qakbot | 3a1ec5cfa213479f5f7fc25d46672b489ab64d50e687253f6f388991b0c50b43

General

Target

89cde7fa5c181f10cc9a21fb961f8de5_JaffaCakes118.vbs
Size

1.9MB
MD5

89cde7fa5c181f10cc9a21fb961f8de5
SHA1

a1449eef635ae525e6ba3167f4978bbfde9c73fc
SHA256

3a1ec5cfa213479f5f7fc25d46672b489ab64d50e687253f6f388991b0c50b43
SHA512

a44b5af5c92fdeebd25de21a08b1ff8138d3092a6131f750f1ba01717c80d729da020e5778419835d1014b29c29951cca4d69eaf0456640c759727a4f495e7d0
SSDEEP

49152:j6rXNinXYXKRat360hlkGHkUxyHUfCllJ04MGo2GriKPgOU1eODlB:F

Score

10^/10

qakbot spx02 1567678709 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx02

Campaign

1567678709

C2

50.78.93.74:995

50.46.131.145:443

98.236.87.243:443

72.179.13.59:443

73.226.220.56:443

75.177.172.209:6881

192.24.181.185:443

206.51.202.106:50002

108.184.57.213:443

67.10.18.112:993

162.244.225.30:443

47.23.101.26:993

47.136.226.219:443

96.20.238.2:2083

68.238.56.27:443

75.131.239.76:443

172.78.85.20:443

96.22.239.27:2222

76.71.76.131:32101

60.254.82.182:2078

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 7 IoCs

Processes:

xgIWRvnF.exexgIWRvnF.exebwiindui.exebwiindui.exexgIWRvnF.exebwiindui.exebwiindui.exe

pid process

3860 xgIWRvnF.exe
3428 xgIWRvnF.exe
3608 bwiindui.exe
3552 bwiindui.exe
4796 xgIWRvnF.exe
5044 bwiindui.exe
1992 bwiindui.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gdxsrgbgi = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Eactoov\\bwiindui.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bwiindui.exexgIWRvnF.exebwiindui.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	bwiindui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	xgIWRvnF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	xgIWRvnF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	bwiindui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	bwiindui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	bwiindui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	xgIWRvnF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	xgIWRvnF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	xgIWRvnF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	xgIWRvnF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	bwiindui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	bwiindui.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3300 schtasks.exe

pid	process
3300	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

xgIWRvnF.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	xgIWRvnF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	xgIWRvnF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	xgIWRvnF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	xgIWRvnF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xgIWRvnF.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

588 PING.EXE

pid	process
588	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

xgIWRvnF.exexgIWRvnF.exebwiindui.exebwiindui.exeexplorer.exexgIWRvnF.exebwiindui.exebwiindui.exe

pid	process
3860	xgIWRvnF.exe
3860	xgIWRvnF.exe
3428	xgIWRvnF.exe
3428	xgIWRvnF.exe
3428	xgIWRvnF.exe
3428	xgIWRvnF.exe
3608	bwiindui.exe
3608	bwiindui.exe
3552	bwiindui.exe
3552	bwiindui.exe
3552	bwiindui.exe
3552	bwiindui.exe
1420	explorer.exe
1420	explorer.exe
1420	explorer.exe
1420	explorer.exe
4796	xgIWRvnF.exe
4796	xgIWRvnF.exe
5044	bwiindui.exe
5044	bwiindui.exe
1992	bwiindui.exe
1992	bwiindui.exe
1992	bwiindui.exe
1992	bwiindui.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bwiindui.exe

pid process

3608 bwiindui.exe

pid	process
3608	bwiindui.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

xgIWRvnF.exebwiindui.exexgIWRvnF.execmd.exebwiindui.exe

description	pid	process	target process
PID 3860 wrote to memory of 3428	3860	xgIWRvnF.exe	xgIWRvnF.exe
PID 3860 wrote to memory of 3428	3860	xgIWRvnF.exe	xgIWRvnF.exe
PID 3860 wrote to memory of 3428	3860	xgIWRvnF.exe	xgIWRvnF.exe
PID 3860 wrote to memory of 3608	3860	xgIWRvnF.exe	bwiindui.exe
PID 3860 wrote to memory of 3608	3860	xgIWRvnF.exe	bwiindui.exe
PID 3860 wrote to memory of 3608	3860	xgIWRvnF.exe	bwiindui.exe
PID 3860 wrote to memory of 3300	3860	xgIWRvnF.exe	schtasks.exe
PID 3860 wrote to memory of 3300	3860	xgIWRvnF.exe	schtasks.exe
PID 3860 wrote to memory of 3300	3860	xgIWRvnF.exe	schtasks.exe
PID 3608 wrote to memory of 3552	3608	bwiindui.exe	bwiindui.exe
PID 3608 wrote to memory of 3552	3608	bwiindui.exe	bwiindui.exe
PID 3608 wrote to memory of 3552	3608	bwiindui.exe	bwiindui.exe
PID 3608 wrote to memory of 1420	3608	bwiindui.exe	explorer.exe
PID 3608 wrote to memory of 1420	3608	bwiindui.exe	explorer.exe
PID 3608 wrote to memory of 1420	3608	bwiindui.exe	explorer.exe
PID 3608 wrote to memory of 1420	3608	bwiindui.exe	explorer.exe
PID 4796 wrote to memory of 532	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 532	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4276	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4276	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 3468	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 3468	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 208	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 208	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4644	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4644	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 2952	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 2952	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4608	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 4608	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 3744	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 3744	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 1392	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 1392	4796	xgIWRvnF.exe	reg.exe
PID 4796 wrote to memory of 5044	4796	xgIWRvnF.exe	bwiindui.exe
PID 4796 wrote to memory of 5044	4796	xgIWRvnF.exe	bwiindui.exe
PID 4796 wrote to memory of 5044	4796	xgIWRvnF.exe	bwiindui.exe
PID 4796 wrote to memory of 1628	4796	xgIWRvnF.exe	cmd.exe
PID 4796 wrote to memory of 1628	4796	xgIWRvnF.exe	cmd.exe
PID 4796 wrote to memory of 3408	4796	xgIWRvnF.exe	schtasks.exe
PID 4796 wrote to memory of 3408	4796	xgIWRvnF.exe	schtasks.exe
PID 1628 wrote to memory of 588	1628	cmd.exe	PING.EXE
PID 1628 wrote to memory of 588	1628	cmd.exe	PING.EXE
PID 5044 wrote to memory of 1992	5044	bwiindui.exe	bwiindui.exe
PID 5044 wrote to memory of 1992	5044	bwiindui.exe	bwiindui.exe
PID 5044 wrote to memory of 1992	5044	bwiindui.exe	bwiindui.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89cde7fa5c181f10cc9a21fb961f8de5_JaffaCakes118.vbs"
1⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe
C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe
C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe /C
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3428

C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dypsdsnr /tr "\"C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe\" /I dypsdsnr" /SC ONCE /Z /ST 07:56 /ET 08:08
2⤵
- Creates scheduled task(s)
PID:3300

C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe
C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe /I dypsdsnr
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:532

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:4276

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:3468

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:208

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:4644

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:2952

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
2⤵
PID:4608

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
2⤵
PID:3744

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov" /d "0"
2⤵
- Windows security bypass
PID:1392

C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044

C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.exe /C
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\system32\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:588

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /DELETE /F /TN dypsdsnr
2⤵
PID:3408

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xgIWRvnF.exe
Filesize
656KB

MD5
ee012e5a6dedbad726af12e7ba9374df

SHA1
1429e28e9c78294b6d1e96b9cb40da73ae51c23a

SHA256
259e8c4576444287f43218b2f6754da1d50339fdb4c4d8c9634ff72e6e2521f5

SHA512
5a82377e13242a7ab5d257a7f7f0c0856904591e5b583089999772742046b3d2857bb43f0937b4ad63cdc8e65e8519f0e6fd831b7c598b1ce13587934f9275d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Eactoov\bwiindui.dat
Filesize
63B

MD5
25e60d4dce767250e58db51b7fc2f21c

SHA1
c9d66575a343dbd55e7233642e5669aca1fd5ea7

SHA256
dd8ab149e766d6cbb362a8a210682cc10c86cff86df41d2f7f11f096c3e2b590

SHA512
bac4c9aaa33f87b9b70ed905506b6ceb31aeaa5420ce51e4ddc42108ab7252bb4fd41c2173a6236b037383b3f2213a75c264f22df4bfdf89cf775cfd96915d5c

Download Submit
memory/1420-36-0x0000000002690000-0x00000000026D1000-memory.dmp

Filesize
260KB

Download
memory/1420-34-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1420-39-0x0000000002690000-0x00000000026D1000-memory.dmp

Filesize
260KB

Download
memory/1420-30-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1420-32-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1420-37-0x0000000002690000-0x00000000026D1000-memory.dmp

Filesize
260KB

Download
memory/1420-33-0x0000000002690000-0x00000000026D1000-memory.dmp

Filesize
260KB

Download
memory/1992-55-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3428-13-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3428-12-0x0000000002150000-0x0000000002157000-memory.dmp

Filesize
28KB

Download
memory/3552-29-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3608-35-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3608-20-0x0000000000720000-0x0000000000727000-memory.dmp

Filesize
28KB

Download
memory/3860-6-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3860-4-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/3860-24-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4796-43-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4796-50-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/5044-56-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads