cryptbot | ea8b966254f89ce69425210fec17037d47b68f5ebb5e6b40c408f28d3900bd0b

Resubmissions

23-06-2024 14:21

240623-rpelzstfpc 10

23-06-2024 14:17

240623-rlz4hsxekp 10

23-06-2024 14:14

240623-rj5k8atekh 3

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 14:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

КМSрiсо.exe
Size

9.3MB
MD5

9a82eec3b97942751c99fe42a8699cdf
SHA1

62fa4445db34eac1e333af921454357704496261
SHA256

ea8b966254f89ce69425210fec17037d47b68f5ebb5e6b40c408f28d3900bd0b
SHA512

ad3b16ca24d29e1f9be6cdae9744cdd065a8f4545468aeaa99509b5c08a28b16d7c846978b71f60fe54d17b770af24529ba261133f02155048b45b7e0a79c246
SSDEEP

196608:hbCPcnPEu6Bqimbj+P6EDTvLhe8dYoANmvP2WNChdb+WRTBl:hWrmb0vTvLnhmWkK+TBl

Score

10^/10

cryptbot discovery evasion execution persistence spyware stealer themida trojan upx

Malware Config

Extracted

Family

cryptbot

xokecn54.top

morekt05.top

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

Setup.exeSetup1.exeIntelRapid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IntelRapid.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup1.exeIntelRapid.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Drops startup file 1 IoCs

Processes:

Setup1.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk Setup1.exe
Executes dropped EXE 9 IoCs

Processes:

Setup.exeKMSpico.exeKMSpico.tmpSetup1.exeIntelRapid.exeUninsHs.exeKMSELDI.exeAutoPico.exeKMSELDI.exe

pid process

2840 Setup.exe
2684 KMSpico.exe
2772 KMSpico.tmp
2720 Setup1.exe
3036 IntelRapid.exe
2428 UninsHs.exe
964 KMSELDI.exe
2852 AutoPico.exe
2016 KMSELDI.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	Setup1.exe

pid	process
2840	Setup.exe
2684	KMSpico.exe
2772	KMSpico.tmp
2720	Setup1.exe
3036	IntelRapid.exe
2428	UninsHs.exe
964	KMSELDI.exe
2852	AutoPico.exe
2016	KMSELDI.exe

Loads dropped DLL 25 IoCs

Processes:

КМSрiсо.exeKMSpico.exeKMSpico.tmpSetup1.exeUninsHs.exe

pid	process
948	КМSрiсо.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
2684	KMSpico.exe
948	КМSрiсо.exe
948	КМSрiсо.exe
2772	KMSpico.tmp
2772	KMSpico.tmp
852
2720	Setup1.exe
2720	Setup1.exe
2720	Setup1.exe
2772	KMSpico.tmp
2772	KMSpico.tmp
2772	KMSpico.tmp
2772	KMSpico.tmp
2428	UninsHs.exe
2428	UninsHs.exe
2428	UninsHs.exe
2772	KMSpico.tmp
2772	KMSpico.tmp

Themida packer 20 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Program Files (x86)\folder1\Setup.exe	themida
behavioral1/memory/948-16-0x0000000003A10000-0x00000000040EE000-memory.dmp	themida
behavioral1/memory/2840-21-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/2840-42-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/2720-65-0x000000013F5F0000-0x000000013FF14000-memory.dmp	themida
C:\Program Files (x86)\folder1\Setup1.exe	themida
behavioral1/memory/2720-64-0x000000013F5F0000-0x000000013FF14000-memory.dmp	themida
behavioral1/memory/2720-63-0x000000013F5F0000-0x000000013FF14000-memory.dmp	themida
behavioral1/memory/2720-62-0x000000013F5F0000-0x000000013FF14000-memory.dmp	themida
behavioral1/memory/3036-81-0x000000013F640000-0x000000013FF64000-memory.dmp	themida
behavioral1/memory/2720-80-0x000000013F5F0000-0x000000013FF14000-memory.dmp	themida
behavioral1/memory/2840-41-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/2840-36-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/2840-35-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/3036-82-0x000000013F640000-0x000000013FF64000-memory.dmp	themida
behavioral1/memory/2840-86-0x0000000000350000-0x0000000000A2E000-memory.dmp	themida
behavioral1/memory/3036-83-0x000000013F640000-0x000000013FF64000-memory.dmp	themida
behavioral1/memory/3036-84-0x000000013F640000-0x000000013FF64000-memory.dmp	themida
behavioral1/memory/3036-89-0x000000013F640000-0x000000013FF64000-memory.dmp	themida
behavioral1/memory/3036-1077-0x000000013F640000-0x000000013FF64000-memory.dmp	themida

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Program Files\KMSpico\UninsHs.exe	upx
behavioral1/memory/2772-896-0x0000000000600000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/2772-900-0x0000000000830000-0x0000000000847000-memory.dmp	upx
behavioral1/memory/2428-907-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2428-912-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup1.exeIntelRapid.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Drops file in System32 directory 3 IoCs

Processes:

KMSpico.tmp

description	ioc	process
File created	C:\Windows\system32\is-QSNG2.tmp	KMSpico.tmp
File created	C:\Windows\system32\is-MUHAA.tmp	KMSpico.tmp
File opened for modification	C:\Windows\system32\Vestris.ResourceLib.dll	KMSpico.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Setup.exeSetup1.exeIntelRapid.exe

pid process

2840 Setup.exe
2720 Setup1.exe
3036 IntelRapid.exe

pid	process
2840	Setup.exe
2720	Setup1.exe
3036	IntelRapid.exe

Drops file in Program Files directory 64 IoCs

Processes:

KMSpico.tmp

description	ioc	process
File opened for modification	C:\Program Files\KMSpico\UninsHs.exe	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-OI9NT.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-33D8P.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-PGKQ9.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-BAO2D.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-FD92T.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-BCFVO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-I3GD3.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-7QV9C.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\icons\is-GRGJO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-D8EJ4.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-E33CH.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\is-JHLT2.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-S02LI.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-I5OSH.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-5VFHF.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-7U252.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-863HA.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-ER4D3.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-83M4Q.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-N4TAP.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-P47FU.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-P44PT.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-2JNUD.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-52AR2.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-22U6U.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-JKORJ.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-OHKFN.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TJL8H.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-1GT8C.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-VTES9.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-V2S4O.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-L85NE.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-5B2UL.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-AOJ7L.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SNIP2.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-GLRBI.tmp	KMSpico.tmp
File opened for modification	C:\Program Files\KMSpico\Service_KMS.exe	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-17ARS.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-79225.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-8O0MJ.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-A5L2U.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\scripts\is-CFNVO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-BIQLB.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-MCQRU.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-THR04.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-55GKF.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-HH78M.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-2JFAH.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\driver\is-RUHJ1.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-Q8UP5.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-POCR6.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\is-J4VEH.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-2HK9N.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-HCSFA.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW10\Core\is-5QAFB.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-6UM01.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Business\is-J9981.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-F75PV.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-3JBKO.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-OQKLF.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-3APAV.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-NJU94.tmp	KMSpico.tmp
File created	C:\Program Files\KMSpico\sounds\is-PMMDI.tmp	KMSpico.tmp

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2332 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2332	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2112 timeout.exe

pid	process
2112	timeout.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

AutoPico.exeKMSELDI.exeKMSELDI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	AutoPico.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	KMSELDI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\PaintDesktopVersion = "0"	KMSELDI.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

KMSpico.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	KMSpico.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	KMSpico.tmp

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1940 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

3036 IntelRapid.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Setup.exeKMSpico.tmp

pid process

2840 Setup.exe
2772 KMSpico.tmp
2772 KMSpico.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

KMSpico.tmp

pid process

2772 KMSpico.tmp

pid	process
1940	schtasks.exe

pid	process
3036	IntelRapid.exe

pid	process
2840	Setup.exe
2772	KMSpico.tmp
2772	KMSpico.tmp

pid	process
2772	KMSpico.tmp

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

KMSELDI.exeAUDIODG.EXEKMSELDI.exe

description	pid	process
Token: SeSystemtimePrivilege	964	KMSELDI.exe
Token: 33	2332	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2332	AUDIODG.EXE
Token: 33	2332	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2332	AUDIODG.EXE
Token: SeSystemtimePrivilege	2016	KMSELDI.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

KMSpico.tmp

pid process

2772 KMSpico.tmp

pid	process
2772	KMSpico.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

КМSрiсо.exeKMSpico.exeSetup1.exeSetup.execmd.exeKMSpico.tmpcmd.execmd.exe

description	pid	process	target process
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2840	948	КМSрiсо.exe	Setup.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 948 wrote to memory of 2684	948	КМSрiсо.exe	KMSpico.exe
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 2684 wrote to memory of 2772	2684	KMSpico.exe	KMSpico.tmp
PID 948 wrote to memory of 2720	948	КМSрiсо.exe	Setup1.exe
PID 948 wrote to memory of 2720	948	КМSрiсо.exe	Setup1.exe
PID 948 wrote to memory of 2720	948	КМSрiсо.exe	Setup1.exe
PID 948 wrote to memory of 2720	948	КМSрiсо.exe	Setup1.exe
PID 2720 wrote to memory of 3036	2720	Setup1.exe	IntelRapid.exe
PID 2720 wrote to memory of 3036	2720	Setup1.exe	IntelRapid.exe
PID 2720 wrote to memory of 3036	2720	Setup1.exe	IntelRapid.exe
PID 2840 wrote to memory of 2052	2840	Setup.exe	cmd.exe
PID 2840 wrote to memory of 2052	2840	Setup.exe	cmd.exe
PID 2840 wrote to memory of 2052	2840	Setup.exe	cmd.exe
PID 2840 wrote to memory of 2052	2840	Setup.exe	cmd.exe
PID 2052 wrote to memory of 2112	2052	cmd.exe	timeout.exe
PID 2052 wrote to memory of 2112	2052	cmd.exe	timeout.exe
PID 2052 wrote to memory of 2112	2052	cmd.exe	timeout.exe
PID 2052 wrote to memory of 2112	2052	cmd.exe	timeout.exe
PID 2772 wrote to memory of 3000	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 3000	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 3000	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 3000	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 1080	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 1080	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 1080	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 1080	2772	KMSpico.tmp	cmd.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 2772 wrote to memory of 2428	2772	KMSpico.tmp	UninsHs.exe
PID 1080 wrote to memory of 1940	1080	cmd.exe	schtasks.exe
PID 1080 wrote to memory of 1940	1080	cmd.exe	schtasks.exe
PID 1080 wrote to memory of 1940	1080	cmd.exe	schtasks.exe
PID 2772 wrote to memory of 964	2772	KMSpico.tmp	KMSELDI.exe
PID 2772 wrote to memory of 964	2772	KMSpico.tmp	KMSELDI.exe
PID 2772 wrote to memory of 964	2772	KMSpico.tmp	KMSELDI.exe
PID 2772 wrote to memory of 964	2772	KMSpico.tmp	KMSELDI.exe
PID 3000 wrote to memory of 2332	3000	cmd.exe	sc.exe
PID 3000 wrote to memory of 2332	3000	cmd.exe	sc.exe
PID 3000 wrote to memory of 2332	3000	cmd.exe	sc.exe
PID 2772 wrote to memory of 2852	2772	KMSpico.tmp	AutoPico.exe
PID 2772 wrote to memory of 2852	2772	KMSpico.tmp	AutoPico.exe
PID 2772 wrote to memory of 2852	2772	KMSpico.tmp	AutoPico.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\КМSрiсо.exe
"C:\Users\Admin\AppData\Local\Temp\КМSрiсо.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948

C:\Program Files (x86)\folder1\Setup.exe
"C:\Program Files (x86)\folder1\Setup.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\AesTErIucwf & timeout 4 & del /f /q "C:\Program Files (x86)\folder1\Setup.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2052

C:\Windows\SysWOW64\timeout.exe
timeout 4
4⤵
- Delays execution with timeout.exe
PID:2112

C:\Program Files (x86)\folder1\KMSpico.exe
"C:\Program Files (x86)\folder1\KMSpico.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684

C:\Users\Admin\AppData\Local\Temp\is-2C2CQ.tmp\KMSpico.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2C2CQ.tmp\KMSpico.tmp" /SL5="$301DE,2952592,69120,C:\Program Files (x86)\folder1\KMSpico.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer Phishing Filter
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
4⤵
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\system32\sc.exe
sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
5⤵
- Launches sc.exe
PID:2332

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
4⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\system32\schtasks.exe
SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
5⤵
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Program Files\KMSpico\UninsHs.exe
"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Program Files (x86)\folder1\KMSpico.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428

C:\Program Files\KMSpico\KMSELDI.exe
"C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
4⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Program Files\KMSpico\AutoPico.exe
"C:\Program Files\KMSpico\AutoPico.exe" /silent
4⤵
- Executes dropped EXE
- Modifies Control Panel
PID:2852

C:\Program Files (x86)\folder1\Setup1.exe
"C:\Program Files (x86)\folder1\Setup1.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:3036

C:\Program Files\KMSpico\KMSELDI.exe
"C:\Program Files\KMSpico\KMSELDI.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2864

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2604

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\folder1\Setup1.exe
Filesize
3.4MB

MD5
150be50312a4f6c64f292c5ddc2367ae

SHA1
c3e19926be108631b2497e6c03796fd30df6d557

SHA256
8534e712f977ab6f7caee080f4281fdaf08337f209e92d1dae23bbff80fe6c41

SHA512
2bfaece5af3a6a3fc78da6c9dabae95c5d7a8bc222f3a84531dc4619e671fb7f0ee09a3973cc2d720ed6e16ea38ae67f5937f0cc74b4278576b54c10a4658ee1

Download Submit
C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll
Filesize
5.2MB

MD5
1397b23f30681f97049df61f94f54d05

SHA1
5cb1ce6966e3d6d8b8c398cbd537c814312f194d

SHA256
fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609

SHA512
7d001b5942dad8ce1a83831b5a87f2fa6a1571bc133ce3c1ebe9988a43a7fcefc5cdb7870a6e692ef89fb815cfcff0e9c4b41f24ba0716c6808f190ea3c53535

Download Submit
C:\Program Files\KMSpico\logs\AutoPico.log
Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Program Files\KMSpico\logs\KMSELDI.log
Filesize
5KB

MD5
08a37069fc267890a94f48d5860b2eca

SHA1
dd32f0f91d21626c51b4e1beaad8e9710ce69676

SHA256
734403cf6449cf24800a41d75324ca0c3890564cfe045bdc8ee50a7408405957

SHA512
1a491d635b1d82941284c7f3f4a3e2ccfeea1dd3b3c9a3b5f43f93f5727c7069b017716497e93768b12d02e684749e65d80ed9d9972ce29c1b40223399fbf9b8

Download Submit
C:\Program Files\KMSpico\logs\KMSELDI.log
Filesize
3KB

MD5
74d72ba1d1a764fcb0621d226ddd3d74

SHA1
5bf02a4f2118c02ab3479fd19ec60e609115ee23

SHA256
bdce92265303948321356c956e7c4ef5c57fa6a1e8e28913b05e86c375e15c2e

SHA512
fe55177def23b74a13f40cd79b7c3bac5e22bd9768ea8e239a33307c3aace0632661f2fe80453bff20aafb6b52dbaa2f65fac6022c838fb44e66bccf9845d0f3

Download Submit
C:\Program Files\KMSpico\logs\KMSELDI.log
Filesize
2KB

MD5
c48b80793129798a5948b85fd33dd5a4

SHA1
a9217c68f654939da649a796f11d265a3cda7e50

SHA256
9a1c09b25d903e51a3c6065f34c5d927b5b2a53b271559bd7f9e20c113e3dbda

SHA512
6146365d820fa2c20a3fc74a7b1d171562629ae2698f7f148881a85b8ae502ccbae3747bddd5e54f1b5bb9d892da96803d282d354f1f458449c3bc979e6ffcde

Download Submit
C:\Program Files\KMSpico\logs\KMSELDI.log
Filesize
4KB

MD5
8fdb0861fe394588a4a7f2e48b02ae54

SHA1
6ba987c679117ed4fb6401f7eef91384c7c42e4b

SHA256
64822a365bcb094f42d629f3d9eda1059ca48e2cea854058e307bbd7fb6e4ef5

SHA512
ada64c1a8ab6ed43518ca5c9dd43a99e8c98cb5f05ad6337b5bb19221fde5c4518ebaa3ae777aa10328e5778b91a971be9ccea791c305d213d035e4978d0a562

Download Submit
C:\Program Files\KMSpico\logs\KMSELDI.log
Filesize
4KB

MD5
4f662619f5d32e852eec5dfaebc3a70d

SHA1
d6fb7a26c12c78b3637b4d5be9954a92aa402094

SHA256
f100e90331e31f2f34a4f9e800498147e62b4e58a1305c2487e367d6f2a6ff3b

SHA512
e3a9e6020417c2bdf764ff636abd828bf994c0353113f52a2b7a3365cfcfb6fcb6b0a6b635960fc449a85ec446d61865a96aff645487a16d05d6db298400dfbc

Download Submit
C:\Program Files\KMSpico\scripts\Install_Service.cmd
Filesize
213B

MD5
9107cd31951f2cf90e0892740b9087c9

SHA1
efac5c2e59ddef2f0a7782ad1dea8f6b25a07395

SHA256
11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c

SHA512
f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457

Download Submit
C:\Program Files\KMSpico\scripts\Install_Task.cmd
Filesize
220B

MD5
ade709ca6a00370a4a6fea2425f948c1

SHA1
5919c95ef78bd4ab200f8071b98970ff9541a24a

SHA256
5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8

SHA512
860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53

Download Submit
C:\Program Files\KMSpico\sounds\affirmative.mp3
Filesize
4KB

MD5
249dca86cbb375d84b52ed4eb5cefdc6

SHA1
244c2ce65343dcfa613c26c94fa8255c7e6789fe

SHA256
e7fc9406c360d22ed281fb415a2eec396b6a7d0c733c828b2a8c106a30753de5

SHA512
84cb0128518618b3142276e7f84f0fdf42b4e662699d822b96957f7ee31630d55eb432148c7f204bd3be46efedc2eea5ea703f3795ffd9edb7181a1e748fb947

Download Submit
C:\Program Files\KMSpico\sounds\begin.mp3
Filesize
9KB

MD5
f33f2a16a46920b5c8227ffd558060b2

SHA1
a8f7192d34d585a981b5a2ea92b04a21a17b67a8

SHA256
443d23bd2705246cd64ff39d61b999ab74be6d60db1703d6782bb0d36a20eef3

SHA512
9cf3f48adfae4c7ff8bf60f313939c956b331373bd262f5b4a25fbb04d79b86abc5d73204d5c21a8e6f8f3fd51e503016a1f930e1dc2ea6696c3c7e056af7361

Download Submit
C:\Program Files\KMSpico\sounds\complete.mp3
Filesize
5KB

MD5
0d0e8e30d6007cf99f3951424e1d88e6

SHA1
56a6a3a39a5c9210e97a27190464cd25014db68c

SHA256
4d73c58c680396759508b34b169d1fd9c6aa292141c7c58634842a92d68d3c7b

SHA512
8c2ad7488e52af3aabcbbfddefe0e82c594401e279b07f5f4096b695e6f365e932085a8b4b01c91b3e29cba0fa3b0f160537d4962daed70a74854b55e67f8541

Download Submit
C:\Program Files\KMSpico\sounds\diagnostic.mp3
Filesize
13KB

MD5
06c9a7d36b9b6390faa90ca9c0650bee

SHA1
a27a0fdc48c678a9bd34b379d4f4e2c0e9776a9c

SHA256
2445c403447490dd7227617f7e8017da429ad65985fe013c6662906af15da4b0

SHA512
00aec80c11219c86f52c1984f8f40f992e24b6aeda1a953b20891ecd8976cdd767aa78c066924ee5c732e10149449dadc4dc7425e5ba3be9c8ca0fc150498bc9

Download Submit
C:\Program Files\KMSpico\sounds\inputok.mp3
Filesize
2KB

MD5
28a23b81aefec1336a1046671dc5af30

SHA1
5c89b9b708d26cd44af9635fce8c0abd1fb71433

SHA256
0131a883e4b66e77becc17594a386bcd69e04f1e5185e4ae8a554fc3a39bb81a

SHA512
bc300f57b91a13ec31c9722c87004ea560fee7c6bedb12703281827163734819edaf3a22e322dd7f39c192ac0c319b34171a36dd9190985be33d106fa19a30bb

Download Submit
C:\Program Files\KMSpico\sounds\processing.mp3
Filesize
6KB

MD5
fa3dfa3bd735d73281f10a91d593d52a

SHA1
4e859fc874b61d09f0c63714385cb73843fb07e7

SHA256
9390c99249423929fb82c2aad89e19249e493e4845d0c8babc99e1b594643f34

SHA512
bb3908c9458e1494a83a33532e6e165a05acacfe44820cda5c82d70e3662e7b9571c7020d9720a694f8b91e41284779b5df09d300193a46e70656d449310aa4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2C2CQ.tmp\KMSpico.tmp
Filesize
703KB

MD5
1778c1f66ff205875a6435a33229ab3c

SHA1
5b6189159b16c6f85feed66834af3e06c0277a19

SHA256
95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

SHA512
8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

Download Submit
C:\Windows\System32\Vestris.ResourceLib.dll
Filesize
88KB

MD5
3d733144477cadcf77009ef614413630

SHA1
0a530a2524084f1d2a85b419f033e1892174ab31

SHA256
392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3

SHA512
be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c

Download Submit
\Program Files (x86)\folder1\KMSpico.exe
Filesize
3.1MB

MD5
a02164371a50c5ff9fa2870ef6e8cfa3

SHA1
060614723f8375ecaad8b249ff07e3be082d7f25

SHA256
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

SHA512
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

Download Submit
\Program Files (x86)\folder1\Setup.exe
Filesize
2.6MB

MD5
eb2960160f8d4ba6fbda91efc9ff91bc

SHA1
80e599ff8e0e43a30a9edab0eafda30d1bc78f8a

SHA256
e1aa011c4654ad6d4e7aa8752325c3a0a6254439bd26b47bb854aaaf512d1ad6

SHA512
9849d4e692308b9ef364926db3d0848a2992e60750da2cd74bc5691ad0c1a76417a85744a9bda8a43d8064643a0e060685d809d9f199ca2751edfc80c902468f

Download Submit
\Program Files\KMSpico\AutoPico.exe
Filesize
728KB

MD5
cfe1c391464c446099a5eb33276f6d57

SHA1
9999bfcded2c953e025eabaa66b4971dab122c24

SHA256
4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa

SHA512
4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4

Download Submit
\Program Files\KMSpico\KMSELDI.exe
Filesize
921KB

MD5
f0280de3880ef581bf14f9cc72ec1c16

SHA1
43d348e164c35f9e02370f6f66186fbfb15ae2a3

SHA256
50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

SHA512
ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

Download Submit
\Program Files\KMSpico\UninsHs.exe
Filesize
29KB

MD5
245824502aefe21b01e42f61955aa7f4

SHA1
a58682a8aae6302f1c934709c5aa1f6c86b2be99

SHA256
0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

SHA512
204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

Download Submit
\Users\Admin\AppData\Local\Temp\is-V0QK0.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/948-17-0x0000000003A10000-0x00000000040EE000-memory.dmp

Filesize
6.9MB

Download
memory/948-16-0x0000000003A10000-0x00000000040EE000-memory.dmp

Filesize
6.9MB

Download
memory/964-918-0x0000000001060000-0x000000000114A000-memory.dmp

Filesize
936KB

Download
memory/964-920-0x000000001B330000-0x000000001B870000-memory.dmp

Filesize
5.2MB

Download
memory/2016-1041-0x000000001B560000-0x000000001BAA0000-memory.dmp

Filesize
5.2MB

Download
memory/2428-907-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2428-912-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2428-908-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2428-909-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2684-87-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2684-1039-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2684-37-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2720-80-0x000000013F5F0000-0x000000013FF14000-memory.dmp

Filesize
9.1MB

Download
memory/2720-72-0x000000013F280000-0x000000013F290000-memory.dmp

Filesize
64KB

Download
memory/2720-65-0x000000013F5F0000-0x000000013FF14000-memory.dmp

Filesize
9.1MB

Download
memory/2720-64-0x000000013F5F0000-0x000000013FF14000-memory.dmp

Filesize
9.1MB

Download
memory/2720-63-0x000000013F5F0000-0x000000013FF14000-memory.dmp

Filesize
9.1MB

Download
memory/2720-62-0x000000013F5F0000-0x000000013FF14000-memory.dmp

Filesize
9.1MB

Download
memory/2772-896-0x0000000000600000-0x0000000000608000-memory.dmp

Filesize
32KB

Download
memory/2772-318-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2772-88-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2772-1038-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2772-900-0x0000000000830000-0x0000000000847000-memory.dmp

Filesize
92KB

Download
memory/2840-86-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-21-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-41-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-35-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-42-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-36-0x0000000000350000-0x0000000000A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2852-995-0x0000000001380000-0x000000000143A000-memory.dmp

Filesize
744KB

Download
memory/3036-83-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download
memory/3036-82-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download
memory/3036-1077-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download
memory/3036-89-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download
memory/3036-81-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download
memory/3036-84-0x000000013F640000-0x000000013FF64000-memory.dmp

Filesize
9.1MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads