sality | 575bdace06ed5398d9c53438dbfc920299feb530e8ec4ff051620189f8193634

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

575bdace06ed5398d9c53438dbfc920299feb530e8ec4ff051620189f8193634_NeikiAnalytics.dll
Size

120KB
MD5

5ed92b7849978ff3dd44fd63aba545a0
SHA1

ece1536f437bd76a11a23d4a1aba6c4c9416d6c2
SHA256

575bdace06ed5398d9c53438dbfc920299feb530e8ec4ff051620189f8193634
SHA512

58ea3b1ca95f43c357f577a9f0b12422ea5ea850053ea3a83b084a2d68b06cdca0cd8d145566421dfa293ed9cd4c193f98c2fa169fc3a4ff41110f41ac379976
SSDEEP

1536:ztMHvrWZaCM4tQbB7V5uZnsgQt/rxkfbSeZ4+SNb4GB/:z6CRFQ17V5AArxubSeZaNf

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761aa2.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761aa2.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f76192c.exe

Executes dropped EXE 3 IoCs

Processes:

f76192c.exef761aa2.exef76364c.exe

pid process

2792 f76192c.exe
2640 f761aa2.exe
3028 f76364c.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2104 rundll32.exe
2104 rundll32.exe
2104 rundll32.exe
2104 rundll32.exe
2104 rundll32.exe
2104 rundll32.exe

pid	process
2792	f76192c.exe
2640	f761aa2.exe
3028	f76364c.exe

pid	process
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe
2104	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2792-12-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-17-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-16-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-20-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-21-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-14-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-18-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-15-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-23-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-19-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-22-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-62-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-63-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-64-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-65-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-66-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-80-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-81-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-99-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-101-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-104-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-105-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-106-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2792-141-0x0000000000680000-0x000000000173A000-memory.dmp	upx
behavioral1/memory/2640-149-0x0000000000950000-0x0000000001A0A000-memory.dmp	upx
behavioral1/memory/2640-175-0x0000000000950000-0x0000000001A0A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761aa2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761aa2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f76192c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761aa2.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761aa2.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f76192c.exe

description	ioc	process
File opened (read-only)	\??\M:	f76192c.exe
File opened (read-only)	\??\N:	f76192c.exe
File opened (read-only)	\??\G:	f76192c.exe
File opened (read-only)	\??\I:	f76192c.exe
File opened (read-only)	\??\J:	f76192c.exe
File opened (read-only)	\??\K:	f76192c.exe
File opened (read-only)	\??\P:	f76192c.exe
File opened (read-only)	\??\E:	f76192c.exe
File opened (read-only)	\??\H:	f76192c.exe
File opened (read-only)	\??\L:	f76192c.exe
File opened (read-only)	\??\O:	f76192c.exe

Drops file in Windows directory 3 IoCs

Processes:

f76192c.exef761aa2.exe

description ioc process

File created C:\Windows\f76196a f76192c.exe
File opened for modification C:\Windows\SYSTEM.INI f76192c.exe
File created C:\Windows\f7669cb f761aa2.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f76192c.exef761aa2.exe

pid process

2792 f76192c.exe
2792 f76192c.exe
2640 f761aa2.exe

description	ioc	process
File created	C:\Windows\f76196a	f76192c.exe
File opened for modification	C:\Windows\SYSTEM.INI	f76192c.exe
File created	C:\Windows\f7669cb	f761aa2.exe

pid	process
2792	f76192c.exe
2792	f76192c.exe
2640	f761aa2.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f76192c.exef761aa2.exe

description	pid	process
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2792	f76192c.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe
Token: SeDebugPrivilege	2640	f761aa2.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef76192c.exef761aa2.exe

description	pid	process	target process
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2964 wrote to memory of 2104	2964	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 2792	2104	rundll32.exe	f76192c.exe
PID 2104 wrote to memory of 2792	2104	rundll32.exe	f76192c.exe
PID 2104 wrote to memory of 2792	2104	rundll32.exe	f76192c.exe
PID 2104 wrote to memory of 2792	2104	rundll32.exe	f76192c.exe
PID 2792 wrote to memory of 1224	2792	f76192c.exe	taskhost.exe
PID 2792 wrote to memory of 1320	2792	f76192c.exe	Dwm.exe
PID 2792 wrote to memory of 1360	2792	f76192c.exe	Explorer.EXE
PID 2792 wrote to memory of 1812	2792	f76192c.exe	DllHost.exe
PID 2792 wrote to memory of 2964	2792	f76192c.exe	rundll32.exe
PID 2792 wrote to memory of 2104	2792	f76192c.exe	rundll32.exe
PID 2792 wrote to memory of 2104	2792	f76192c.exe	rundll32.exe
PID 2104 wrote to memory of 2640	2104	rundll32.exe	f761aa2.exe
PID 2104 wrote to memory of 2640	2104	rundll32.exe	f761aa2.exe
PID 2104 wrote to memory of 2640	2104	rundll32.exe	f761aa2.exe
PID 2104 wrote to memory of 2640	2104	rundll32.exe	f761aa2.exe
PID 2104 wrote to memory of 3028	2104	rundll32.exe	f76364c.exe
PID 2104 wrote to memory of 3028	2104	rundll32.exe	f76364c.exe
PID 2104 wrote to memory of 3028	2104	rundll32.exe	f76364c.exe
PID 2104 wrote to memory of 3028	2104	rundll32.exe	f76364c.exe
PID 2792 wrote to memory of 1224	2792	f76192c.exe	taskhost.exe
PID 2792 wrote to memory of 1320	2792	f76192c.exe	Dwm.exe
PID 2792 wrote to memory of 1360	2792	f76192c.exe	Explorer.EXE
PID 2792 wrote to memory of 2640	2792	f76192c.exe	f761aa2.exe
PID 2792 wrote to memory of 2640	2792	f76192c.exe	f761aa2.exe
PID 2792 wrote to memory of 3028	2792	f76192c.exe	f76364c.exe
PID 2792 wrote to memory of 3028	2792	f76192c.exe	f76364c.exe
PID 2640 wrote to memory of 1224	2640	f761aa2.exe	taskhost.exe
PID 2640 wrote to memory of 1320	2640	f761aa2.exe	Dwm.exe
PID 2640 wrote to memory of 1360	2640	f761aa2.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f76192c.exef761aa2.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f76192c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761aa2.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1224

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\575bdace06ed5398d9c53438dbfc920299feb530e8ec4ff051620189f8193634_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\575bdace06ed5398d9c53438dbfc920299feb530e8ec4ff051620189f8193634_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104

C:\Users\Admin\AppData\Local\Temp\f76192c.exe
C:\Users\Admin\AppData\Local\Temp\f76192c.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2792

C:\Users\Admin\AppData\Local\Temp\f761aa2.exe
C:\Users\Admin\AppData\Local\Temp\f761aa2.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2640

C:\Users\Admin\AppData\Local\Temp\f76364c.exe
C:\Users\Admin\AppData\Local\Temp\f76364c.exe
4⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1812

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
de9d1c6a32f971963ec4189af077a0f5

SHA1
c84949786a6ec31c2fd51b4214ed06225d098eef

SHA256
4b6cb3fc5df1d0747d99f087bf4d67013da7cda3fd9ac262951f32462693de5a

SHA512
9dc832ff2c0382fa13a21d2ac391b053eb9675cef6e8b2e24316389d5490dc29fcfaf04ef1c625b4d0bfc5c010f6ca319afe6e9d76ebebbad83eb8a95169676f

Download Submit
\Users\Admin\AppData\Local\Temp\f76192c.exe
Filesize
97KB

MD5
745998fddf5ffcd591d8945f33f48c5a

SHA1
db2cb77689dc8f3493b0030e327b44faa21c7482

SHA256
2e750a898eef427bc04a4aac23e882aa702fe32d4ba9482b6d0d5e36eafe2766

SHA512
02d1208bd1f832553f2a390e1b2afe4c365fb04339e08a0a34d5ac86e893eac1e917c9d8cdb6f6c34b34da0a3814861c91d42049056b60b95d467405aa85fafa

Download Submit
memory/1224-29-0x0000000001FB0000-0x0000000001FB2000-memory.dmp

Filesize
8KB

Download
memory/2104-60-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2104-53-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2104-8-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2104-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2104-37-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2104-46-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2104-58-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2104-36-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2104-75-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download
memory/2104-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2640-174-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2640-175-0x0000000000950000-0x0000000001A0A000-memory.dmp

Filesize
16.7MB

Download
memory/2640-90-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2640-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2640-89-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2640-97-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2640-149-0x0000000000950000-0x0000000001A0A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-15-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-21-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-22-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-47-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2792-50-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2792-49-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2792-23-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-62-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-63-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-64-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-65-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-66-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-18-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2792-80-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-81-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-14-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-19-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-12-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-17-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-16-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-20-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-99-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-101-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-104-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-105-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-106-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/2792-115-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/2792-140-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2792-141-0x0000000000680000-0x000000000173A000-memory.dmp

Filesize
16.7MB

Download
memory/3028-98-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/3028-95-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/3028-96-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/3028-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3028-179-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads