sality | 377032bcec88947b06eb24f65c43ffe33bb4fff87ff5039a544bd41de143ac31

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

377032bcec88947b06eb24f65c43ffe33bb4fff87ff5039a544bd41de143ac31_NeikiAnalytics.dll
Size

120KB
MD5

91b4e2142fd84b4a238c3407f4d67b00
SHA1

d925773af48dc363459fad9728cf17b8df5913b2
SHA256

377032bcec88947b06eb24f65c43ffe33bb4fff87ff5039a544bd41de143ac31
SHA512

d96fc7aede6152388938e4129aca89017ce87816268a714ba215e1b263021121ffd89673504ec170bb6d1312be45a13bfc6a52903cfc50c47dbaa26fa7a14a8a
SSDEEP

3072:rbYcq/7/GrLv0S4jpub0+huLqenStOKzntN3:rbYcI/Qv0Ssob/huuHOKz7

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f760e62.exef7629fd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7629fd.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760e62.exef7629fd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7629fd.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7629fd.exef760e62.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760e62.exe

Executes dropped EXE 3 IoCs

Processes:

f760e62.exef760fe8.exef7629fd.exe

pid process

1728 f760e62.exe
2600 f760fe8.exe
760 f7629fd.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1252 rundll32.exe
1252 rundll32.exe
1252 rundll32.exe
1252 rundll32.exe
1252 rundll32.exe
1252 rundll32.exe

pid	process
1728	f760e62.exe
2600	f760fe8.exe
760	f7629fd.exe

pid	process
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe
1252	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1728-19-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-16-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-15-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-17-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-20-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-18-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-23-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-14-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-21-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-22-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-62-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-63-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-64-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-66-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-65-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-68-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-69-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-83-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-85-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-87-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-107-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-108-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/1728-156-0x0000000000630000-0x00000000016EA000-memory.dmp	upx
behavioral1/memory/760-172-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/760-210-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7629fd.exef760e62.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760e62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7629fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7629fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760e62.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f760e62.exef7629fd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7629fd.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760e62.exef7629fd.exe

description	ioc	process
File opened (read-only)	\??\G:	f760e62.exe
File opened (read-only)	\??\O:	f760e62.exe
File opened (read-only)	\??\T:	f760e62.exe
File opened (read-only)	\??\E:	f7629fd.exe
File opened (read-only)	\??\H:	f760e62.exe
File opened (read-only)	\??\N:	f760e62.exe
File opened (read-only)	\??\P:	f760e62.exe
File opened (read-only)	\??\Q:	f760e62.exe
File opened (read-only)	\??\L:	f760e62.exe
File opened (read-only)	\??\M:	f760e62.exe
File opened (read-only)	\??\G:	f7629fd.exe
File opened (read-only)	\??\E:	f760e62.exe
File opened (read-only)	\??\I:	f760e62.exe
File opened (read-only)	\??\J:	f760e62.exe
File opened (read-only)	\??\K:	f760e62.exe
File opened (read-only)	\??\R:	f760e62.exe
File opened (read-only)	\??\S:	f760e62.exe

Drops file in Windows directory 3 IoCs

Processes:

f760e62.exef7629fd.exe

description ioc process

File created C:\Windows\f760eb0 f760e62.exe
File opened for modification C:\Windows\SYSTEM.INI f760e62.exe
File created C:\Windows\f765ed2 f7629fd.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f760e62.exef7629fd.exe

pid process

1728 f760e62.exe
1728 f760e62.exe
760 f7629fd.exe

description	ioc	process
File created	C:\Windows\f760eb0	f760e62.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760e62.exe
File created	C:\Windows\f765ed2	f7629fd.exe

pid	process
1728	f760e62.exe
1728	f760e62.exe
760	f7629fd.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f760e62.exef7629fd.exe

description	pid	process
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	1728	f760e62.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe
Token: SeDebugPrivilege	760	f7629fd.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef760e62.exef7629fd.exe

description	pid	process	target process
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 1252	1488	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 1728	1252	rundll32.exe	f760e62.exe
PID 1252 wrote to memory of 1728	1252	rundll32.exe	f760e62.exe
PID 1252 wrote to memory of 1728	1252	rundll32.exe	f760e62.exe
PID 1252 wrote to memory of 1728	1252	rundll32.exe	f760e62.exe
PID 1728 wrote to memory of 1100	1728	f760e62.exe	taskhost.exe
PID 1728 wrote to memory of 1160	1728	f760e62.exe	Dwm.exe
PID 1728 wrote to memory of 1184	1728	f760e62.exe	Explorer.EXE
PID 1728 wrote to memory of 2376	1728	f760e62.exe	DllHost.exe
PID 1728 wrote to memory of 1488	1728	f760e62.exe	rundll32.exe
PID 1728 wrote to memory of 1252	1728	f760e62.exe	rundll32.exe
PID 1728 wrote to memory of 1252	1728	f760e62.exe	rundll32.exe
PID 1252 wrote to memory of 2600	1252	rundll32.exe	f760fe8.exe
PID 1252 wrote to memory of 2600	1252	rundll32.exe	f760fe8.exe
PID 1252 wrote to memory of 2600	1252	rundll32.exe	f760fe8.exe
PID 1252 wrote to memory of 2600	1252	rundll32.exe	f760fe8.exe
PID 1252 wrote to memory of 760	1252	rundll32.exe	f7629fd.exe
PID 1252 wrote to memory of 760	1252	rundll32.exe	f7629fd.exe
PID 1252 wrote to memory of 760	1252	rundll32.exe	f7629fd.exe
PID 1252 wrote to memory of 760	1252	rundll32.exe	f7629fd.exe
PID 1728 wrote to memory of 1100	1728	f760e62.exe	taskhost.exe
PID 1728 wrote to memory of 1160	1728	f760e62.exe	Dwm.exe
PID 1728 wrote to memory of 1184	1728	f760e62.exe	Explorer.EXE
PID 1728 wrote to memory of 2600	1728	f760e62.exe	f760fe8.exe
PID 1728 wrote to memory of 2600	1728	f760e62.exe	f760fe8.exe
PID 1728 wrote to memory of 760	1728	f760e62.exe	f7629fd.exe
PID 1728 wrote to memory of 760	1728	f760e62.exe	f7629fd.exe
PID 760 wrote to memory of 1100	760	f7629fd.exe	taskhost.exe
PID 760 wrote to memory of 1160	760	f7629fd.exe	Dwm.exe
PID 760 wrote to memory of 1184	760	f7629fd.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f760e62.exef7629fd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7629fd.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\377032bcec88947b06eb24f65c43ffe33bb4fff87ff5039a544bd41de143ac31_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\377032bcec88947b06eb24f65c43ffe33bb4fff87ff5039a544bd41de143ac31_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252

C:\Users\Admin\AppData\Local\Temp\f760e62.exe
C:\Users\Admin\AppData\Local\Temp\f760e62.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1728

C:\Users\Admin\AppData\Local\Temp\f760fe8.exe
C:\Users\Admin\AppData\Local\Temp\f760fe8.exe
4⤵
- Executes dropped EXE
PID:2600

C:\Users\Admin\AppData\Local\Temp\f7629fd.exe
C:\Users\Admin\AppData\Local\Temp\f7629fd.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2376

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
b6e01aedf44429e5e30a540908870efe

SHA1
af08e15ce006bd688a2c65440dd273a075851ba7

SHA256
d417168d269d8c392cc91ee93c0934233aed6abec6c25786bebab79e1a46d7dd

SHA512
53ca1c9aeb950feb340ab2ea8a421d25446877d20b228b2b2fa67a7de49e38868010d23acadb1c9decf560bbeb1fe6f97910a26378b9e18c6e7cfdccdce18adc

Download Submit
\Users\Admin\AppData\Local\Temp\f760e62.exe
Filesize
97KB

MD5
d27ab2c712ad417495a14e618bf171d3

SHA1
4bce12a2be6f76619e308b196464b84d0f358406

SHA256
97debe6cea188ce7495f212e5c822565ec911f53b469480d7f0600079a9c98a9

SHA512
3ca22990aefa96d5e42fbd51d9af178e999b4997456f7fa12b6f774e898423eb2423f9f9679601f4e176ece008a9094141735e116482a21e7e0d9585cdce52df

Download Submit
memory/760-210-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/760-211-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/760-172-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/760-106-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/760-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/760-104-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/760-82-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1100-29-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/1252-36-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1252-56-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1252-10-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1252-37-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1252-9-0x0000000000150000-0x0000000000162000-memory.dmp

Filesize
72KB

Download
memory/1252-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1252-77-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1252-81-0x0000000000150000-0x0000000000152000-memory.dmp

Filesize
8KB

Download
memory/1252-59-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1252-58-0x0000000000270000-0x0000000000282000-memory.dmp

Filesize
72KB

Download
memory/1252-46-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1728-17-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-87-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-14-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-21-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-22-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-62-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-63-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-64-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-66-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-65-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-68-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-69-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-23-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-18-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-83-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-85-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-57-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1728-15-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-16-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-49-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1728-47-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1728-19-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-155-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1728-107-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-108-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-125-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1728-20-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/1728-156-0x0000000000630000-0x00000000016EA000-memory.dmp

Filesize
16.7MB

Download
memory/2600-160-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2600-105-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2600-97-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2600-98-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2600-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads