latrodectus | c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf

General

Target

merd.msi
Size

2.0MB
MD5

309abcad11b67d2498cf87c4e10ff30f
SHA1

0d805a684b889846a7b00cecc0ee84c7cf93398d
SHA256

c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
SHA512

0f0c0f4a04ae65532a7f4c197ca22c371d904a5b3055e14bd537a3c092d8b4526a597564019395ed0b05d4ffbc6d9b450a8d267de3906f88ac2d320f9c75bdd9
SSDEEP

49152:ecS3YhW8zBQSc0ZnSKBZKumZr7AQkojSo0kzI8ZVE6VPbe:sYY0Zn3K/AQz3Tbx56

Score

10^/10

latrodectus discovery loader persistence privilege_escalation

Malware Config

Extracted

Family

latrodectus

C2

https://bestmarsgood.com/test/

https://cerwintifed.com/test/

Signatures

Detects Latrodectus 6 IoCs

Detects Latrodectus v1.4.

Processes:

resource	yara_rule
behavioral2/memory/4844-61-0x00007FF415260000-0x00007FF415275000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/4844-61-0x00007FF415260000-0x00007FF415275000-memory.dmp	Latrodectus14
behavioral2/memory/3692-66-0x00000000013F0000-0x0000000001405000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/3692-66-0x00000000013F0000-0x0000000001405000-memory.dmp	Latrodectus14
behavioral2/memory/3692-67-0x00000000013F0000-0x0000000001405000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/3692-67-0x00000000013F0000-0x0000000001405000-memory.dmp	Latrodectus14

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Blocklisted process makes network request 12 IoCs

Processes:

rundll32.exe

flow	pid	process
35	4844	rundll32.exe
37	4844	rundll32.exe
39	4844	rundll32.exe
40	4844	rundll32.exe
54	4844	rundll32.exe
60	4844	rundll32.exe
65	4844	rundll32.exe
70	4844	rundll32.exe
77	4844	rundll32.exe
78	4844	rundll32.exe
79	4844	rundll32.exe
80	4844	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e57bcc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC018.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC122.tmp	msiexec.exe
File created	C:\Windows\Installer\e57bcc8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEEE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F51335B5-861E-4317-91B1-6EA78A6DECF1}	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSIC122.tmp

pid process

4332 MSIC122.tmp
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

1108 MsiExec.exe
1108 MsiExec.exe
1108 MsiExec.exe
1108 MsiExec.exe
5068 rundll32.exe
4844 rundll32.exe
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2028 msiexec.exe

pid	process
4332	MSIC122.tmp

pid	process
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
1108	MsiExec.exe
5068	rundll32.exe
4844	rundll32.exe

pid	process
2028	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMSIC122.tmprundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIC122.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006b382b850f3dc2e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006b382b850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006b382b85000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6b382b85000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006b382b8500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msiexec.exerundll32.exe

pid	process
216	msiexec.exe
216	msiexec.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe
4844	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exeExplorer.EXE

description	pid	process
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	216	msiexec.exe
Token: SeCreateTokenPrivilege	2028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2028	msiexec.exe
Token: SeLockMemoryPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeMachineAccountPrivilege	2028	msiexec.exe
Token: SeTcbPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	2028	msiexec.exe
Token: SeTakeOwnershipPrivilege	2028	msiexec.exe
Token: SeLoadDriverPrivilege	2028	msiexec.exe
Token: SeSystemProfilePrivilege	2028	msiexec.exe
Token: SeSystemtimePrivilege	2028	msiexec.exe
Token: SeProfSingleProcessPrivilege	2028	msiexec.exe
Token: SeIncBasePriorityPrivilege	2028	msiexec.exe
Token: SeCreatePagefilePrivilege	2028	msiexec.exe
Token: SeCreatePermanentPrivilege	2028	msiexec.exe
Token: SeBackupPrivilege	2028	msiexec.exe
Token: SeRestorePrivilege	2028	msiexec.exe
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeDebugPrivilege	2028	msiexec.exe
Token: SeAuditPrivilege	2028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2028	msiexec.exe
Token: SeChangeNotifyPrivilege	2028	msiexec.exe
Token: SeRemoteShutdownPrivilege	2028	msiexec.exe
Token: SeUndockPrivilege	2028	msiexec.exe
Token: SeSyncAgentPrivilege	2028	msiexec.exe
Token: SeEnableDelegationPrivilege	2028	msiexec.exe
Token: SeManageVolumePrivilege	2028	msiexec.exe
Token: SeImpersonatePrivilege	2028	msiexec.exe
Token: SeCreateGlobalPrivilege	2028	msiexec.exe
Token: SeBackupPrivilege	240	vssvc.exe
Token: SeRestorePrivilege	240	vssvc.exe
Token: SeAuditPrivilege	240	vssvc.exe
Token: SeBackupPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeRestorePrivilege	216	msiexec.exe
Token: SeTakeOwnershipPrivilege	216	msiexec.exe
Token: SeBackupPrivilege	2676	srtasks.exe
Token: SeRestorePrivilege	2676	srtasks.exe
Token: SeSecurityPrivilege	2676	srtasks.exe
Token: SeTakeOwnershipPrivilege	2676	srtasks.exe
Token: SeBackupPrivilege	2676	srtasks.exe
Token: SeRestorePrivilege	2676	srtasks.exe
Token: SeSecurityPrivilege	2676	srtasks.exe
Token: SeTakeOwnershipPrivilege	2676	srtasks.exe
Token: SeShutdownPrivilege	3692	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2028 msiexec.exe
2028 msiexec.exe

pid	process
2028	msiexec.exe
2028	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msiexec.exerundll32.exerundll32.exe

description	pid	process	target process
PID 216 wrote to memory of 2676	216	msiexec.exe	srtasks.exe
PID 216 wrote to memory of 2676	216	msiexec.exe	srtasks.exe
PID 216 wrote to memory of 1108	216	msiexec.exe	MsiExec.exe
PID 216 wrote to memory of 1108	216	msiexec.exe	MsiExec.exe
PID 216 wrote to memory of 1108	216	msiexec.exe	MsiExec.exe
PID 216 wrote to memory of 4332	216	msiexec.exe	MSIC122.tmp
PID 216 wrote to memory of 4332	216	msiexec.exe	MSIC122.tmp
PID 216 wrote to memory of 4332	216	msiexec.exe	MSIC122.tmp
PID 5068 wrote to memory of 4844	5068	rundll32.exe	rundll32.exe
PID 5068 wrote to memory of 4844	5068	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 3692	4844	rundll32.exe	Explorer.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\merd.msi
  2⤵
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4844

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D6420FB5EBED4EFF16221BF26A37B2A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1108
- C:\Windows\Installer\MSIC122.tmp
  "C:\Windows\Installer\MSIC122.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57bccb.rbs

Filesize
1KB

MD5
1fd22be2640a1e3c515abead07569e88

SHA1
cdb3dcb981882f854d40ab627548c364a3187ae2

SHA256
b52623abc3e24479ba7c1acb663e3b59f4822d936a74dfd08fe8f922d3bb120d

SHA512
bafc979aa3fd1f0a38b8285ea373e465682b80f78d253c2595c13a3193f8b9f3e89d9a68384a28ce0e8d2b2777060fc92b26cf9e6c7c2f934d56a67fc2151332

Download Submit
C:\Users\Admin\AppData\Roaming\sqx.dll

Filesize
1.3MB

MD5
dd862590d9e4ea1791df147912ae4c8f

SHA1
852d7a9ea4db5ff4cd51a92447a8d5701cfb322b

SHA256
14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184

SHA512
3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568

Download Submit
C:\Windows\Installer\MSIBD26.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIC122.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.9MB

MD5
f0a04952f9732e6ee769be35985a63a9

SHA1
ba21c70fcf8d83d285da5176dde2451d3e94d326

SHA256
0bbc788ebc4b8165a9a9f56dc8266a816a117459bd046549d481dfab2b16fa79

SHA512
39a72e8b135341ad969d5c6e3ae790346b34fd4af8fdbb3354b27cf5c1f7c982538610c08cd507acfc4cf0a00e8c38c4517c6ce8117e62290e3c1c35aed73cff

Download Submit
\??\Volume{852b386b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d7dcfaef-2c42-4d1d-ab2a-a6e5c73717cc}_OnDiskSnapshotProp

Filesize
6KB

MD5
9a9f949457f14f16bf729c03fded813f

SHA1
461716cd6822b6cf00dd4f10609d518275ba1cc5

SHA256
f211945c951dadc291e9fb224a06c1b252f19986c9f03e0dacf376a302d5e7ba

SHA512
6a2115e7eab2752935a05e54fe5f09bf8496edfb01baaddf69441293c9b05fa6bc19fd75ec59a43913ccfe4417a7f962e61c90935f44dcfc116015f9a604a074

Download Submit
memory/3692-67-0x00000000013F0000-0x0000000001405000-memory.dmp

Filesize
84KB

Download
memory/3692-66-0x00000000013F0000-0x0000000001405000-memory.dmp

Filesize
84KB

Download
memory/4844-45-0x0000021315350000-0x000002131539C000-memory.dmp

Filesize
304KB

Download
memory/4844-64-0x00007FF415230000-0x00007FF415231000-memory.dmp

Filesize
4KB

Download
memory/4844-62-0x00007FF415250000-0x00007FF415251000-memory.dmp

Filesize
4KB

Download
memory/4844-60-0x00007FF415280000-0x00007FF415281000-memory.dmp

Filesize
4KB

Download
memory/4844-65-0x00007FF415220000-0x00007FF415221000-memory.dmp

Filesize
4KB

Download
memory/4844-63-0x00007FF415240000-0x00007FF415241000-memory.dmp

Filesize
4KB

Download
memory/4844-61-0x00007FF415260000-0x00007FF415275000-memory.dmp

Filesize
84KB

Download
memory/4844-72-0x0000021315350000-0x000002131539C000-memory.dmp

Filesize
304KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads