darkcomet | 9cf83059673268289d337054ceeb4af6c6a4165552cf2de4664c28d45f2462b9

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Size

483KB
MD5

d443c691f304ba592dd500c6fdf08bec
SHA1

1f6db40bf02a65dadfad40cb86a587f7b11bb701
SHA256

9cf83059673268289d337054ceeb4af6c6a4165552cf2de4664c28d45f2462b9
SHA512

6021d875e753a9152d7ece0e8856b8481c01be73d26e01869d1315308eef9c22fb377c20b3d829b0531b8672ca3234ab942c34124ba84172a15c81a737155e34
SSDEEP

12288:QaZAPK8kO7CWteq1/NpckaFoBpcd1Qbl4c:QwASE74ObRNg1QT

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Deletes itself 1 IoCs

pid	Process
2748	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
2816	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	notepad.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2492 set thread context of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2912 set thread context of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2816 set thread context of 2328	2816	explorer.exe	35
PID 2328 set thread context of 604	2328	explorer.exe	36

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSecurityPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeBackupPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeRestorePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeShutdownPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeDebugPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeUndockPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 33	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 34	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 35	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	604	explorer.exe
Token: SeSecurityPrivilege	604	explorer.exe
Token: SeTakeOwnershipPrivilege	604	explorer.exe
Token: SeLoadDriverPrivilege	604	explorer.exe
Token: SeSystemProfilePrivilege	604	explorer.exe
Token: SeSystemtimePrivilege	604	explorer.exe
Token: SeProfSingleProcessPrivilege	604	explorer.exe
Token: SeIncBasePriorityPrivilege	604	explorer.exe
Token: SeCreatePagefilePrivilege	604	explorer.exe
Token: SeBackupPrivilege	604	explorer.exe
Token: SeRestorePrivilege	604	explorer.exe
Token: SeShutdownPrivilege	604	explorer.exe
Token: SeDebugPrivilege	604	explorer.exe
Token: SeSystemEnvironmentPrivilege	604	explorer.exe
Token: SeChangeNotifyPrivilege	604	explorer.exe
Token: SeRemoteShutdownPrivilege	604	explorer.exe
Token: SeUndockPrivilege	604	explorer.exe
Token: SeManageVolumePrivilege	604	explorer.exe
Token: SeImpersonatePrivilege	604	explorer.exe
Token: SeCreateGlobalPrivilege	604	explorer.exe
Token: 33	604	explorer.exe
Token: 34	604	explorer.exe
Token: 35	604	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
604	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2492	2100	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	30
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2492 wrote to memory of 2912	2492	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	31
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2884	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2816	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2748	2912	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks BIOS information in registry
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2884
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:2816
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2328
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2880
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GgHsif8eFi8fAef.dll

Filesize
2KB

MD5
86abab3626563fab5e99e64704c422db

SHA1
796f07b6dc34725477fb76ef561bd93f401f18ca

SHA256
32f96309d1f0308381f7bf24376e7b70af563316fe0e641a604a9d7afe4d18ca

SHA512
cd44208604d83b52e3fb55fe5f486d143919f0a1fe5a9aba617b4e8187b573879286f617cca06ea9686fddb56f3fcf9588d629aa2220bda0b5c8e7abd5567501

Download Submit
memory/2492-7-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-13-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-14-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2492-5-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2492-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2816-101-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2816-86-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2884-33-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2884-60-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-21-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-19-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-18-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-17-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-16-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-15-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-30-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-31-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2912-20-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-22-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-28-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2912-25-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads