120	iexplorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
4456	iexplorer.exe
4120	iexplorer.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 3900 wrote to memory of 1924	3900	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	84
PID 1924 wrote to memory of 4908	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	87
PID 1924 wrote to memory of 4908	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	87
PID 1924 wrote to memory of 4908	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	87
PID 1924 wrote to memory of 544	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	89
PID 1924 wrote to memory of 544	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	89
PID 1924 wrote to memory of 544	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	89
PID 1924 wrote to memory of 4456	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	91
PID 1924 wrote to memory of 4456	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	91
PID 1924 wrote to memory of 4456	1924	bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe	91
PID 4908 wrote to memory of 2528	4908	cmd.exe	92
PID 4908 wrote to memory of 2528	4908	cmd.exe	92
PID 4908 wrote to memory of 2528	4908	cmd.exe	92
PID 544 wrote to memory of 3236	544	cmd.exe	93
PID 544 wrote to memory of 3236	544	cmd.exe	93
PID 544 wrote to memory of 3236	544	cmd.exe	93
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94
PID 4456 wrote to memory of 4120	4456	iexplorer.exe	94

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2528	attrib.exe
3236	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\bad3375c1afb85e12eaa4f872e640c58_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3236
- - C:\Users\Admin\AppData\Roaming\iexplorer.exe
    "C:\Users\Admin\AppData\Roaming\iexplorer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Users\Admin\AppData\Roaming\iexplorer.exe
      4⤵
      Modifies firewall policy service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

Filesize
50B

MD5
b774ae3fb1da087e1f83b4f7b2060e5a

SHA1
97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

SHA256
adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

SHA512
f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

Download Submit
C:\Users\Admin\AppData\Roaming\iexplorer.exe

Filesize
758KB

MD5
bad3375c1afb85e12eaa4f872e640c58

SHA1
d279596e7fbc990d2ee51649aa2e4f79bcd51bf1

SHA256
828bf06da890c926bcfec850972e98ef358b5def95ca47da2c0ab931a6202aab

SHA512
ff7c03887def0abf56aca3a814020e8a699fef48b02e5844a1ec7d2c63db847578cf2017cb86f4a5aa19c75e76710f1d0c850c6ffe26b715f90116d463720631

Download Submit
memory/1924-2-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1924-3-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1924-4-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1924-5-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1924-6-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1924-25-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-37-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-46-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-41-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-40-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-39-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-38-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-35-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-42-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-43-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-44-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-45-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-36-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-47-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-48-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-49-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-50-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-51-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-52-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-53-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-54-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-55-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/4120-56-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads