sality | 7f505ddd3c5265692b72a1744392f9700cc09162233943912bf09bdd4e4ed658

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f505ddd3c5265692b72a1744392f9700cc09162233943912bf09bdd4e4ed658_NeikiAnalytics.dll
Size

120KB
MD5

55c3ecd2e70ddf0891e6c71d8b57d590
SHA1

16a4c0a5f8c88076acd53f8f6d8706a43838227a
SHA256

7f505ddd3c5265692b72a1744392f9700cc09162233943912bf09bdd4e4ed658
SHA512

ed0acc40f73e9fbc8f8b828bf0e6269686c5f554aebf61273f7400db605d11ef7e08cc0675b2754db5f3e52bf5a20e5130fd0af342a6a16729b9f8644456d519
SSDEEP

3072:84EWK3jjN0rQhFGm4r2kU5eN4ShLoFuPYdqaHIPYyPV:FK3jh0raGmU2kYemSh3ypy9

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f75fd72.exef75fee8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f75fee8.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f75fee8.exef75fd72.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fd72.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f75fee8.exef75fd72.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f75fd72.exe

Executes dropped EXE 3 IoCs

Processes:

f75fd72.exef75fee8.exef76192c.exe

pid process

2688 f75fd72.exe
2632 f75fee8.exe
1464 f76192c.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2276 rundll32.exe
2276 rundll32.exe
2276 rundll32.exe
2276 rundll32.exe
2276 rundll32.exe
2276 rundll32.exe

pid	process
2688	f75fd72.exe
2632	f75fee8.exe
1464	f76192c.exe

pid	process
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2688-12-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-15-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-20-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-17-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-21-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-19-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-16-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-22-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-18-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-14-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-63-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-62-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-64-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-65-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-66-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-82-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-83-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-101-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-103-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-105-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-106-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-109-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2688-142-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2632-157-0x0000000000910000-0x00000000019CA000-memory.dmp	upx
behavioral1/memory/2632-176-0x0000000000910000-0x00000000019CA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f75fd72.exef75fee8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f75fd72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f75fee8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f75fee8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f75fee8.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f75fd72.exef75fee8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fee8.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f75fd72.exe

description	ioc	process
File opened (read-only)	\??\J:	f75fd72.exe
File opened (read-only)	\??\M:	f75fd72.exe
File opened (read-only)	\??\N:	f75fd72.exe
File opened (read-only)	\??\P:	f75fd72.exe
File opened (read-only)	\??\G:	f75fd72.exe
File opened (read-only)	\??\H:	f75fd72.exe
File opened (read-only)	\??\I:	f75fd72.exe
File opened (read-only)	\??\O:	f75fd72.exe
File opened (read-only)	\??\E:	f75fd72.exe
File opened (read-only)	\??\K:	f75fd72.exe
File opened (read-only)	\??\L:	f75fd72.exe

Drops file in Windows directory 3 IoCs

Processes:

f75fd72.exef75fee8.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI f75fd72.exe
File created C:\Windows\f764df1 f75fee8.exe
File created C:\Windows\f75fdb0 f75fd72.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f75fd72.exef75fee8.exe

pid process

2688 f75fd72.exe
2688 f75fd72.exe
2632 f75fee8.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	f75fd72.exe
File created	C:\Windows\f764df1	f75fee8.exe
File created	C:\Windows\f75fdb0	f75fd72.exe

pid	process
2688	f75fd72.exe
2688	f75fd72.exe
2632	f75fee8.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f75fd72.exef75fee8.exe

description	pid	process
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2688	f75fd72.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe
Token: SeDebugPrivilege	2632	f75fee8.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef75fd72.exef75fee8.exe

description	pid	process	target process
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2276	2908	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2688	2276	rundll32.exe	f75fd72.exe
PID 2276 wrote to memory of 2688	2276	rundll32.exe	f75fd72.exe
PID 2276 wrote to memory of 2688	2276	rundll32.exe	f75fd72.exe
PID 2276 wrote to memory of 2688	2276	rundll32.exe	f75fd72.exe
PID 2688 wrote to memory of 1072	2688	f75fd72.exe	taskhost.exe
PID 2688 wrote to memory of 1128	2688	f75fd72.exe	Dwm.exe
PID 2688 wrote to memory of 1152	2688	f75fd72.exe	Explorer.EXE
PID 2688 wrote to memory of 1712	2688	f75fd72.exe	DllHost.exe
PID 2688 wrote to memory of 2908	2688	f75fd72.exe	rundll32.exe
PID 2688 wrote to memory of 2276	2688	f75fd72.exe	rundll32.exe
PID 2688 wrote to memory of 2276	2688	f75fd72.exe	rundll32.exe
PID 2276 wrote to memory of 2632	2276	rundll32.exe	f75fee8.exe
PID 2276 wrote to memory of 2632	2276	rundll32.exe	f75fee8.exe
PID 2276 wrote to memory of 2632	2276	rundll32.exe	f75fee8.exe
PID 2276 wrote to memory of 2632	2276	rundll32.exe	f75fee8.exe
PID 2276 wrote to memory of 1464	2276	rundll32.exe	f76192c.exe
PID 2276 wrote to memory of 1464	2276	rundll32.exe	f76192c.exe
PID 2276 wrote to memory of 1464	2276	rundll32.exe	f76192c.exe
PID 2276 wrote to memory of 1464	2276	rundll32.exe	f76192c.exe
PID 2688 wrote to memory of 1072	2688	f75fd72.exe	taskhost.exe
PID 2688 wrote to memory of 1128	2688	f75fd72.exe	Dwm.exe
PID 2688 wrote to memory of 1152	2688	f75fd72.exe	Explorer.EXE
PID 2688 wrote to memory of 2632	2688	f75fd72.exe	f75fee8.exe
PID 2688 wrote to memory of 2632	2688	f75fd72.exe	f75fee8.exe
PID 2688 wrote to memory of 1464	2688	f75fd72.exe	f76192c.exe
PID 2688 wrote to memory of 1464	2688	f75fd72.exe	f76192c.exe
PID 2632 wrote to memory of 1072	2632	f75fee8.exe	taskhost.exe
PID 2632 wrote to memory of 1128	2632	f75fee8.exe	Dwm.exe
PID 2632 wrote to memory of 1152	2632	f75fee8.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f75fd72.exef75fee8.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fd72.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f75fee8.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1072

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f505ddd3c5265692b72a1744392f9700cc09162233943912bf09bdd4e4ed658_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f505ddd3c5265692b72a1744392f9700cc09162233943912bf09bdd4e4ed658_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\f75fd72.exe
C:\Users\Admin\AppData\Local\Temp\f75fd72.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2688

C:\Users\Admin\AppData\Local\Temp\f75fee8.exe
C:\Users\Admin\AppData\Local\Temp\f75fee8.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2632

C:\Users\Admin\AppData\Local\Temp\f76192c.exe
C:\Users\Admin\AppData\Local\Temp\f76192c.exe
4⤵
- Executes dropped EXE
PID:1464

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1712

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
f0ea0485e0916309c1414f05cea442ce

SHA1
cf0be464e7d5a07d4bd24c6cb0cd895640627d14

SHA256
cce5d609c4523f948c64728e3df4ed05e38c9f19c6b19fc5bdff47854730313a

SHA512
1752786b459312504422e1b30697f0d9e64d9628c9ecd74c3e3a54166b50050b4bb8c2949288e0455d2bb6178aa077522d11012333d611526b80d6db24cd0872

Download Submit
\Users\Admin\AppData\Local\Temp\f75fd72.exe
Filesize
97KB

MD5
66f06434c02252a70a44805aac745596

SHA1
a5a727f68b45a862a73eff0c2f126b287bee444c

SHA256
6e644836c7d94a36d592e4844f797acd38b077ea0acca4e7892de694e9ce97df

SHA512
900c3f76c1f2a08aeedef7d1de2ddf6def6b88f7ef3e9469ddb3593c1be3696d5d28a86331f5a59ca1e5a504ed7a3e56d675e4fe84058438835978e987c00437

Download Submit
memory/1072-28-0x0000000002010000-0x0000000002012000-memory.dmp

Filesize
8KB

Download
memory/1464-180-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1464-99-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/1464-96-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/1464-97-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1464-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2276-36-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2276-47-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2276-75-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2276-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2276-37-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2276-59-0x0000000000200000-0x0000000000212000-memory.dmp

Filesize
72KB

Download
memory/2276-9-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/2276-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2276-77-0x0000000000310000-0x0000000000322000-memory.dmp

Filesize
72KB

Download
memory/2276-80-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2632-91-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2632-90-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2632-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2632-98-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2632-157-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/2632-176-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/2632-175-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2688-14-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-48-0x0000000001720000-0x0000000001721000-memory.dmp

Filesize
4KB

Download
memory/2688-65-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-66-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-62-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-63-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-17-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-19-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-82-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-83-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-18-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-21-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-20-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-15-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-12-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-64-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-101-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-103-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-105-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-106-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-109-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-116-0x0000000001710000-0x0000000001712000-memory.dmp

Filesize
8KB

Download
memory/2688-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2688-142-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-50-0x0000000001710000-0x0000000001712000-memory.dmp

Filesize
8KB

Download
memory/2688-49-0x0000000001710000-0x0000000001712000-memory.dmp

Filesize
8KB

Download
memory/2688-22-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-16-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2688-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads