darkcomet | 9cf83059673268289d337054ceeb4af6c6a4165552cf2de4664c28d45f2462b9

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Size

483KB
MD5

d443c691f304ba592dd500c6fdf08bec
SHA1

1f6db40bf02a65dadfad40cb86a587f7b11bb701
SHA256

9cf83059673268289d337054ceeb4af6c6a4165552cf2de4664c28d45f2462b9
SHA512

6021d875e753a9152d7ece0e8856b8481c01be73d26e01869d1315308eef9c22fb377c20b3d829b0531b8672ca3234ab942c34124ba84172a15c81a737155e34
SSDEEP

12288:QaZAPK8kO7CWteq1/NpckaFoBpcd1Qbl4c:QwASE74ObRNg1QT

Score

10^/10

darkcomet discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Deletes itself 1 IoCs

pid	Process
2288	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
3952	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	notepad.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 1904 set thread context of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 3676 set thread context of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3952 set thread context of 3644	3952	explorer.exe	89
PID 3644 set thread context of 2920	3644	explorer.exe	90

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSecurityPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeBackupPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeRestorePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeShutdownPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeDebugPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeUndockPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 33	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 34	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 35	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: 36	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2920	explorer.exe
Token: SeSecurityPrivilege	2920	explorer.exe
Token: SeTakeOwnershipPrivilege	2920	explorer.exe
Token: SeLoadDriverPrivilege	2920	explorer.exe
Token: SeSystemProfilePrivilege	2920	explorer.exe
Token: SeSystemtimePrivilege	2920	explorer.exe
Token: SeProfSingleProcessPrivilege	2920	explorer.exe
Token: SeIncBasePriorityPrivilege	2920	explorer.exe
Token: SeCreatePagefilePrivilege	2920	explorer.exe
Token: SeBackupPrivilege	2920	explorer.exe
Token: SeRestorePrivilege	2920	explorer.exe
Token: SeShutdownPrivilege	2920	explorer.exe
Token: SeDebugPrivilege	2920	explorer.exe
Token: SeSystemEnvironmentPrivilege	2920	explorer.exe
Token: SeChangeNotifyPrivilege	2920	explorer.exe
Token: SeRemoteShutdownPrivilege	2920	explorer.exe
Token: SeUndockPrivilege	2920	explorer.exe
Token: SeManageVolumePrivilege	2920	explorer.exe
Token: SeImpersonatePrivilege	2920	explorer.exe
Token: SeCreateGlobalPrivilege	2920	explorer.exe
Token: 33	2920	explorer.exe
Token: 34	2920	explorer.exe
Token: 35	2920	explorer.exe
Token: 36	2920	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2920	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 5056 wrote to memory of 1904	5056	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	84
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 1904 wrote to memory of 3676	1904	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	85
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 1980	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	86
PID 3676 wrote to memory of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3676 wrote to memory of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3676 wrote to memory of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3676 wrote to memory of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3676 wrote to memory of 3952	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	87
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88
PID 3676 wrote to memory of 2288	3676	d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d443c691f304ba592dd500c6fdf08bec_JaffaCakes118.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks BIOS information in registry
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1980
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3952
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3644
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        Checks BIOS information in registry
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2920
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:372
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GgHsif8eFi8fAef.dll

Filesize
2KB

MD5
86abab3626563fab5e99e64704c422db

SHA1
796f07b6dc34725477fb76ef561bd93f401f18ca

SHA256
32f96309d1f0308381f7bf24376e7b70af563316fe0e641a604a9d7afe4d18ca

SHA512
cd44208604d83b52e3fb55fe5f486d143919f0a1fe5a9aba617b4e8187b573879286f617cca06ea9686fddb56f3fcf9588d629aa2220bda0b5c8e7abd5567501

Download Submit
memory/372-32-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/1904-4-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1904-6-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1904-7-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1904-10-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1980-15-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/2288-19-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2920-35-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2920-34-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2920-33-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2920-31-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3676-9-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3676-12-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3676-13-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3676-8-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/3952-28-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3952-22-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3952-21-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads