sodinokibi | 19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c

General

Target

JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
Size

5.6MB
MD5

4d6db255a6f3ac059db04ec85c5af708
SHA1

81a6336213bfc9c65ba54d0db1d01304166a52ad
SHA256

19889563a01396e02d971bac3be7194500fc09b8b4409cec21affd1f6a11741c
SHA512

a3c12b27ef17c8dc8a9ae3975f9d99c1a469b5e98fca45dfcfcc1b0b558840a05e5562fd683ddcba70fdc03ef8976c7bfee0b85e12927141dc946747d08741f5
SSDEEP

3072:2zQkpdEcu8e5KoREUzk+JV8tHvlnbIrNHF14:6gYJvZW

Score

10^/10

sodinokibi $2a$12$prox/4ekl8zrpgsc5lnhpecevs5nockouw5r3s4jjydnzzsghvbkq 8254 discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq

Campaign

8254

Decoy

boisehosting.net

fotoideaymedia.es

dubnew.com

stallbyggen.se

koken-voor-baby.nl

juneauopioidworkgroup.org

vancouver-print.ca

zewatchers.com

bouquet-de-roses.com

seevilla-dr-sturm.at

olejack.ru

i-trust.dk

wasmachtmeinfonds.at

appsformacpc.com

friendsandbrgrs.com

thenewrejuveme.com

xn--singlebrsen-vergleich-nec.com

sabel-bf.com

seminoc.com

ceres.org.au

Attributes

net
false
pid
$2a$12$prOX/4eKl8zrpGSC5lnHPecevs5NOckOUW5r3s4JJYDnZZSghvBkq
prc
encsvc

powerpnt

ocssd

steam

isqlplussvc

outlook

sql

ocomm

agntsvc

mspub

onenote

winword

thebat

excel

mydesktopqos

ocautoupds

thunderbird

synctime

infopath

mydesktopservice

firefox

oracle

sqbcoreservice

dbeng50

tbirdconfig

msaccess

visio

dbsnmp

wordpad

xfssvccon
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
8254
svc
veeam

memtas

sql

backup

vss

sophos

svc$

mepocs

Extracted

Path

C:\Users\831l1864-readme.txt

Ransom Note

---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 831l1864. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/ABDE0477481B7585 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vTjj6zDj0orYN42R5jBQ4GkGG2pmmEaB3EOW6Rr1teL/EoLTYK+/v20hmh61h14B Cp/O9Mclg9LHCkkBorhYKgE3kodCqwZp5KDiTsIDQbvyAfZ8fueoHqmVPB3wMOP4 WC1F4jzREHIR8+ok5Q6mRZ0UTqq/Gq487JhJpYjKoPWldYtYxKcEi+lWGWABwU4A xD+qx/ilnzuBGPPFLHAVBROmHL65LUfLU3NE8G/igANPgPJvXK4KFMSYmjqqjhUT 05od0pBMZmQ8T1cnaZh3hGEELHYBw42QoNtACSr+JPzSLabS0/hTcVmL4VfHabIT rDjrZMhD4vdCHi48ctwOnjl96IGng/osBe7IzM3fOH4M4DvbfNeMUd7Moj3FGKCY TL0wSEq4DLf98Kce81vbfZ+msGpmW+1QOQaEvkvBY6ygWOed2Wvt6dqiTxkHxRJA egkA8lLOzyW1yzvBfyu2PnmhO+THtJcE//4VFrrCXA+IEfXS0WhRUiW/hbARzxTH yfwJTCVnXeFuMRmVXAxTauvuFAQdf2DcpR2LWH7CRRzYPoctNSCHYVbJ0RSWUrSa iYdv0GOUX8LTotfKWbsbhwN9DZ2lTHhVcdQUnF72QexUEoVElU0MlHXQc/06/tP6 Ue603KgJ9DMKcxYAdMYIyLxuih0ed37qFa/Su81TwOEuQcaHGTOr+G8b+H302jwF CpEgV/MIsZwSchlmJjkxOiVkbwhW1/HjTDCBvcWnKP7Skg4OTOYTgU8fDkO0DSsT Wd1pGn/bBmWdHwDdt8hBcertVC/ArCwb2uCIjPQ6hyS9sgfMhikytbifbxLzhm0u 94bMIVMcCV8O9Mj3tzYy9003w87djVY0VRAUije+M6pV7WLxtdx8T3RkS9EP0W5Y Fuvq+lQmCPm8mS4sgyRdVJVsaLBfbNd1lwHlmMB9NwA/CH+dIPH2cRTsw1qXff72 NRyETYT1tWkUmd0SA64B0Wch4XKm6+4FeGfN/RuPBjBaMXKNFRJzs3/YOjdnprDc +LEBEoIYjTCyi6PzNJMT7l+yb19p6h5dmc4mcLkYlmF03xI57LgY+p6WqxPmA3FT H8C6vgFGrCoNHrsSZ/exganKIaHf1rA+RdyNp57Wi7XEIYvKTNCG3RJXPbsF/hx8 EQmff6oBZG22Nmbp9BQNd1Fa9r6Ee2AmPYHCXnJ7grgEbeiS+/VqfW+U5ix1hZHk 8tSKNlHlh4uiS7DOhvLGRmt5xkPt8VnvIN+Sh0M4pdz/TJ+eknkhufxZBelgi/Bp nzGx8fzkDL1+d1xv0lP7iTgUOxptIzpp1ZAq/ne+X10ovTKgtdxymzUd0JEUtLFQ f/7Ro6Cq/JBgbvUzEI+RIbUsNEq/ASl2dO2UiVYIejU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ABDE0477481B7585

http://decoder.re/ABDE0477481B7585

Signatures

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4448 created 3520	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	56

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
952	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	MsMpEng.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	MsMpEng.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	MsMpEng.exe
File opened (read-only)	\??\K:	MsMpEng.exe
File opened (read-only)	\??\N:	MsMpEng.exe
File opened (read-only)	\??\P:	MsMpEng.exe
File opened (read-only)	\??\Z:	MsMpEng.exe
File opened (read-only)	\??\H:	MsMpEng.exe
File opened (read-only)	\??\J:	MsMpEng.exe
File opened (read-only)	\??\L:	MsMpEng.exe
File opened (read-only)	\??\T:	MsMpEng.exe
File opened (read-only)	\??\A:	MsMpEng.exe
File opened (read-only)	\??\E:	MsMpEng.exe
File opened (read-only)	\??\M:	MsMpEng.exe
File opened (read-only)	\??\R:	MsMpEng.exe
File opened (read-only)	\??\X:	MsMpEng.exe
File opened (read-only)	\??\F:	MsMpEng.exe
File opened (read-only)	\??\D:	MsMpEng.exe
File opened (read-only)	\??\W:	MsMpEng.exe
File opened (read-only)	\??\G:	MsMpEng.exe
File opened (read-only)	\??\I:	MsMpEng.exe
File opened (read-only)	\??\O:	MsMpEng.exe
File opened (read-only)	\??\Q:	MsMpEng.exe
File opened (read-only)	\??\S:	MsMpEng.exe
File opened (read-only)	\??\U:	MsMpEng.exe
File opened (read-only)	\??\V:	MsMpEng.exe
File opened (read-only)	\??\Y:	MsMpEng.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5w9bf2vb299.bmp"	MsMpEng.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\PopSave.MTS	MsMpEng.exe
File opened for modification	\??\c:\program files\RestoreEnter.i64	MsMpEng.exe
File opened for modification	\??\c:\program files\StepFormat.avi	MsMpEng.exe
File opened for modification	\??\c:\program files\StepSubmit.pcx	MsMpEng.exe
File opened for modification	\??\c:\program files\SwitchEdit.vsd	MsMpEng.exe
File opened for modification	\??\c:\program files\UninstallPop.zip	MsMpEng.exe
File created	\??\c:\program files (x86)\831l1864-readme.txt	MsMpEng.exe
File opened for modification	\??\c:\program files\ConnectUnprotect.bmp	MsMpEng.exe
File opened for modification	\??\c:\program files\UnlockDisable.vsd	MsMpEng.exe
File opened for modification	\??\c:\program files\WriteOut.rtf	MsMpEng.exe
File opened for modification	\??\c:\program files\ConvertConnect.php	MsMpEng.exe
File opened for modification	\??\c:\program files\LockStep.edrwx	MsMpEng.exe
File opened for modification	\??\c:\program files\UndoPublish.ps1xml	MsMpEng.exe
File created	\??\c:\program files (x86)\tmp	MsMpEng.exe
File opened for modification	\??\c:\program files\CompressConvert.TS	MsMpEng.exe
File opened for modification	\??\c:\program files\ExitResume.html	MsMpEng.exe
File opened for modification	\??\c:\program files\PushSplit.php	MsMpEng.exe
File opened for modification	\??\c:\program files\RedoSuspend.shtml	MsMpEng.exe
File opened for modification	\??\c:\program files\RegisterCheckpoint.pptx	MsMpEng.exe
File opened for modification	\??\c:\program files\UnlockGroup.wvx	MsMpEng.exe
File created	\??\c:\program files\831l1864-readme.txt	MsMpEng.exe
File opened for modification	\??\c:\program files\EditProtect.wma	MsMpEng.exe
File opened for modification	\??\c:\program files\RestartRestore.zip	MsMpEng.exe
File opened for modification	\??\c:\program files\SkipConnect.dib	MsMpEng.exe
File created	\??\c:\program files\tmp	MsMpEng.exe
File opened for modification	\??\c:\program files\ExitDebug.jpg	MsMpEng.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mpsvc.dll	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
File created	C:\Windows\MsMpEng.exe	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsMpEng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe
2240	MsMpEng.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	MsMpEng.exe
Token: SeTakeOwnershipPrivilege	2240	MsMpEng.exe
Token: SeBackupPrivilege	3712	vssvc.exe
Token: SeRestorePrivilege	3712	vssvc.exe
Token: SeAuditPrivilege	3712	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 4448 wrote to memory of 1124	4448	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	84
PID 1124 wrote to memory of 2240	1124	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	85
PID 1124 wrote to memory of 2240	1124	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	85
PID 1124 wrote to memory of 2240	1124	JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe	85
PID 2240 wrote to memory of 952	2240	MsMpEng.exe	87
PID 2240 wrote to memory of 952	2240	MsMpEng.exe	87
PID 2240 wrote to memory of 952	2240	MsMpEng.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3520
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d6db255a6f3ac059db04ec85c5af708.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\MsMpEng.exe
    "C:\Windows\MsMpEng.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:952

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:5012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\831l1864-readme.txt

Filesize
6KB

MD5
a441d2ff42c42e66dc9ba6c51188d656

SHA1
ff2a5168b7ee3dce8ea1c7d4e71fcdba24d0f8f5

SHA256
78daac43b58cfdd90f02d8f1dc08f4e8da1b300a3b93784d19b1dd7cd92a2b9f

SHA512
789344222dcbfb894828f17d24f3c4296f6d520c03aa7f4d02b2001417c8d59ab19a43576d1b2e4dcf51d132319299dc0f8f89777ca0451c692dafb660b2c6bd

Download Submit
C:\Windows\MsMpEng.exe

Filesize
21KB

MD5
8cc83221870dd07144e63df594c391d9

SHA1
3d409b39b8502fcd23335a878f2cbdaf6d721995

SHA256
33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

SHA512
e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c

Download Submit
C:\Windows\mpsvc.dll

Filesize
789KB

MD5
a47cf00aedf769d60d58bfe00c0b5421

SHA1
656c4d285ea518d90c1b669b79af475db31e30b1

SHA256
8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd

SHA512
4c2dcad3bd478fa70d086b7426d55976caa7ffc3d120c9c805cbb49eae910123c496bf2356066afcacba12ba05c963bbb8d95ed7f548479c90fec57aa16e4637

Download Submit
memory/1124-5-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1124-6-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1124-4-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1124-15-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/2240-19-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/2240-17-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/2240-38-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/2240-408-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/2240-414-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/2240-431-0x0000000001EC0000-0x0000000001EE2000-memory.dmp

Filesize
136KB

Download
memory/4448-18-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-16-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-2-0x00000000052A0000-0x000000000532E000-memory.dmp

Filesize
568KB

Download
memory/4448-0-0x00000000743FE000-0x00000000743FF000-memory.dmp

Filesize
4KB

Download
memory/4448-3-0x00000000058E0000-0x0000000005E84000-memory.dmp

Filesize
5.6MB

Download
memory/4448-1-0x0000000000520000-0x0000000000ACC000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads