gh0strat | 7d53c33d9f83abaf854a7ca96973226533659ad0800c290cd787d8cb23497550

General

Target

7d53c33d9f83abaf854a7ca96973226533659ad0800c290cd787d8cb23497550.dll
Size

137KB
MD5

2027c3e1a6842ef18f9b69c30f60748d
SHA1

15484be9d393007a01a60be34cb7255fb72caceb
SHA256

7d53c33d9f83abaf854a7ca96973226533659ad0800c290cd787d8cb23497550
SHA512

2821381c0c8294e02718d7cb316f156843ade004b5b2380a934464df882a9c5dd7d7ccb30c8e2933bceab97cab06dd8aec5ede042ed0a2eaf54458e1e9bd5ec1
SSDEEP

3072:uR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuZ:725GgFny61mraP

Score

10^/10

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/4544-6-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral2/memory/4544-5-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral2/memory/4544-4-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat
behavioral2/memory/4544-41-0x0000000010000000-0x000000001001C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	4544	rundll32.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 16 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	Spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	Spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	Spoolsv.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Spooler\ImagePath = "Spoolsv.exe"	svchost.exe

ACProtect 1.3x - 1.4x DLL software 16 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/4544-18-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4908-25-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4908-30-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4908-29-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4908-28-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4908-27-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4908-24-0x00000000032D0000-0x00000000032ED000-memory.dmp	acprotect
behavioral2/memory/4544-14-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4544-13-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4544-12-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4544-7-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4544-8-0x0000000003070000-0x000000000308D000-memory.dmp	acprotect
behavioral2/memory/4544-6-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral2/memory/4544-5-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral2/memory/4544-4-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect
behavioral2/memory/4544-41-0x0000000010000000-0x000000001001C000-memory.dmp	acprotect

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Miscson.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Miscson.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\scsimon.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\com\comb.dll	rundll32.exe
File created	C:\Windows\SysWOW64\Miscson.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\scsimon.dll	rundll32.exe
File created	C:\Windows\SysWOW64\scsimon.dll	rundll32.exe
File created	C:\Windows\SysWOW64\Miscson.dll	svchost.exe
File created	C:\Windows\SysWOW64\scsimon.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\com\comb.dll	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 4908	4544	rundll32.exe	90

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe
File created	C:\Windows\AppPatch\ComBack.Dll	rundll32.exe
File opened for modification	C:\Windows\AppPatch\AcSvcst.dll	rundll32.exe
File created	C:\Windows\AppPatch\AcSvcst.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
184	4544	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Spoolsv.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	Spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:"	Spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45"	Spoolsv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	rundll32.exe
Token: SeDebugPrivilege	4908	svchost.exe
Token: SeDebugPrivilege	4544	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4544	2728	rundll32.exe	85
PID 2728 wrote to memory of 4544	2728	rundll32.exe	85
PID 2728 wrote to memory of 4544	2728	rundll32.exe	85
PID 4544 wrote to memory of 4908	4544	rundll32.exe	90
PID 4544 wrote to memory of 4908	4544	rundll32.exe	90
PID 4544 wrote to memory of 4908	4544	rundll32.exe	90
PID 4544 wrote to memory of 4908	4544	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d53c33d9f83abaf854a7ca96973226533659ad0800c290cd787d8cb23497550.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d53c33d9f83abaf854a7ca96973226533659ad0800c290cd787d8cb23497550.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Boot or Logon Autostart Execution: Port Monitors
  - Sets service image path in registry
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe -k rundll32
    3⤵
    - Boot or Logon Autostart Execution: Port Monitors
    - Sets service image path in registry
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 616
    3⤵
    - Program crash
    PID:184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4544 -ip 4544
1⤵
PID:2920

C:\Windows\system32\Spoolsv.exe
Spoolsv.exe
1⤵
PID:2912

C:\Windows\system32\Spoolsv.exe
Spoolsv.exe
1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Port Monitors

1

T1547.010

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Port Monitors

1

T1547.010

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\ComBack.Dll

Filesize
137KB

MD5
7a298ebb0e14253a8fbe1677a12423f5

SHA1
35143dfdb06e208d3a006cd7cb033d3c9db7c682

SHA256
27429b6365fa451f4bf3741daba5ba6ddf57065d974d66e40df636fa8e6300da

SHA512
7f5d3bc555bc0d874fee039f1edd8520fcda8e9761cba888b2cd3fe84aa43b891f872a0f3633a0b9f44a31555f25d46a413403c3007e80d543ea6779c32ab5ba

Download Submit
C:\Windows\SysWOW64\Miscson.dll

Filesize
137KB

MD5
a69b41befb451e92ab1de67118d7c0d0

SHA1
a661721790795b253a02d5718f231c450243eafd

SHA256
b506d24a55e18c5cc7cfbab6c4a4d234d8c4fc5ac768e0fa858df21104140a10

SHA512
da9fae338c8582d910d42b577807f89017af5a95f4ebdf4a7ddafd155c1f608f216a9449cb05f5f34669d75f88818e2be9d323a9414411f01b20ca9d70ec5ab5

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
99B

MD5
ab69455cd6dd9384e975bc278052f4fc

SHA1
f12d7b41c80ed9c77ddcc9090547e4916842e048

SHA256
fe347e41261fca61b0cf0fcdecbfb945b2ba064ffcfc89b51ab70817c2e3f2cf

SHA512
c456c6d3ada796a051c390cf80993540ee4574e586a3cdb514a22bd34f54cd82f6e1bc03bc4ec4d596e3169e79157402ed2d4411dda6246b93c6d6dfe79d4485

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
247B

MD5
5a6e368d1cec6d2229beb1044b86ef72

SHA1
8d4194d5c3b9e38181e408927db6cf8d93c4ce58

SHA256
5d130123b5fabbfec2d7d1016d4a7d6f4a294e7f50e13cd2e61a0701b773f37a

SHA512
8e9effe6d31f8d61a2e9fd5ca473f210563e405b23b62ddc66e6f31bdb18e95440b07336268db7d7193073b4fdd3c1f8f91694259f3ea975c2b6d5971b07131e

Download Submit
C:\Windows\SysWOW64\com\comb.dll

Filesize
290B

MD5
75c465a5e7d05f20138ac20d10002805

SHA1
6015a8badbaf58599d7edee201e70aa96b3837e0

SHA256
f58ff79ebfe537c0b2e14a2216eee91dc88f55e0e161de4bb3faa24d1ea22c67

SHA512
6a0df9ae20b4c227e43dcf39297c55a381b515f95b3e120deb80542715d421c05c6f519ea3e5a97bbaceb21f82db37bed60810ba5b9169a53976f322dcd1c533

Download Submit
C:\Windows\SysWOW64\scsimon.dll

Filesize
137KB

MD5
aed0a98c5cf2e9718640a12f57b4693e

SHA1
f0a35ffeeeea70e58f647cbc3c24cd988200f58d

SHA256
72a6bc3ed1e05136e5930a55ca60ce6dca160296cb720187684f94919e575416

SHA512
bad9262533f964ee7f7248708b8880a6c089eaed673399f6ef612a10786249a9a024e1f67256d9eefe085412a966b8f3f72538c9514657641374ddce73e199b9

Download Submit
memory/4544-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4544-6-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4544-41-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4544-43-0x0000000043E50000-0x0000000043E77000-memory.dmp

Filesize
156KB

Download
memory/4544-4-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4544-18-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4544-14-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4544-13-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4544-12-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4544-7-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4544-8-0x0000000003070000-0x000000000308D000-memory.dmp

Filesize
116KB

Download
memory/4908-27-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-16-0x0000000000CC0000-0x0000000000CE3000-memory.dmp

Filesize
140KB

Download
memory/4908-15-0x0000000000DC0000-0x0000000000DE7000-memory.dmp

Filesize
156KB

Download
memory/4908-29-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-28-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-24-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-44-0x0000000000DC0000-0x0000000000DE7000-memory.dmp

Filesize
156KB

Download
memory/4908-30-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-25-0x00000000032D0000-0x00000000032ED000-memory.dmp

Filesize
116KB

Download
memory/4908-17-0x0000000000DC0000-0x0000000000DE7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads