sality | 063c947da45fb10d79c71c57f21d850923507f660947e464ad36eded9e5a45a7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

063c947da45fb10d79c71c57f21d850923507f660947e464ad36eded9e5a45a7_NeikiAnalytics.dll
Size

120KB
MD5

aacb313020aef4a7fef3ab99010d4fe0
SHA1

32db960d03f4cb86f6a9754f9b0e0d52c2d5d9f8
SHA256

063c947da45fb10d79c71c57f21d850923507f660947e464ad36eded9e5a45a7
SHA512

30504d485db5b4dc24f4fc69c160ca4666e63f12159193d16effa6278c69b01710a644e7d8ea31d73d7f70ed87dcabab1516cade71c9479e438afcc38af5ae83
SSDEEP

1536:qtdC9vlONWPzK1Emwdx5/UIWM/I9d9lW0HxDULltsYKp/qDC25BAQflY6mzh7bBP:q3dEPbmwJh/I9VbRUtsB2EQfGzz/0R0

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761d50.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7640b8.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7640b8.exe

Executes dropped EXE 3 IoCs

Processes:

f761d50.exef761eb7.exef7640b8.exe

pid process

1292 f761d50.exe
2744 f761eb7.exe
1956 f7640b8.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1672 rundll32.exe
1672 rundll32.exe
1672 rundll32.exe
1672 rundll32.exe
1672 rundll32.exe
1672 rundll32.exe

pid	process
1292	f761d50.exe
2744	f761eb7.exe
1956	f7640b8.exe

pid	process
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe
1672	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1292-14-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-16-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-17-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-19-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-22-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-20-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-23-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-21-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-18-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-15-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-61-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-62-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-63-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-64-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-65-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-67-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-68-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-83-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-99-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-102-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-104-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-105-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-106-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1292-145-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1956-166-0x0000000000930000-0x00000000019EA000-memory.dmp	upx
behavioral1/memory/1956-203-0x0000000000930000-0x00000000019EA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761d50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761d50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7640b8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7640b8.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7640b8.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f761d50.exef7640b8.exe

description	ioc	process
File opened (read-only)	\??\H:	f761d50.exe
File opened (read-only)	\??\G:	f7640b8.exe
File opened (read-only)	\??\E:	f7640b8.exe
File opened (read-only)	\??\I:	f7640b8.exe
File opened (read-only)	\??\I:	f761d50.exe
File opened (read-only)	\??\K:	f761d50.exe
File opened (read-only)	\??\M:	f761d50.exe
File opened (read-only)	\??\Q:	f761d50.exe
File opened (read-only)	\??\H:	f7640b8.exe
File opened (read-only)	\??\G:	f761d50.exe
File opened (read-only)	\??\L:	f761d50.exe
File opened (read-only)	\??\O:	f761d50.exe
File opened (read-only)	\??\P:	f761d50.exe
File opened (read-only)	\??\E:	f761d50.exe
File opened (read-only)	\??\J:	f761d50.exe
File opened (read-only)	\??\N:	f761d50.exe

Drops file in Windows directory 3 IoCs

Processes:

f761d50.exef7640b8.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI f761d50.exe
File created C:\Windows\f766dc1 f7640b8.exe
File created C:\Windows\f761d9e f761d50.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f761d50.exef7640b8.exe

pid process

1292 f761d50.exe
1292 f761d50.exe
1956 f7640b8.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	f761d50.exe
File created	C:\Windows\f766dc1	f7640b8.exe
File created	C:\Windows\f761d9e	f761d50.exe

pid	process
1292	f761d50.exe
1292	f761d50.exe
1956	f7640b8.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f761d50.exef7640b8.exe

description	pid	process
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1292	f761d50.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe
Token: SeDebugPrivilege	1956	f7640b8.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef761d50.exef7640b8.exe

description	pid	process	target process
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 1672	2424	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 1292	1672	rundll32.exe	f761d50.exe
PID 1672 wrote to memory of 1292	1672	rundll32.exe	f761d50.exe
PID 1672 wrote to memory of 1292	1672	rundll32.exe	f761d50.exe
PID 1672 wrote to memory of 1292	1672	rundll32.exe	f761d50.exe
PID 1292 wrote to memory of 1104	1292	f761d50.exe	taskhost.exe
PID 1292 wrote to memory of 1168	1292	f761d50.exe	Dwm.exe
PID 1292 wrote to memory of 1192	1292	f761d50.exe	Explorer.EXE
PID 1292 wrote to memory of 2172	1292	f761d50.exe	DllHost.exe
PID 1292 wrote to memory of 2424	1292	f761d50.exe	rundll32.exe
PID 1292 wrote to memory of 1672	1292	f761d50.exe	rundll32.exe
PID 1292 wrote to memory of 1672	1292	f761d50.exe	rundll32.exe
PID 1672 wrote to memory of 2744	1672	rundll32.exe	f761eb7.exe
PID 1672 wrote to memory of 2744	1672	rundll32.exe	f761eb7.exe
PID 1672 wrote to memory of 2744	1672	rundll32.exe	f761eb7.exe
PID 1672 wrote to memory of 2744	1672	rundll32.exe	f761eb7.exe
PID 1672 wrote to memory of 1956	1672	rundll32.exe	f7640b8.exe
PID 1672 wrote to memory of 1956	1672	rundll32.exe	f7640b8.exe
PID 1672 wrote to memory of 1956	1672	rundll32.exe	f7640b8.exe
PID 1672 wrote to memory of 1956	1672	rundll32.exe	f7640b8.exe
PID 1292 wrote to memory of 1104	1292	f761d50.exe	taskhost.exe
PID 1292 wrote to memory of 1168	1292	f761d50.exe	Dwm.exe
PID 1292 wrote to memory of 1192	1292	f761d50.exe	Explorer.EXE
PID 1292 wrote to memory of 2744	1292	f761d50.exe	f761eb7.exe
PID 1292 wrote to memory of 2744	1292	f761d50.exe	f761eb7.exe
PID 1292 wrote to memory of 1956	1292	f761d50.exe	f7640b8.exe
PID 1292 wrote to memory of 1956	1292	f761d50.exe	f7640b8.exe
PID 1956 wrote to memory of 1104	1956	f7640b8.exe	taskhost.exe
PID 1956 wrote to memory of 1168	1956	f7640b8.exe	Dwm.exe
PID 1956 wrote to memory of 1192	1956	f7640b8.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f761d50.exef7640b8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7640b8.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\063c947da45fb10d79c71c57f21d850923507f660947e464ad36eded9e5a45a7_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\063c947da45fb10d79c71c57f21d850923507f660947e464ad36eded9e5a45a7_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\f761d50.exe
C:\Users\Admin\AppData\Local\Temp\f761d50.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1292

C:\Users\Admin\AppData\Local\Temp\f761eb7.exe
C:\Users\Admin\AppData\Local\Temp\f761eb7.exe
4⤵
- Executes dropped EXE
PID:2744

C:\Users\Admin\AppData\Local\Temp\f7640b8.exe
C:\Users\Admin\AppData\Local\Temp\f7640b8.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1956

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2172

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
944d6d0fce233b83829945b07c0a4343

SHA1
7f28a7d7980a8ed33a696771e1ca323f4bd56730

SHA256
8bee8383f19f60dd887e137818412b474cf45f7710c22a8cdf9bd545f6c3a458

SHA512
8b151ed590a1a8c9054cdfb2c5347ba1f0425ff4b20d5296fc6343f15e49bd9654f9004b7dbdf94fef2635d720a1c79681337d16f8a76866287698887976392f

Download Submit
\Users\Admin\AppData\Local\Temp\f761d50.exe
Filesize
97KB

MD5
e7ff8eea59c0e27b881f02bcba97897a

SHA1
218137ca2716839fc9cc790c24c62f6a1954b3da

SHA256
6bdc87ab39bfca820a123c98701e946c4767c06d5cac68a71462b9d5fda0b388

SHA512
60652578218296ed820d80261f0a4005ac76c68365d536cd2876e472277efd08401669334ceaa29db2eb0b5e815e430cf1c039c046627a2131a09e998997e21f

Download Submit
memory/1104-29-0x0000000001F90000-0x0000000001F92000-memory.dmp

Filesize
8KB

Download
memory/1292-17-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-99-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-14-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-16-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-67-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-19-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-22-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-20-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-145-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-106-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-105-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-104-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-102-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-144-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1292-48-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1292-46-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1292-83-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-68-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1292-23-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-21-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-18-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-15-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-61-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-62-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-63-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-64-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1292-65-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1672-59-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1672-51-0x0000000000270000-0x0000000000282000-memory.dmp

Filesize
72KB

Download
memory/1672-80-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download
memory/1672-77-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1672-10-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/1672-45-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1672-9-0x0000000000130000-0x0000000000142000-memory.dmp

Filesize
72KB

Download
memory/1672-35-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1672-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1672-58-0x0000000000270000-0x0000000000282000-memory.dmp

Filesize
72KB

Download
memory/1672-36-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1956-98-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/1956-96-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1956-94-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/1956-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1956-166-0x0000000000930000-0x00000000019EA000-memory.dmp

Filesize
16.7MB

Download
memory/1956-203-0x0000000000930000-0x00000000019EA000-memory.dmp

Filesize
16.7MB

Download
memory/1956-204-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2744-97-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2744-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2744-90-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2744-91-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2744-149-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads