modiloader | 43b7d587cb2c56d1736b8e67eadc199aa8487cab43ad4f2bc6914ae1857fb725

General

Target

f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
Size

1.7MB
MD5

f3170806e0287d20298a0034618c7a45
SHA1

05422b6fff5f944e5bb6342e99d2c263e7e46de7
SHA256

43b7d587cb2c56d1736b8e67eadc199aa8487cab43ad4f2bc6914ae1857fb725
SHA512

107472be0c7ba7c5927186de9486e8b63c6b8f107cb5c8075c6623a29a8b6e8694eac38547edeba76ed1024cf916f88f7b730430815518fd3744058ff37d48ac
SSDEEP

49152:q0vOIoFWabTIegQAvEMxRzwtH6IcuQ30PzV4MI:vYWawegQKvEJDcT0p8

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwn32.exe

ModiLoader Second Stage 14 IoCs

resource	yara_rule
behavioral1/memory/2672-62-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-73-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2672-71-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-87-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-90-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-94-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-100-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-106-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-112-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-119-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-125-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-131-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-137-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1316-143-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 4 IoCs

pid	Process
2672	xx.exe
2564	ducsetup.exe
2696	chromeinstall-6u18-rv.exe
1316	mstwn32.exe

Loads dropped DLL 8 IoCs

pid	Process
2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
2564	ducsetup.exe
2564	ducsetup.exe
2564	ducsetup.exe
2672	xx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwn32 = "C:\\Windows\\mstwn32.exe"	mstwn32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwn32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwn32.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000001227e-6.dat	upx
behavioral1/memory/2672-14-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/files/0x0008000000016d0e-15.dat	upx
behavioral1/memory/2564-22-0x0000000000400000-0x00000000005D7000-memory.dmp	upx
behavioral1/memory/2696-31-0x0000000000400000-0x00000000005D2000-memory.dmp	upx
behavioral1/files/0x0008000000016d18-27.dat	upx
behavioral1/memory/2672-62-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2564-74-0x0000000000400000-0x00000000005D7000-memory.dmp	upx
behavioral1/memory/1316-73-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2672-71-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2672-68-0x0000000003010000-0x0000000003060000-memory.dmp	upx
behavioral1/memory/2696-82-0x0000000000400000-0x00000000005D2000-memory.dmp	upx
behavioral1/memory/2696-85-0x0000000000400000-0x00000000005D2000-memory.dmp	upx
behavioral1/memory/1316-87-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-90-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-94-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-100-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-106-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-112-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-119-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-125-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-131-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-137-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1316-143-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\mstwn32.exe	xx.exe
File opened for modification	C:\Windows\mstwn32.exe	xx.exe
File created	C:\Windows\ntdtcstp.dll	mstwn32.exe
File created	C:\Windows\cmsetac.dll	mstwn32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ducsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromeinstall-6u18-rv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwn32.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	chromeinstall-6u18-rv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	chromeinstall-6u18-rv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	ducsetup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	xx.exe
Token: SeBackupPrivilege	792	vssvc.exe
Token: SeRestorePrivilege	792	vssvc.exe
Token: SeAuditPrivilege	792	vssvc.exe
Token: SeDebugPrivilege	1316	mstwn32.exe
Token: SeDebugPrivilege	1316	mstwn32.exe
Token: SeDebugPrivilege	2696	chromeinstall-6u18-rv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1316	mstwn32.exe
1316	mstwn32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2672	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2672	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2672	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2672	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2564	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	31
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2696	2764	f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe	32
PID 2672 wrote to memory of 1316	2672	xx.exe	37
PID 2672 wrote to memory of 1316	2672	xx.exe	37
PID 2672 wrote to memory of 1316	2672	xx.exe	37
PID 2672 wrote to memory of 1316	2672	xx.exe	37

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwn32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3170806e0287d20298a0034618c7a45_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\xx.exe
  "C:\Users\Admin\AppData\Local\Temp\xx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\mstwn32.exe
    "C:\Windows\mstwn32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\xx.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1316
- C:\Users\Admin\AppData\Local\Temp\ducsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\ducsetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\chromeinstall-6u18-rv.exe
  "C:\Users\Admin\AppData\Local\Temp\chromeinstall-6u18-rv.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\jre1.6.0_18\OpenOffice_banner.jpg

Filesize
73KB

MD5
8777484978e7741c0630da2df3127bc3

SHA1
d7a646404a5ddd280ff9bb1e5f0eee749a7fec74

SHA256
3b0e7c69acad31d6404f6bc6124e6f264c856044bce2b30db2ef237ed28a1078

SHA512
2680bc559eab130716dc708560d53e6115825cf05f0f074521ab653bac1bcd7c9ba66a0703710a6c13585275226f88817c852732be667079cbbe93db84848758

Download Submit
C:\Users\Admin\AppData\Local\Temp\chromeinstall-6u18-rv.exe

Filesize
898KB

MD5
331e1435b63bdea7ac24e1217a05809b

SHA1
67447b199445d07f1fe6fd3b464cdbb8a50d2ef1

SHA256
2152d1f7b036ab09d0a354831e5376e93a1db54d3a354b3c23a844f231403cdd

SHA512
9b9780ad36fb7ac07790a0300964bc22c09343a52db39513d016037784f47ad94979ed7a19774678230b11da9d94ae5fa510bf75c32d596ca4beb323dc5e3c18

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
695cbf2cc0ad6756bd0094d784fe78b5

SHA1
62acdf1f09f83c094d861dc181200a96460b36c2

SHA256
a9ffdfcfa2a87f4b903acadc325f08e8cda9d0e82a6c8e41b94de54791a86c74

SHA512
2c3f6df18964d24fd367892cd092e38aa7a8439309f22d1e44a2d4ae30bdbd3bea51dca88d3a690ed008ae0464378dea7b3a7c7fc41b67d933d2d8182fc6a6b9

Download Submit
\Users\Admin\AppData\Local\Temp\ducsetup.exe

Filesize
668KB

MD5
43d3cc91d2078ef1b99c913cb9cfe921

SHA1
63f2655f8852a3341b0b1c8c8ecbea933dc7f25d

SHA256
f46b22b0f4e301123e9901d42a32e3ececa1d7839e99a5af6d6470ee45f15651

SHA512
62db61c009dd036c73c2bcba64d54bb48facac8d0706cbcb91e9125d2618d8d4f89a8175421105767aa5df9621264a5dc3d55b15d54ad88473f25375c75c2eac

Download Submit
\Users\Admin\AppData\Local\Temp\xx.exe

Filesize
109KB

MD5
00311b735e05b1b775ff554eed913675

SHA1
a3e884a2a307060e727ab42825ce3949fa0325df

SHA256
59de2df15c0ed14a677932bf586378563fd60f116587b29ce54f21b0b9f15612

SHA512
b5acfe6f3fea9e9e7da5f77d6bc75753176ba27b8ba2008c9d000f496fff34091f78f61e50e1c2cd905739b96eb9585db19b79fbcca269fb18a9085bcabe1b36

Download Submit
memory/1316-90-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-112-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-143-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-88-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/1316-89-0x0000000002330000-0x000000000233E000-memory.dmp

Filesize
56KB

Download
memory/1316-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-131-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-125-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-119-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-87-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-78-0x0000000002330000-0x000000000233E000-memory.dmp

Filesize
56KB

Download
memory/1316-73-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-106-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-100-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1316-94-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2564-74-0x0000000000400000-0x00000000005D7000-memory.dmp

Filesize
1.8MB

Download
memory/2564-22-0x0000000000400000-0x00000000005D7000-memory.dmp

Filesize
1.8MB

Download
memory/2564-32-0x0000000000DC0000-0x0000000000F97000-memory.dmp

Filesize
1.8MB

Download
memory/2564-33-0x0000000000DC0000-0x0000000000F97000-memory.dmp

Filesize
1.8MB

Download
memory/2564-83-0x0000000000DC0000-0x0000000000F97000-memory.dmp

Filesize
1.8MB

Download
memory/2672-14-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2672-63-0x0000000002120000-0x0000000002130000-memory.dmp

Filesize
64KB

Download
memory/2672-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2672-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2672-70-0x0000000003010000-0x0000000003060000-memory.dmp

Filesize
320KB

Download
memory/2672-68-0x0000000003010000-0x0000000003060000-memory.dmp

Filesize
320KB

Download
memory/2696-81-0x0000000003530000-0x000000000353E000-memory.dmp

Filesize
56KB

Download
memory/2696-82-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/2696-86-0x0000000003530000-0x000000000353E000-memory.dmp

Filesize
56KB

Download
memory/2696-85-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/2696-31-0x0000000000400000-0x00000000005D2000-memory.dmp

Filesize
1.8MB

Download
memory/2764-12-0x0000000002670000-0x00000000026C0000-memory.dmp

Filesize
320KB

Download
memory/2764-11-0x0000000002670000-0x00000000026C0000-memory.dmp

Filesize
320KB

Download
memory/2764-19-0x0000000002CE0000-0x0000000002EB7000-memory.dmp

Filesize
1.8MB

Download
memory/2764-26-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads