sality | 0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll
Size

120KB
MD5

7ab39f0c4fafd69063933a71631ee7b0
SHA1

66ec13af73bf31dbb13652112a228ef4490bfb02
SHA256

0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17
SHA512

b197da767ab80f0b46ce5b2095ad972433a82fe45537e8ab1c842dd5a947e2c20c318c04f5b2213f9410853894880f7786ce7f714806466c52149f5e5d4c343e
SSDEEP

3072:mDWepspMFJVFUTDOa0bsNFyKCPZXwoiE:wspMWDO9b6kwoi

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f766f18.exef766b8f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f766b8f.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766b8f.exef766f18.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f18.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766b8f.exef766f18.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766f18.exe

Executes dropped EXE 3 IoCs

Processes:

f766b8f.exef766f18.exef7682a7.exe

pid process

2940 f766b8f.exe
2604 f766f18.exe
1912 f7682a7.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1900 rundll32.exe
1900 rundll32.exe
1900 rundll32.exe
1900 rundll32.exe
1900 rundll32.exe
1900 rundll32.exe

pid	process
2940	f766b8f.exe
2604	f766f18.exe
1912	f7682a7.exe

pid	process
1900	rundll32.exe
1900	rundll32.exe
1900	rundll32.exe
1900	rundll32.exe
1900	rundll32.exe
1900	rundll32.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2940-11-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-16-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-15-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-13-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-18-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-17-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-20-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-21-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-19-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-14-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-59-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-60-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-61-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-62-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-63-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-66-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-78-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-79-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-81-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-82-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-103-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2940-145-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2604-164-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/2604-170-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f766f18.exef766b8f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766f18.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766b8f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f766f18.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f766b8f.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f766b8f.exef766f18.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f18.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f766b8f.exe

description	ioc	process
File opened (read-only)	\??\E:	f766b8f.exe
File opened (read-only)	\??\K:	f766b8f.exe
File opened (read-only)	\??\L:	f766b8f.exe
File opened (read-only)	\??\O:	f766b8f.exe
File opened (read-only)	\??\Q:	f766b8f.exe
File opened (read-only)	\??\G:	f766b8f.exe
File opened (read-only)	\??\I:	f766b8f.exe
File opened (read-only)	\??\H:	f766b8f.exe
File opened (read-only)	\??\N:	f766b8f.exe
File opened (read-only)	\??\P:	f766b8f.exe
File opened (read-only)	\??\R:	f766b8f.exe
File opened (read-only)	\??\J:	f766b8f.exe
File opened (read-only)	\??\M:	f766b8f.exe
File opened (read-only)	\??\S:	f766b8f.exe

Drops file in Windows directory 3 IoCs

Processes:

f766b8f.exef766f18.exe

description ioc process

File created C:\Windows\f766c98 f766b8f.exe
File opened for modification C:\Windows\SYSTEM.INI f766b8f.exe
File created C:\Windows\f76bd85 f766f18.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f766b8f.exe

pid process

2940 f766b8f.exe
2940 f766b8f.exe

description	ioc	process
File created	C:\Windows\f766c98	f766b8f.exe
File opened for modification	C:\Windows\SYSTEM.INI	f766b8f.exe
File created	C:\Windows\f76bd85	f766f18.exe

pid	process
2940	f766b8f.exe
2940	f766b8f.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f766b8f.exe

description	pid	process
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe
Token: SeDebugPrivilege	2940	f766b8f.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef766b8f.exe

description	pid	process	target process
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 2096 wrote to memory of 1900	2096	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 2940	1900	rundll32.exe	f766b8f.exe
PID 1900 wrote to memory of 2940	1900	rundll32.exe	f766b8f.exe
PID 1900 wrote to memory of 2940	1900	rundll32.exe	f766b8f.exe
PID 1900 wrote to memory of 2940	1900	rundll32.exe	f766b8f.exe
PID 2940 wrote to memory of 1208	2940	f766b8f.exe	taskhost.exe
PID 2940 wrote to memory of 1272	2940	f766b8f.exe	Dwm.exe
PID 2940 wrote to memory of 1308	2940	f766b8f.exe	Explorer.EXE
PID 2940 wrote to memory of 2008	2940	f766b8f.exe	DllHost.exe
PID 2940 wrote to memory of 2096	2940	f766b8f.exe	rundll32.exe
PID 2940 wrote to memory of 1900	2940	f766b8f.exe	rundll32.exe
PID 2940 wrote to memory of 1900	2940	f766b8f.exe	rundll32.exe
PID 1900 wrote to memory of 2604	1900	rundll32.exe	f766f18.exe
PID 1900 wrote to memory of 2604	1900	rundll32.exe	f766f18.exe
PID 1900 wrote to memory of 2604	1900	rundll32.exe	f766f18.exe
PID 1900 wrote to memory of 2604	1900	rundll32.exe	f766f18.exe
PID 1900 wrote to memory of 1912	1900	rundll32.exe	f7682a7.exe
PID 1900 wrote to memory of 1912	1900	rundll32.exe	f7682a7.exe
PID 1900 wrote to memory of 1912	1900	rundll32.exe	f7682a7.exe
PID 1900 wrote to memory of 1912	1900	rundll32.exe	f7682a7.exe
PID 2940 wrote to memory of 1208	2940	f766b8f.exe	taskhost.exe
PID 2940 wrote to memory of 1272	2940	f766b8f.exe	Dwm.exe
PID 2940 wrote to memory of 1308	2940	f766b8f.exe	Explorer.EXE
PID 2940 wrote to memory of 2604	2940	f766b8f.exe	f766f18.exe
PID 2940 wrote to memory of 2604	2940	f766b8f.exe	f766f18.exe
PID 2940 wrote to memory of 1912	2940	f766b8f.exe	f7682a7.exe
PID 2940 wrote to memory of 1912	2940	f766b8f.exe	f7682a7.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f766b8f.exef766f18.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766b8f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f766f18.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1208

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1272

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1308

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0caa5b9c9430e8696ae7b643ac0e88632ea339d90020ec485c69032f0dd40e17_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\f766b8f.exe
C:\Users\Admin\AppData\Local\Temp\f766b8f.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2940

C:\Users\Admin\AppData\Local\Temp\f766f18.exe
C:\Users\Admin\AppData\Local\Temp\f766f18.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2604

C:\Users\Admin\AppData\Local\Temp\f7682a7.exe
C:\Users\Admin\AppData\Local\Temp\f7682a7.exe
4⤵
- Executes dropped EXE
PID:1912

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2008

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
fd3f0eb1eb08e417a75ef0b62e718e41

SHA1
a9a321cb1eea73b7dc2ac217febb987aceb1689e

SHA256
a5050f4021ae6118a916adec2e0af048f69d841b951818fa2814c78711e28600

SHA512
4c660ceb63a499d27dd0180be0513fb343330467f8c2925a09b13dd2e18c804aebbe46336737e1a493ede756d089b4af6b87c0edced1d3d86274c6d648aca346

Download Submit
\Users\Admin\AppData\Local\Temp\f766b8f.exe
Filesize
97KB

MD5
f7475bb3248cccbf83f2798850c4ec74

SHA1
8492237f2e165e3f9376228a0f51e377e9a41937

SHA256
0cfb56aaefd721b772d6fc60b15c8bf4b557261d715bc0df34f9806b0327ea16

SHA512
b024a03c7ab27dabae991cad0f7db2004c609500a3f1c714064416b9c95730002c48b6256c0bb05c0127918c6e8e078a8c17f3a2ad3985313d5c565f334d7946

Download Submit
memory/1208-27-0x0000000001CC0000-0x0000000001CC2000-memory.dmp

Filesize
8KB

Download
memory/1900-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1900-74-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1900-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1900-53-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1900-35-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1900-56-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1900-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1900-34-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1900-55-0x0000000000410000-0x0000000000422000-memory.dmp

Filesize
72KB

Download
memory/1900-44-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1912-175-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1912-104-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1912-100-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1912-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1912-101-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2604-171-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2604-102-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2604-94-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2604-93-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2604-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2604-164-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2604-170-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2940-14-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-60-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-61-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-62-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-63-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-59-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-19-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-66-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-78-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-79-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-81-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-82-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-21-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-20-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-17-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-18-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-54-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/2940-13-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-103-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-145-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-15-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-45-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2940-43-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2940-16-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2940-11-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads