quasar | 8b776eb44e02df10fec47058feac9cc18d0f169370ebf7cbd9f0f0b7b66c99f9

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bannas.exe
Size

348KB
MD5

7500a9269a35b159e854312282732728
SHA1

5b3d03a59af9e662f84fb2ab113e6275a9d502af
SHA256

8b776eb44e02df10fec47058feac9cc18d0f169370ebf7cbd9f0f0b7b66c99f9
SHA512

3d46a5cec0dfc5b14381e21c096d0a9d094e6971629eada7fa4a3ddac7ac2192ff69c1c73b627447092d6589caab350fea14235cfbb380a364dba14969a7487f
SSDEEP

6144:wk+zrEsiN1PDA3COn7bblr71T2fJYUzsgNkd:dxsiNczZsf2UzXkd

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

localhost:4781

192.168.1.159:4781

skibiditoilet.hopto.org:4781

86.175.70.140:4781

Mutex

QSR_MUTEX_86QM62MaEKfEyd8OVt

Attributes

encryption_key
zZvCiezIyCBIqqTBUeKo
install_name
security2.exe
log_directory
Logs
reconnect_delay
3000
startup_key
security2
subdirectory
skibidi

Signatures

Quasar RAT 4 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
	11	ip-api.com	Process not Found
	15	ip-api.com	Process not Found
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bannas.exe
	2	ip-api.com	Process not Found

Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/2548-1-0x0000000000140000-0x000000000019E000-memory.dmp	family_quasar
behavioral1/files/0x00280000000186b7-5.dat	family_quasar
behavioral1/memory/3020-10-0x0000000000B10000-0x0000000000B6E000-memory.dmp	family_quasar
behavioral1/memory/2212-32-0x0000000000BF0000-0x0000000000C4E000-memory.dmp	family_quasar
behavioral1/memory/1208-50-0x0000000001330000-0x000000000138E000-memory.dmp	family_quasar
behavioral1/memory/1692-68-0x0000000000390000-0x00000000003EE000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
3020	security2.exe
2212	security2.exe
1208	security2.exe
1692	security2.exe

Loads dropped DLL 16 IoCs

pid	Process
2548	bannas.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
2700	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
2580	WerFault.exe
2580	WerFault.exe
2580	WerFault.exe
2580	WerFault.exe
2580	WerFault.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
11	ip-api.com
15	ip-api.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\skibidi\security2.exe	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi	security2.exe
File created	C:\Program Files (x86)\skibidi\security2.exe	bannas.exe
File opened for modification	C:\Program Files (x86)\skibidi\security2.exe	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi\security2.exe	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi\security2.exe	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi	security2.exe
File opened for modification	C:\Program Files (x86)\skibidi\security2.exe	bannas.exe
File opened for modification	C:\Program Files (x86)\skibidi	security2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2700	3020	WerFault.exe	33
1876	2212	WerFault.exe	41
2580	1208	WerFault.exe	49

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bannas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	security2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1832	PING.EXE
2692	PING.EXE
2388	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1832	PING.EXE
2692	PING.EXE
2388	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2812	schtasks.exe
2000	schtasks.exe
1280	schtasks.exe
2904	schtasks.exe
2972	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	bannas.exe
Token: SeDebugPrivilege	3020	security2.exe
Token: SeDebugPrivilege	2212	security2.exe
Token: SeDebugPrivilege	1208	security2.exe
Token: SeDebugPrivilege	1692	security2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3020	security2.exe
2212	security2.exe
1208	security2.exe
1692	security2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2972	2548	bannas.exe	31
PID 2548 wrote to memory of 2972	2548	bannas.exe	31
PID 2548 wrote to memory of 2972	2548	bannas.exe	31
PID 2548 wrote to memory of 2972	2548	bannas.exe	31
PID 2548 wrote to memory of 3020	2548	bannas.exe	33
PID 2548 wrote to memory of 3020	2548	bannas.exe	33
PID 2548 wrote to memory of 3020	2548	bannas.exe	33
PID 2548 wrote to memory of 3020	2548	bannas.exe	33
PID 3020 wrote to memory of 2812	3020	security2.exe	34
PID 3020 wrote to memory of 2812	3020	security2.exe	34
PID 3020 wrote to memory of 2812	3020	security2.exe	34
PID 3020 wrote to memory of 2812	3020	security2.exe	34
PID 3020 wrote to memory of 2268	3020	security2.exe	36
PID 3020 wrote to memory of 2268	3020	security2.exe	36
PID 3020 wrote to memory of 2268	3020	security2.exe	36
PID 3020 wrote to memory of 2268	3020	security2.exe	36
PID 3020 wrote to memory of 2700	3020	security2.exe	38
PID 3020 wrote to memory of 2700	3020	security2.exe	38
PID 3020 wrote to memory of 2700	3020	security2.exe	38
PID 3020 wrote to memory of 2700	3020	security2.exe	38
PID 2268 wrote to memory of 1392	2268	cmd.exe	39
PID 2268 wrote to memory of 1392	2268	cmd.exe	39
PID 2268 wrote to memory of 1392	2268	cmd.exe	39
PID 2268 wrote to memory of 1392	2268	cmd.exe	39
PID 2268 wrote to memory of 1832	2268	cmd.exe	40
PID 2268 wrote to memory of 1832	2268	cmd.exe	40
PID 2268 wrote to memory of 1832	2268	cmd.exe	40
PID 2268 wrote to memory of 1832	2268	cmd.exe	40
PID 2268 wrote to memory of 2212	2268	cmd.exe	41
PID 2268 wrote to memory of 2212	2268	cmd.exe	41
PID 2268 wrote to memory of 2212	2268	cmd.exe	41
PID 2268 wrote to memory of 2212	2268	cmd.exe	41
PID 2212 wrote to memory of 2000	2212	security2.exe	42
PID 2212 wrote to memory of 2000	2212	security2.exe	42
PID 2212 wrote to memory of 2000	2212	security2.exe	42
PID 2212 wrote to memory of 2000	2212	security2.exe	42
PID 2212 wrote to memory of 2196	2212	security2.exe	44
PID 2212 wrote to memory of 2196	2212	security2.exe	44
PID 2212 wrote to memory of 2196	2212	security2.exe	44
PID 2212 wrote to memory of 2196	2212	security2.exe	44
PID 2212 wrote to memory of 1876	2212	security2.exe	46
PID 2212 wrote to memory of 1876	2212	security2.exe	46
PID 2212 wrote to memory of 1876	2212	security2.exe	46
PID 2212 wrote to memory of 1876	2212	security2.exe	46
PID 2196 wrote to memory of 904	2196	cmd.exe	47
PID 2196 wrote to memory of 904	2196	cmd.exe	47
PID 2196 wrote to memory of 904	2196	cmd.exe	47
PID 2196 wrote to memory of 904	2196	cmd.exe	47
PID 2196 wrote to memory of 2692	2196	cmd.exe	48
PID 2196 wrote to memory of 2692	2196	cmd.exe	48
PID 2196 wrote to memory of 2692	2196	cmd.exe	48
PID 2196 wrote to memory of 2692	2196	cmd.exe	48
PID 2196 wrote to memory of 1208	2196	cmd.exe	49
PID 2196 wrote to memory of 1208	2196	cmd.exe	49
PID 2196 wrote to memory of 1208	2196	cmd.exe	49
PID 2196 wrote to memory of 1208	2196	cmd.exe	49
PID 1208 wrote to memory of 1280	1208	security2.exe	50
PID 1208 wrote to memory of 1280	1208	security2.exe	50
PID 1208 wrote to memory of 1280	1208	security2.exe	50
PID 1208 wrote to memory of 1280	1208	security2.exe	50
PID 1208 wrote to memory of 2340	1208	security2.exe	52
PID 1208 wrote to memory of 2340	1208	security2.exe	52
PID 1208 wrote to memory of 2340	1208	security2.exe	52
PID 1208 wrote to memory of 2340	1208	security2.exe	52

C:\Users\Admin\AppData\Local\Temp\bannas.exe
"C:\Users\Admin\AppData\Local\Temp\bannas.exe"
1⤵
- Quasar RAT
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "security2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bannas.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2972
- C:\Program Files (x86)\skibidi\security2.exe
  "C:\Program Files (x86)\skibidi\security2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "security2" /sc ONLOGON /tr "C:\Program Files (x86)\skibidi\security2.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\NG8NEsCGN34Y.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1832
  - - C:\Program Files (x86)\skibidi\security2.exe
      "C:\Program Files (x86)\skibidi\security2.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "security2" /sc ONLOGON /tr "C:\Program Files (x86)\skibidi\security2.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2000
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nWjITlQVbHsW.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:904
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2692
      - C:\Program Files (x86)\skibidi\security2.exe
        
        "C:\Program Files (x86)\skibidi\security2.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "security2" /sc ONLOGON /tr "C:\Program Files (x86)\skibidi\security2.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\SuoZUTgbBjDb.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2340
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2388
        
        C:\Program Files (x86)\skibidi\security2.exe
        
        "C:\Program Files (x86)\skibidi\security2.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "security2" /sc ONLOGON /tr "C:\Program Files (x86)\skibidi\security2.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1468
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 1428
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1500
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NG8NEsCGN34Y.bat

Filesize
203B

MD5
29c8f0adc06689fd101b286b0a9c4ee9

SHA1
63eec5648937b54d53f9026dd744e580439ff612

SHA256
a83e85fa6ab5c76f99841f84b11aa23b9edfdd165a81d7788a67ea187af9910f

SHA512
c117c7aa2bcfa9ec8822520277ae9f2debf066336716359486ab6c336f9a606ed578fdf799d9ce1795bfdb3ff52e6940c90f32a03a88e73605e438715b9e39b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\SuoZUTgbBjDb.bat

Filesize
203B

MD5
a3c2a43b17a32238eb7e00a9b9a4b35a

SHA1
42dc5e808f08060400a97c24f9e0a7ca096f2730

SHA256
11deefdf364148507adf56fd9807801ff65f9713a43fff6926a4d52786dbc033

SHA512
f9f554127df7e8cbcbf71278d2e2606d994a885353496ce04bf588f1fe21b8307658dd395ce3ac90ba4c0383ca143b5aae852a9b66011b609a308c0d4995b9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nWjITlQVbHsW.bat

Filesize
203B

MD5
577649cf5f007c8c4430ca6fc0983edb

SHA1
e405f041fca073c57f95b89d2323ecd33fedb1cc

SHA256
fe39ddd043996203f9d5007157530b8006281df46c3f225f3412c867adf63fd9

SHA512
63de2d282eeb19766b2e0f7734e7dea4c13d93455053d0cf7fd65a6e1149538aba2734300b5650f0920660bb5b783805515e021efe6bb3591a3e1a5f695d6c3a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-14-2024

Filesize
224B

MD5
952c8e552ce2d5aebc00bda66f516ca3

SHA1
da70ac6a01bc717621049a7576a0590d077ef5bf

SHA256
a49a935c0d36b411767c7460fcb5481c7e4f3e60e623a46eeff5e55496c2cb12

SHA512
19df07910dc8ced292545de0ed4520b89543874ec300edc4e5c5a0a2da4f6a75ce936ff6542c8eb28f1bc6df92b036cc211122b185cdc074a8202f39a12a5223

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-14-2024

Filesize
224B

MD5
0db817aeb130f6f0ecd06c7807e942be

SHA1
e629f8c3b53a2472d6404f7cb8d4a6e57d462c49

SHA256
f642e90211d5904a0330f6492cc55c352f4cffe884fc4866650a02f4b1d7918a

SHA512
9a07566fcc69bb82c63617a59d85f83e056f1ca8ccea2badb56cf12e032ac5727d150a3179a38320b364715b5a1f83e491a240dc6747684811b4df3010468d03

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-14-2024

Filesize
224B

MD5
80adb6d63cee870609c630f90b7e5848

SHA1
920a49861b4b810f4cc63f1b2e8a9b32750812b1

SHA256
23a675d65b562b3f234081a1771fc9feaa3ccdd77f0befe247643b53207ffac3

SHA512
b27409a85910df7e722032c0dab9573c6d82663f8e11961a42ca7582dc931afabba20e63bbd53f7ef641e39f0c6aee800ebd2d2947880289a1e668060c45d1f8

Download Submit
\Program Files (x86)\skibidi\security2.exe

Filesize
348KB

MD5
7500a9269a35b159e854312282732728

SHA1
5b3d03a59af9e662f84fb2ab113e6275a9d502af

SHA256
8b776eb44e02df10fec47058feac9cc18d0f169370ebf7cbd9f0f0b7b66c99f9

SHA512
3d46a5cec0dfc5b14381e21c096d0a9d094e6971629eada7fa4a3ddac7ac2192ff69c1c73b627447092d6589caab350fea14235cfbb380a364dba14969a7487f

Download Submit
memory/1208-50-0x0000000001330000-0x000000000138E000-memory.dmp

Filesize
376KB

Download
memory/1692-68-0x0000000000390000-0x00000000003EE000-memory.dmp

Filesize
376KB

Download
memory/2212-32-0x0000000000BF0000-0x0000000000C4E000-memory.dmp

Filesize
376KB

Download
memory/2548-13-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2548-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-1-0x0000000000140000-0x000000000019E000-memory.dmp

Filesize
376KB

Download
memory/3020-10-0x0000000000B10000-0x0000000000B6E000-memory.dmp

Filesize
376KB

Download
memory/3020-30-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-15-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-12-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/3020-11-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads