bitrat | 293440eae97b7c052aeaffd6855b2eda065b0b8fd452a830a9bf3c6637a20f4a

General

Target

fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
Size

2.7MB
MD5

fa730d83b4be4c873039dc585f958d7c
SHA1

95f5cef4663ceb749ca98131734bb001d618458f
SHA256

293440eae97b7c052aeaffd6855b2eda065b0b8fd452a830a9bf3c6637a20f4a
SHA512

2870816e65670af2b1675dc6b3e48ae6e297adc15330c1ce3e0c9ae276136a122a3fe46175c389d93014938a080bb70bc7824f5adc4b831818ee8a707a24589b
SSDEEP

49152:DdbNhMYCLtVRgf3FEyzLrU2OzPaWBA22ynoyHORZ/nXX2WAoF:hPuCf1EyHo20PaP2VoyHGZ/XXyU

Score

10^/10

bitrat discovery execution trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

C2

storage.nsupdate.info:8973

Attributes

communication_password
bf771c9d082071fe80b18bb678220682
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Bitrat family
bitrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe
2284	powershell.exe
2352	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2204	MSBuild.exe
2204	MSBuild.exe
2204	MSBuild.exe
2204	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-94-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-93-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-92-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-89-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-88-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-96-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-97-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-103-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-105-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-104-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-107-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-106-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-108-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-109-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-111-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-110-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-113-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-112-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-114-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2204-115-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2352	powershell.exe
2284	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2204	MSBuild.exe
Token: SeShutdownPrivilege	2204	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	MSBuild.exe
2204	MSBuild.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1520	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1520	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1520	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	30
PID 2640 wrote to memory of 1520	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	30
PID 2640 wrote to memory of 2284	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	32
PID 2640 wrote to memory of 2284	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	32
PID 2640 wrote to memory of 2284	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	32
PID 2640 wrote to memory of 2284	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	32
PID 2640 wrote to memory of 2008	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	33
PID 2640 wrote to memory of 2008	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	33
PID 2640 wrote to memory of 2008	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	33
PID 2640 wrote to memory of 2008	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	33
PID 2640 wrote to memory of 2352	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	36
PID 2640 wrote to memory of 2352	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	36
PID 2640 wrote to memory of 2352	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	36
PID 2640 wrote to memory of 2352	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	36
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38
PID 2640 wrote to memory of 2204	2640	fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fa730d83b4be4c873039dc585f958d7c_JaffaCakes118.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoiCgLlRgn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WoiCgLlRgn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E62.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WoiCgLlRgn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab44EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4511.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3E62.tmp

Filesize
1KB

MD5
fe223da44a93c1304221b6e10aafce0b

SHA1
13972af33a55e0f83888f83f243058cb3f949725

SHA256
bfb16bd39b3061a4557dcce50c9218519085ff3669ce7b5be1aa9257881d74c5

SHA512
dba55d754be9cee1ae05d7ea057fe8a1af7ce05b93b373e9ed1914beb8563620cd5fac73b4c92f1a2977ff83825a6fa4c2162f4b0db4f8216cf662b833d77e82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NFPI8S4I4TWR8HVT19QS.temp

Filesize
7KB

MD5
9015a050b0d927c3dd7af58262f8fd12

SHA1
ca0201b15d705dd1fd95fbcc275f055b2c7810b7

SHA256
c1b78652efe7aefbde7cd77518b12754ec5376fa94a9f9a6fed92938f27c7141

SHA512
92e012221236b08de677cbf13c26b3a2e455f4eabc797ef397209989b06c72b942e13d76096bd2941cb6528b9053b06d54d84ded6d4d6ca35a00d95ad9699e50

Download Submit
memory/2204-104-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-88-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-115-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-114-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-112-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-113-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-110-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-111-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-85-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-94-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-93-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-109-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-92-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-91-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-89-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-108-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-96-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-97-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-103-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-105-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-106-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2204-107-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2640-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

Filesize
4KB

Download
memory/2640-63-0x0000000002240000-0x000000000225A000-memory.dmp

Filesize
104KB

Download
memory/2640-95-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-1-0x0000000000B90000-0x0000000000E40000-memory.dmp

Filesize
2.7MB

Download
memory/2640-2-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-67-0x000000000AC00000-0x000000000AD78000-memory.dmp

Filesize
1.5MB

Download
memory/2640-66-0x0000000009A10000-0x0000000009C00000-memory.dmp

Filesize
1.9MB

Download
memory/2640-65-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-64-0x00000000744EE000-0x00000000744EF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads