sality | 713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll
Size

120KB
MD5

f8406647db957a8e412f87f264750762
SHA1

2c583c73d2149c1cf7c48e86d220d91027459663
SHA256

713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c
SHA512

5292f186da834d04f85150a6f093c631e0100085d1a1a6c1287d7f1d7f269a2d0f05ee4681f2875a7b69094d21f08abb7948885aa524846bf82b8fc7153a7595
SSDEEP

1536:3MX0jYUqppB21PAZRhY1y8KPl4jXq6mv88/HyyxFS+NQ2noh30PmhBs9OFVwo+Lm:3MEspBQAPhY1tKP+jXqXyyhm30uqBE

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7610a4.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f762c2f.exef7610a4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7610a4.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762c2f.exe

Executes dropped EXE 3 IoCs

Processes:

f7610a4.exef761593.exef762c2f.exe

pid process

3040 f7610a4.exe
2720 f761593.exe
1208 f762c2f.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2996 rundll32.exe
2996 rundll32.exe
2996 rundll32.exe
2996 rundll32.exe
2996 rundll32.exe
2996 rundll32.exe

pid	process
3040	f7610a4.exe
2720	f761593.exe
1208	f762c2f.exe

pid	process
2996	rundll32.exe
2996	rundll32.exe
2996	rundll32.exe
2996	rundll32.exe
2996	rundll32.exe
2996	rundll32.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-12-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-13-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-15-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-18-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-20-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-21-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-19-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-17-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-23-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-22-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-16-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-62-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-63-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-64-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-65-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-66-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-83-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-84-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-107-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-108-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-124-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/3040-148-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1208-164-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/1208-205-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7610a4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7610a4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762c2f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762c2f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762c2f.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
File opened (read-only)	\??\L:	f7610a4.exe
File opened (read-only)	\??\E:	f7610a4.exe
File opened (read-only)	\??\G:	f7610a4.exe
File opened (read-only)	\??\J:	f7610a4.exe
File opened (read-only)	\??\M:	f7610a4.exe
File opened (read-only)	\??\O:	f7610a4.exe
File opened (read-only)	\??\P:	f7610a4.exe
File opened (read-only)	\??\G:	f762c2f.exe
File opened (read-only)	\??\H:	f762c2f.exe
File opened (read-only)	\??\H:	f7610a4.exe
File opened (read-only)	\??\I:	f7610a4.exe
File opened (read-only)	\??\K:	f7610a4.exe
File opened (read-only)	\??\N:	f7610a4.exe
File opened (read-only)	\??\E:	f762c2f.exe

Drops file in Windows directory 3 IoCs

Processes:

f7610a4.exef762c2f.exe

description ioc process

File created C:\Windows\f7610f2 f7610a4.exe
File opened for modification C:\Windows\SYSTEM.INI f7610a4.exe
File created C:\Windows\f7664db f762c2f.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f7610a4.exef762c2f.exe

pid process

3040 f7610a4.exe
3040 f7610a4.exe
1208 f762c2f.exe

description	ioc	process
File created	C:\Windows\f7610f2	f7610a4.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7610a4.exe
File created	C:\Windows\f7664db	f762c2f.exe

pid	process
3040	f7610a4.exe
3040	f7610a4.exe
1208	f762c2f.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f7610a4.exef762c2f.exe

description	pid	process
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	3040	f7610a4.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe
Token: SeDebugPrivilege	1208	f762c2f.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef7610a4.exef762c2f.exe

description	pid	process	target process
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 2996	2976	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 3040	2996	rundll32.exe	f7610a4.exe
PID 2996 wrote to memory of 3040	2996	rundll32.exe	f7610a4.exe
PID 2996 wrote to memory of 3040	2996	rundll32.exe	f7610a4.exe
PID 2996 wrote to memory of 3040	2996	rundll32.exe	f7610a4.exe
PID 3040 wrote to memory of 1112	3040	f7610a4.exe	taskhost.exe
PID 3040 wrote to memory of 1168	3040	f7610a4.exe	Dwm.exe
PID 3040 wrote to memory of 1220	3040	f7610a4.exe	Explorer.EXE
PID 3040 wrote to memory of 1776	3040	f7610a4.exe	DllHost.exe
PID 3040 wrote to memory of 2976	3040	f7610a4.exe	rundll32.exe
PID 3040 wrote to memory of 2996	3040	f7610a4.exe	rundll32.exe
PID 3040 wrote to memory of 2996	3040	f7610a4.exe	rundll32.exe
PID 2996 wrote to memory of 2720	2996	rundll32.exe	f761593.exe
PID 2996 wrote to memory of 2720	2996	rundll32.exe	f761593.exe
PID 2996 wrote to memory of 2720	2996	rundll32.exe	f761593.exe
PID 2996 wrote to memory of 2720	2996	rundll32.exe	f761593.exe
PID 2996 wrote to memory of 1208	2996	rundll32.exe	f762c2f.exe
PID 2996 wrote to memory of 1208	2996	rundll32.exe	f762c2f.exe
PID 2996 wrote to memory of 1208	2996	rundll32.exe	f762c2f.exe
PID 2996 wrote to memory of 1208	2996	rundll32.exe	f762c2f.exe
PID 3040 wrote to memory of 1112	3040	f7610a4.exe	taskhost.exe
PID 3040 wrote to memory of 1168	3040	f7610a4.exe	Dwm.exe
PID 3040 wrote to memory of 1220	3040	f7610a4.exe	Explorer.EXE
PID 3040 wrote to memory of 2720	3040	f7610a4.exe	f761593.exe
PID 3040 wrote to memory of 2720	3040	f7610a4.exe	f761593.exe
PID 3040 wrote to memory of 1208	3040	f7610a4.exe	f762c2f.exe
PID 3040 wrote to memory of 1208	3040	f7610a4.exe	f762c2f.exe
PID 1208 wrote to memory of 1112	1208	f762c2f.exe	taskhost.exe
PID 1208 wrote to memory of 1168	1208	f762c2f.exe	Dwm.exe
PID 1208 wrote to memory of 1220	1208	f762c2f.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f7610a4.exef762c2f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7610a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762c2f.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1220

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\713bb803e7e113423acaf9d3f86244681df70649f807d26f3e63152b81b8660c.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996

C:\Users\Admin\AppData\Local\Temp\f7610a4.exe
C:\Users\Admin\AppData\Local\Temp\f7610a4.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3040

C:\Users\Admin\AppData\Local\Temp\f761593.exe
C:\Users\Admin\AppData\Local\Temp\f761593.exe
4⤵
- Executes dropped EXE
PID:2720

C:\Users\Admin\AppData\Local\Temp\f762c2f.exe
C:\Users\Admin\AppData\Local\Temp\f762c2f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1208

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1776

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f7610a4.exe
Filesize
97KB

MD5
460deea74188ca0c9eba550e8cb11b95

SHA1
f77f3477797862e89f18f7e30f615dab4fc93d28

SHA256
194cb2ea60024645c01298fa56a2b93ec5df2d099e5d378f8dbeb2449307f38e

SHA512
5d10bf5d3ce530901c63cf4827e451a4b767d56b893040e4b5914170b0749671f3d653e521be9bebb59fbb6183dcc39e2b319e821fca76d4173f26661707ec86

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
068ac5e2ce2823ef9c22048fc7aa5ef4

SHA1
4c65e0d5b8b613211a0508d8a40022e673872007

SHA256
b14c4e686aea864b8afdec8890fb81960d50e43a595525aa0add5b53d2ae5c23

SHA512
c8cf4ccf1cbd959094132dbf0ab4df4e4f1cac1334fe3532caa5a3d820d01dea77f7070090a0d02f13a075127cfbcc5657ff76c5639f04b214b7b1f567c6ae41

Download Submit
memory/1112-29-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1208-103-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1208-204-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1208-82-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1208-205-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/1208-164-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/1208-105-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1208-106-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2720-96-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2720-97-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2720-152-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2720-104-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2720-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2996-78-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2996-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2996-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2996-76-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2996-8-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2996-41-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2996-39-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2996-38-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2996-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2996-59-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2996-80-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/2996-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2996-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3040-23-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-64-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-65-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-66-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-63-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-62-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-58-0x00000000016D0000-0x00000000016D2000-memory.dmp

Filesize
8KB

Download
memory/3040-47-0x00000000016E0000-0x00000000016E1000-memory.dmp

Filesize
4KB

Download
memory/3040-49-0x00000000016D0000-0x00000000016D2000-memory.dmp

Filesize
8KB

Download
memory/3040-83-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-84-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-16-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-22-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-17-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-19-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-21-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-20-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-107-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-108-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-124-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-147-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3040-148-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-18-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-15-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-13-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-12-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/3040-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads