tofsee | eca59671c5b27920d3194bf8367a55c451a8aa6f78eb0b6dc5400fd0bec9e531

General

Target

0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
Size

10.0MB
MD5

0866bfed4e41dc6490faa8c4d149d42e
SHA1

9f3409b0408c9573beeadd30c4ed7d5c95e7d1d2
SHA256

eca59671c5b27920d3194bf8367a55c451a8aa6f78eb0b6dc5400fd0bec9e531
SHA512

2b3cd6e677751de715c603624e51fa2eec754ec1c75baf5ff303f6e0c64b5d01f5c1290fcae8ec97fb917d52ab7ad5c5a03b07313994b192cd74552e465f1ec6
SSDEEP

49152:CMeuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuH:C

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4860 netsh.exe

pid	process
4860	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\acshugbt\ImagePath = "C:\\Windows\\SysWOW64\\acshugbt\\ltimzxgg.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

3396 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

ltimzxgg.exe

pid process

3160 ltimzxgg.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ltimzxgg.exe

description pid process target process

PID 3160 set thread context of 3396 3160 ltimzxgg.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4968 sc.exe
3680 sc.exe
4360 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3396	svchost.exe

pid	process
3160	ltimzxgg.exe

description	pid	process	target process
PID 3160 set thread context of 3396	3160	ltimzxgg.exe	svchost.exe

pid	process
4968	sc.exe
3680	sc.exe
4360	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 21 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2876	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
4916	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
1384	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
1976	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
5008	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
3756	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
4956	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
2932	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
3996	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
5072	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
4988	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
2900	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
1068	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
3960	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
4348	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
1848	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
4312	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
5084	3084	WerFault.exe	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
2156	3160	WerFault.exe	ltimzxgg.exe
1168	3160	WerFault.exe	ltimzxgg.exe
4892	3160	WerFault.exe	ltimzxgg.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exesvchost.exe0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.execmd.exesc.exesc.exesc.exenetsh.exeltimzxgg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ltimzxgg.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exeltimzxgg.exe

description	pid	process	target process
PID 3084 wrote to memory of 1992	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 1992	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 1992	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 5032	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 5032	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 5032	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	cmd.exe
PID 3084 wrote to memory of 4968	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4968	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4968	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 3680	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 3680	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 3680	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4360	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4360	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4360	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	sc.exe
PID 3084 wrote to memory of 4860	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	netsh.exe
PID 3084 wrote to memory of 4860	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	netsh.exe
PID 3084 wrote to memory of 4860	3084	0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe	netsh.exe
PID 3160 wrote to memory of 3396	3160	ltimzxgg.exe	svchost.exe
PID 3160 wrote to memory of 3396	3160	ltimzxgg.exe	svchost.exe
PID 3160 wrote to memory of 3396	3160	ltimzxgg.exe	svchost.exe
PID 3160 wrote to memory of 3396	3160	ltimzxgg.exe	svchost.exe
PID 3160 wrote to memory of 3396	3160	ltimzxgg.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 588
2⤵
- Program crash
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 736
2⤵
- Program crash
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 796
2⤵
- Program crash
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 832
2⤵
- Program crash
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 980
2⤵
- Program crash
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1000
2⤵
- Program crash
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1020
2⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\acshugbt\
2⤵
- System Location Discovery: System Language Discovery
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 924
2⤵
- Program crash
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 580
2⤵
- Program crash
PID:3996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ltimzxgg.exe" C:\Windows\SysWOW64\acshugbt\
2⤵
- System Location Discovery: System Language Discovery
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 800
2⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 680
2⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create acshugbt binPath= "C:\Windows\SysWOW64\acshugbt\ltimzxgg.exe /d\"C:\Users\Admin\AppData\Local\Temp\0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 924
2⤵
- Program crash
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 800
2⤵
- Program crash
PID:1068

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description acshugbt "wifi internet conection"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1184
2⤵
- Program crash
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 924
2⤵
- Program crash
PID:4348

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start acshugbt
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 572
2⤵
- Program crash
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1148
2⤵
- Program crash
PID:4312

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 580
2⤵
- Program crash
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3084 -ip 3084
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3084 -ip 3084
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3084 -ip 3084
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3084 -ip 3084
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3084 -ip 3084
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3084 -ip 3084
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3084 -ip 3084
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3084 -ip 3084
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3084 -ip 3084
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3084 -ip 3084
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3084 -ip 3084
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3084 -ip 3084
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3084 -ip 3084
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3084 -ip 3084
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3084 -ip 3084
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3084 -ip 3084
1⤵
PID:1596

C:\Windows\SysWOW64\acshugbt\ltimzxgg.exe
C:\Windows\SysWOW64\acshugbt\ltimzxgg.exe /d"C:\Users\Admin\AppData\Local\Temp\0866bfed4e41dc6490faa8c4d149d42e_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 520
2⤵
- Program crash
PID:2156

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 528
2⤵
- Program crash
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 544
2⤵
- Program crash
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3084 -ip 3084
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3084 -ip 3084
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3160 -ip 3160
1⤵
PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3160 -ip 3160
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3160 -ip 3160
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ltimzxgg.exe

Filesize
12.8MB

MD5
e6e358db7794f3e9ecc41b91146a1d36

SHA1
8571bfde65cce451964e2a7d63b83f1ded7e5c8d

SHA256
98b2693dbc2d9f0f3067c797eec6c6ff8a68e6d9e7adad2d41b44a37a9bc0aec

SHA512
ef08a667284644ea5b0a7f284336af6183889045a0ab8813ed6abf4545dac08a6aedfdb1f5018b4513f06cc758697119448cd841cc5e2964a7f7e7fe1a343c33

Download Submit
memory/3084-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/3084-2-0x00000000005C0000-0x00000000005D3000-memory.dmp

Filesize
76KB

Download
memory/3084-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3084-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3084-8-0x00000000005C0000-0x00000000005D3000-memory.dmp

Filesize
76KB

Download
memory/3084-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3160-11-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3160-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3396-12-0x0000000000A30000-0x0000000000A45000-memory.dmp

Filesize
84KB

Download
memory/3396-14-0x0000000000A30000-0x0000000000A45000-memory.dmp

Filesize
84KB

Download
memory/3396-15-0x0000000000A30000-0x0000000000A45000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads