orcus | 1a740ea5fc256aeac6c2df54d489e502cd2b752c20c09495ff879705f4bf5a0c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9aa350b786356d7d78279e338ccc590N.exe
Size

7.6MB
MD5

a9aa350b786356d7d78279e338ccc590
SHA1

248541c0cac6a66ba81dd8573470a15fd6107ddd
SHA256

1a740ea5fc256aeac6c2df54d489e502cd2b752c20c09495ff879705f4bf5a0c
SHA512

c7c4f3412ec0e027f5230b9912a1c2885c075cfc3cd5836ee21be44a93bf81df9afad7dda12274a29e5607f50a1ddb3290462170098dd53b731a4582d8890ef1
SSDEEP

196608:0N/rsm+cw4nWA4e9p9KGOXvFzYJncZfN/rsm+cw9nWA4e9p9KGOXvFzYJncZwh:0N/rsr4nC0PodYJncpN/rsr9nC0PodYt

Score

10^/10

orcus discovery evasion macro persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

orcus

127.0.0.1:10134

Attributes

autostart_method
Disable
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012282-14.dat	family_orcus

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a9aa350b786356d7d78279e338ccc590N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Synaptics.exe

Orcurs Rat Executable 12 IoCs

resource	yara_rule
behavioral1/memory/2648-4-0x0000000000940000-0x00000000015D1000-memory.dmp	orcus
behavioral1/memory/2648-5-0x0000000000940000-0x00000000015D1000-memory.dmp	orcus
behavioral1/files/0x000b000000012282-14.dat	orcus
behavioral1/memory/2752-25-0x0000000001120000-0x0000000001208000-memory.dmp	orcus
behavioral1/memory/2648-36-0x0000000000940000-0x00000000015D1000-memory.dmp	orcus
behavioral1/memory/1056-44-0x0000000000FC0000-0x0000000001C51000-memory.dmp	orcus
behavioral1/memory/1056-42-0x0000000000FC0000-0x0000000001C51000-memory.dmp	orcus
behavioral1/memory/836-56-0x00000000011F0000-0x00000000012D8000-memory.dmp	orcus
behavioral1/memory/1260-71-0x00000000011C0000-0x00000000012A8000-memory.dmp	orcus
behavioral1/memory/1056-160-0x0000000000FC0000-0x0000000001C51000-memory.dmp	orcus
behavioral1/memory/1056-161-0x0000000000FC0000-0x0000000001C51000-memory.dmp	orcus
behavioral1/memory/1056-197-0x0000000000FC0000-0x0000000001C51000-memory.dmp	orcus

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0005000000019266-104.dat
behavioral1/files/0x0006000000019284-117.dat
behavioral1/files/0x000600000001928c-144.dat
behavioral1/files/0x0009000000019266-155.dat

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a9aa350b786356d7d78279e338ccc590N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a9aa350b786356d7d78279e338ccc590N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Synaptics.exe

Executes dropped EXE 4 IoCs

pid	Process
2752	._cache_a9aa350b786356d7d78279e338ccc590N.exe
1056	Synaptics.exe
836	._cache_Synaptics.exe
1260	Orcus.exe

Loads dropped DLL 6 IoCs

pid	Process
2648	a9aa350b786356d7d78279e338ccc590N.exe
2648	a9aa350b786356d7d78279e338ccc590N.exe
2648	a9aa350b786356d7d78279e338ccc590N.exe
1056	Synaptics.exe
1056	Synaptics.exe
836	._cache_Synaptics.exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2648-0-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/memory/2648-2-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/memory/2648-3-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/memory/2648-4-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/memory/2648-5-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/files/0x0007000000017472-21.dat	themida
behavioral1/memory/1056-38-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/2648-36-0x0000000000940000-0x00000000015D1000-memory.dmp	themida
behavioral1/memory/1056-40-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-39-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-44-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-42-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-160-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-161-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida
behavioral1/memory/1056-197-0x0000000000FC0000-0x0000000001C51000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	a9aa350b786356d7d78279e338ccc590N.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a9aa350b786356d7d78279e338ccc590N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Synaptics.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2648	a9aa350b786356d7d78279e338ccc590N.exe
1056	Synaptics.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Orcus\Orcus.exe.config	._cache_Synaptics.exe
File created	C:\Program Files (x86)\Orcus\Orcus.exe	._cache_Synaptics.exe
File opened for modification	C:\Program Files (x86)\Orcus\Orcus.exe	._cache_Synaptics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9aa350b786356d7d78279e338ccc590N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_a9aa350b786356d7d78279e338ccc590N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Orcus.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1456	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	Orcus.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	Orcus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	Orcus.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1260	Orcus.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1456	EXCEL.EXE
1260	Orcus.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2752	2648	a9aa350b786356d7d78279e338ccc590N.exe	30
PID 2648 wrote to memory of 2752	2648	a9aa350b786356d7d78279e338ccc590N.exe	30
PID 2648 wrote to memory of 2752	2648	a9aa350b786356d7d78279e338ccc590N.exe	30
PID 2648 wrote to memory of 2752	2648	a9aa350b786356d7d78279e338ccc590N.exe	30
PID 2648 wrote to memory of 1056	2648	a9aa350b786356d7d78279e338ccc590N.exe	31
PID 2648 wrote to memory of 1056	2648	a9aa350b786356d7d78279e338ccc590N.exe	31
PID 2648 wrote to memory of 1056	2648	a9aa350b786356d7d78279e338ccc590N.exe	31
PID 2648 wrote to memory of 1056	2648	a9aa350b786356d7d78279e338ccc590N.exe	31
PID 1056 wrote to memory of 836	1056	Synaptics.exe	32
PID 1056 wrote to memory of 836	1056	Synaptics.exe	32
PID 1056 wrote to memory of 836	1056	Synaptics.exe	32
PID 1056 wrote to memory of 836	1056	Synaptics.exe	32
PID 836 wrote to memory of 1260	836	._cache_Synaptics.exe	34
PID 836 wrote to memory of 1260	836	._cache_Synaptics.exe	34
PID 836 wrote to memory of 1260	836	._cache_Synaptics.exe	34
PID 836 wrote to memory of 1260	836	._cache_Synaptics.exe	34

C:\Users\Admin\AppData\Local\Temp\a9aa350b786356d7d78279e338ccc590N.exe
"C:\Users\Admin\AppData\Local\Temp\a9aa350b786356d7d78279e338ccc590N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\._cache_a9aa350b786356d7d78279e338ccc590N.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_a9aa350b786356d7d78279e338ccc590N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Program Files (x86)\Orcus\Orcus.exe
      "C:\Program Files (x86)\Orcus\Orcus.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1260

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Orcus\Orcus.exe.config

Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
7.6MB

MD5
a9aa350b786356d7d78279e338ccc590

SHA1
248541c0cac6a66ba81dd8573470a15fd6107ddd

SHA256
1a740ea5fc256aeac6c2df54d489e502cd2b752c20c09495ff879705f4bf5a0c

SHA512
c7c4f3412ec0e027f5230b9912a1c2885c075cfc3cd5836ee21be44a93bf81df9afad7dda12274a29e5607f50a1ddb3290462170098dd53b731a4582d8890ef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_a9aa350b786356d7d78279e338ccc590N.exe

Filesize
903KB

MD5
f25eb9be765070030a1f2e26deb22abe

SHA1
1cc47835cfe0472b285f891b2e66cc43a14a1ed1

SHA256
1e66f6824062400a6c9a8d7de09c7f3a1fa6b07273d8a97adf332b21b88905d7

SHA512
5e2229f652207812cc61cb4bd5f96fbee071424c5013dc66a70316cf6526460b927dd6595353b89ff5cf6f3653b996df99d11ae1bdebfc84bbe6755cedded6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
22KB

MD5
750769e760c4598365adc494a19a73dc

SHA1
178d97636035229faa7bff2eb63a6b8e7110998a

SHA256
b8e69fd12715236f6e2616b027f3b74688cb10886268b874eaac9e4d4f4cf842

SHA512
7ce0d683e18af45f545d15e06357de7c8109059e64d4b0c6f9f53493af8ac7e25f34c5a983ac4fc0c487940e5745b39e2b291be73f37eb9948e1c08a511926ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
26KB

MD5
b043e7119c34a0c5c37e8d3ee8ab2ff3

SHA1
61093379d310b0fa28ba15c283d807ca762f0e4f

SHA256
6edacddcdc4d02a581fae6b4b125391fe26d21620af4f418464233d74727ea69

SHA512
e6ff93ed382c049857e306022875f5ecffa4868815879fe900114a9dfcd0429460a42701d056133152e0c62d1e43c015b71a05962a0580e678881444847aba12

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
28KB

MD5
f18075103fd67619d35300b0101f0a8e

SHA1
e3f587237ad070b8afceed7c14ac0fad4e628269

SHA256
2ca41bffdcdcecc6c6c999a1a884cf9d90a9176646cf9f18e9df7bac3d6b830e

SHA512
da0df564e2e59ad0c5a57273b2ba8c682a0e6f206997fde3e4a6b5ade33949846eb421027e847ba487af6c76e9abf28118cb36d69355629a3787f885af40d0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
25KB

MD5
9f97489f34ac0e9d61af598165f89798

SHA1
bf3c235ac1c368c06761ac9fdaacab2a6497913e

SHA256
ecdb4745f3b2783e0caf60a4f397b30a3aaa5cfc4107217c6d3939d8fc812f31

SHA512
07a339fd21fdef70de7400685692ac8846646b795ee1b56b48836bfead22c73df019c67f76a4fbf7bfd1f69a431e331325ace006344d3fe3752c51cbdf7469f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\G5y8xZRa.xlsm

Filesize
25KB

MD5
e6152fbcc7b25cd0dec5258d31f77a3b

SHA1
1407015a491cafb6acdfb68587cc97606acd8c3f

SHA256
32cd331b85c617be7e0661c1d3e68219b9f54d867a62eeb0c66de382003d1bbc

SHA512
7f08ab25f6d262f0769d1cdcbd4f4e577a1716ed455c29788dc861e632b2d6c07107d05999338388d8bbd936d232dc50a7954667bf20025fb5a6d2edb22feb26

Download Submit
C:\Users\Admin\Desktop\~$OpenOut.xlsx

Filesize
165B

MD5
ff09371174f7c701e75f357a187c06e8

SHA1
57f9a638fd652922d7eb23236c80055a91724503

SHA256
e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8

SHA512
e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

Download Submit
memory/836-56-0x00000000011F0000-0x00000000012D8000-memory.dmp

Filesize
928KB

Download
memory/836-59-0x0000000000640000-0x0000000000652000-memory.dmp

Filesize
72KB

Download
memory/1056-40-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-162-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/1056-161-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-160-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-197-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-38-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-39-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-44-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-42-0x0000000000FC0000-0x0000000001C51000-memory.dmp

Filesize
12.6MB

Download
memory/1056-50-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/1260-120-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/1260-121-0x0000000000AF0000-0x0000000000B08000-memory.dmp

Filesize
96KB

Download
memory/1260-123-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/1260-71-0x00000000011C0000-0x00000000012A8000-memory.dmp

Filesize
928KB

Download
memory/1456-159-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1456-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2648-34-0x0000000004150000-0x0000000004160000-memory.dmp

Filesize
64KB

Download
memory/2648-4-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2648-0-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2648-35-0x0000000006A70000-0x0000000007701000-memory.dmp

Filesize
12.6MB

Download
memory/2648-1-0x0000000077400000-0x0000000077402000-memory.dmp

Filesize
8KB

Download
memory/2648-2-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2648-12-0x0000000004150000-0x0000000004160000-memory.dmp

Filesize
64KB

Download
memory/2648-6-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2648-5-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2648-3-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2648-36-0x0000000000940000-0x00000000015D1000-memory.dmp

Filesize
12.6MB

Download
memory/2752-43-0x0000000000580000-0x00000000005DC000-memory.dmp

Filesize
368KB

Download
memory/2752-25-0x0000000001120000-0x0000000001208000-memory.dmp

Filesize
928KB

Download
memory/2752-41-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads