sality | 2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d

Analysis

max time kernel
25s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll
Size

120KB
MD5

943a35338aef0ac7a6711ed208231ae0
SHA1

c5653d29a00717a150d3d06c56aa7eeffadc53be
SHA256

2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d
SHA512

39c941ef89bef53a874f6049ec57632ebde58898c7b0b1d6506356a36d46c69e1c2254a8abb5546f4a14a071beb31e9d19f5ea77757d499fdf50099277d24f09
SSDEEP

1536:judG1BlsLHd1RoGUZ46rL9FvY3r8AqIWSd4Zw/WPyMxA10BN/r768z9fRqoIGxyw:6dYl0D7UmwHw78tIH6Aw28z94bY

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f763f9f.exef762424.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f763f9f.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f762424.exef763f9f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763f9f.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f763f9f.exef762424.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763f9f.exe

Executes dropped EXE 3 IoCs

Processes:

f762424.exef7625c9.exef763f9f.exe

pid process

2348 f762424.exe
2696 f7625c9.exe
1944 f763f9f.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2156 rundll32.exe
2156 rundll32.exe
2156 rundll32.exe
2156 rundll32.exe
2156 rundll32.exe
2156 rundll32.exe

pid	process
2348	f762424.exe
2696	f7625c9.exe
1944	f763f9f.exe

pid	process
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe
2156	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2348-12-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-14-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-18-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-20-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-15-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-16-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-21-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-19-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-17-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-22-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-63-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-64-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-65-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-66-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-67-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-69-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-70-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-83-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-86-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-88-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-105-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-106-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-119-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/2348-157-0x00000000005F0000-0x00000000016AA000-memory.dmp	upx
behavioral1/memory/1944-171-0x0000000000910000-0x00000000019CA000-memory.dmp	upx
behavioral1/memory/1944-208-0x0000000000910000-0x00000000019CA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f762424.exef763f9f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763f9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763f9f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f763f9f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f763f9f.exef762424.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763f9f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762424.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f762424.exef763f9f.exe

description	ioc	process
File opened (read-only)	\??\G:	f762424.exe
File opened (read-only)	\??\H:	f762424.exe
File opened (read-only)	\??\J:	f762424.exe
File opened (read-only)	\??\K:	f762424.exe
File opened (read-only)	\??\M:	f762424.exe
File opened (read-only)	\??\O:	f762424.exe
File opened (read-only)	\??\Q:	f762424.exe
File opened (read-only)	\??\E:	f762424.exe
File opened (read-only)	\??\R:	f762424.exe
File opened (read-only)	\??\N:	f762424.exe
File opened (read-only)	\??\S:	f762424.exe
File opened (read-only)	\??\E:	f763f9f.exe
File opened (read-only)	\??\I:	f762424.exe
File opened (read-only)	\??\P:	f762424.exe
File opened (read-only)	\??\L:	f762424.exe

Drops file in Windows directory 3 IoCs

Processes:

f762424.exef763f9f.exe

description ioc process

File created C:\Windows\f7624a0 f762424.exe
File opened for modification C:\Windows\SYSTEM.INI f762424.exe
File created C:\Windows\f7674c3 f763f9f.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f762424.exef763f9f.exe

pid process

2348 f762424.exe
2348 f762424.exe
1944 f763f9f.exe

description	ioc	process
File created	C:\Windows\f7624a0	f762424.exe
File opened for modification	C:\Windows\SYSTEM.INI	f762424.exe
File created	C:\Windows\f7674c3	f763f9f.exe

pid	process
2348	f762424.exe
2348	f762424.exe
1944	f763f9f.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f762424.exef763f9f.exe

description	pid	process
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	2348	f762424.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe
Token: SeDebugPrivilege	1944	f763f9f.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef762424.exef763f9f.exe

description	pid	process	target process
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2132 wrote to memory of 2156	2132	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 2348	2156	rundll32.exe	f762424.exe
PID 2156 wrote to memory of 2348	2156	rundll32.exe	f762424.exe
PID 2156 wrote to memory of 2348	2156	rundll32.exe	f762424.exe
PID 2156 wrote to memory of 2348	2156	rundll32.exe	f762424.exe
PID 2348 wrote to memory of 1120	2348	f762424.exe	taskhost.exe
PID 2348 wrote to memory of 1180	2348	f762424.exe	Dwm.exe
PID 2348 wrote to memory of 1196	2348	f762424.exe	Explorer.EXE
PID 2348 wrote to memory of 1952	2348	f762424.exe	DllHost.exe
PID 2348 wrote to memory of 2132	2348	f762424.exe	rundll32.exe
PID 2348 wrote to memory of 2156	2348	f762424.exe	rundll32.exe
PID 2348 wrote to memory of 2156	2348	f762424.exe	rundll32.exe
PID 2156 wrote to memory of 2696	2156	rundll32.exe	f7625c9.exe
PID 2156 wrote to memory of 2696	2156	rundll32.exe	f7625c9.exe
PID 2156 wrote to memory of 2696	2156	rundll32.exe	f7625c9.exe
PID 2156 wrote to memory of 2696	2156	rundll32.exe	f7625c9.exe
PID 2156 wrote to memory of 1944	2156	rundll32.exe	f763f9f.exe
PID 2156 wrote to memory of 1944	2156	rundll32.exe	f763f9f.exe
PID 2156 wrote to memory of 1944	2156	rundll32.exe	f763f9f.exe
PID 2156 wrote to memory of 1944	2156	rundll32.exe	f763f9f.exe
PID 2348 wrote to memory of 1120	2348	f762424.exe	taskhost.exe
PID 2348 wrote to memory of 1180	2348	f762424.exe	Dwm.exe
PID 2348 wrote to memory of 1196	2348	f762424.exe	Explorer.EXE
PID 2348 wrote to memory of 2696	2348	f762424.exe	f7625c9.exe
PID 2348 wrote to memory of 2696	2348	f762424.exe	f7625c9.exe
PID 2348 wrote to memory of 1944	2348	f762424.exe	f763f9f.exe
PID 2348 wrote to memory of 1944	2348	f762424.exe	f763f9f.exe
PID 1944 wrote to memory of 1120	1944	f763f9f.exe	taskhost.exe
PID 1944 wrote to memory of 1180	1944	f763f9f.exe	Dwm.exe
PID 1944 wrote to memory of 1196	1944	f763f9f.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f762424.exef763f9f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762424.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763f9f.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\f762424.exe
C:\Users\Admin\AppData\Local\Temp\f762424.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2348

C:\Users\Admin\AppData\Local\Temp\f7625c9.exe
C:\Users\Admin\AppData\Local\Temp\f7625c9.exe
4⤵
- Executes dropped EXE
PID:2696

C:\Users\Admin\AppData\Local\Temp\f763f9f.exe
C:\Users\Admin\AppData\Local\Temp\f763f9f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1944

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1952

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f762424.exe
Filesize
97KB

MD5
121051f0ad19c6d228f7c6878fa0459a

SHA1
7acb9d0626a5065822b437dde7b82052feb62f9a

SHA256
d0ea07cdc6f0512ee21808ccaf1c3d10babf7169337079b3f0cb804a81eb6472

SHA512
3d5a5220e90254944401d2ed8aa160f283c5e3ad526799eb08c80dcd99d85e6b22d32eb9a1bc178c1f33da6d7c4cab28422092ec27ce9472b4dbeae33f868182

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
82752003f549353491fdc7bce8abf94d

SHA1
1349755ad9af8609ad13a9110c2dda543cb12f03

SHA256
b6c045b4553241cac104866a42479c5ad117430a19a4f31c86e4018aeb64d608

SHA512
8c4b6ebde439f1a81d7083eca3772b3c33eaf33cab55f1e6a69571d0f1ee7e3720a8fda5a0e8993acdcfcddffb09eec9ea5891f4a9579a3dc830024588f486fe

Download Submit
memory/1120-23-0x0000000001FF0000-0x0000000001FF2000-memory.dmp

Filesize
8KB

Download
memory/1944-208-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/1944-209-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1944-171-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/1944-104-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1944-101-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1944-102-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1944-82-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2156-33-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2156-54-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2156-42-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2156-32-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2156-9-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2156-8-0x00000000001C0000-0x00000000001D2000-memory.dmp

Filesize
72KB

Download
memory/2156-78-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2156-51-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2156-53-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2348-69-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-88-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-17-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-61-0x00000000004C0000-0x00000000004C2000-memory.dmp

Filesize
8KB

Download
memory/2348-62-0x00000000004C0000-0x00000000004C2000-memory.dmp

Filesize
8KB

Download
memory/2348-22-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-63-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-64-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-65-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-66-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-67-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-16-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-70-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-15-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-19-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-83-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-86-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2348-20-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-18-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-14-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-43-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2348-21-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-12-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-105-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-106-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-119-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2348-153-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2348-157-0x00000000005F0000-0x00000000016AA000-memory.dmp

Filesize
16.7MB

Download
memory/2696-158-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2696-96-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2696-97-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2696-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2696-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads