sality | 80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll
Size

120KB
MD5

4f94b4da382ef1b4056f17cbc68c7a20
SHA1

5f17f77c47eb722a405ac5fc1ce38caf1d135233
SHA256

80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e
SHA512

85e67e1d9e579831602e52cd765e8ede6a477036793867b2ff18f648ca69e294a75eee515f5b9e389a15339de589fa47c9b52402e0e20d0e568e3a8e8267a384
SSDEEP

3072:6Uh11a84hkyu/JHnpH5lJoX8kJBjVrwcFYrCJM:6UT1aDkyu/RRhWJ7W+JM

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f760657.exef762240.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f762240.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760657.exef762240.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762240.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760657.exef762240.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762240.exe

Executes dropped EXE 3 IoCs

Processes:

f760657.exef7608e6.exef762240.exe

pid process

1928 f760657.exe
2628 f7608e6.exe
1356 f762240.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2088 rundll32.exe
2088 rundll32.exe
2088 rundll32.exe
2088 rundll32.exe
2088 rundll32.exe
2088 rundll32.exe

pid	process
1928	f760657.exe
2628	f7608e6.exe
1356	f762240.exe

pid	process
2088	rundll32.exe
2088	rundll32.exe
2088	rundll32.exe
2088	rundll32.exe
2088	rundll32.exe
2088	rundll32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1928-13-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-17-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-21-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-15-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-20-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-19-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-16-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-22-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-18-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-23-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-60-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-61-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-62-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-63-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-64-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-66-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-67-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-81-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-83-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-85-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-103-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-106-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1928-146-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/1356-167-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/1356-201-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760657.exef762240.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760657.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762240.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762240.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f760657.exef762240.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760657.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762240.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760657.exef762240.exe

description	ioc	process
File opened (read-only)	\??\H:	f760657.exe
File opened (read-only)	\??\J:	f760657.exe
File opened (read-only)	\??\S:	f760657.exe
File opened (read-only)	\??\K:	f760657.exe
File opened (read-only)	\??\R:	f760657.exe
File opened (read-only)	\??\E:	f762240.exe
File opened (read-only)	\??\G:	f762240.exe
File opened (read-only)	\??\G:	f760657.exe
File opened (read-only)	\??\I:	f760657.exe
File opened (read-only)	\??\L:	f760657.exe
File opened (read-only)	\??\N:	f760657.exe
File opened (read-only)	\??\P:	f760657.exe
File opened (read-only)	\??\E:	f760657.exe
File opened (read-only)	\??\M:	f760657.exe
File opened (read-only)	\??\O:	f760657.exe
File opened (read-only)	\??\Q:	f760657.exe

Drops file in Windows directory 3 IoCs

Processes:

f760657.exef762240.exe

description ioc process

File created C:\Windows\f7606b5 f760657.exe
File opened for modification C:\Windows\SYSTEM.INI f760657.exe
File created C:\Windows\f7657ff f762240.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f760657.exef762240.exe

pid process

1928 f760657.exe
1928 f760657.exe
1356 f762240.exe

description	ioc	process
File created	C:\Windows\f7606b5	f760657.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760657.exe
File created	C:\Windows\f7657ff	f762240.exe

pid	process
1928	f760657.exe
1928	f760657.exe
1356	f762240.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f760657.exef762240.exe

description	pid	process
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1928	f760657.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe
Token: SeDebugPrivilege	1356	f762240.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef760657.exef762240.exe

description	pid	process	target process
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 1928	2088	rundll32.exe	f760657.exe
PID 2088 wrote to memory of 1928	2088	rundll32.exe	f760657.exe
PID 2088 wrote to memory of 1928	2088	rundll32.exe	f760657.exe
PID 2088 wrote to memory of 1928	2088	rundll32.exe	f760657.exe
PID 1928 wrote to memory of 1060	1928	f760657.exe	taskhost.exe
PID 1928 wrote to memory of 1152	1928	f760657.exe	Dwm.exe
PID 1928 wrote to memory of 1180	1928	f760657.exe	Explorer.EXE
PID 1928 wrote to memory of 1560	1928	f760657.exe	DllHost.exe
PID 1928 wrote to memory of 1860	1928	f760657.exe	rundll32.exe
PID 1928 wrote to memory of 2088	1928	f760657.exe	rundll32.exe
PID 1928 wrote to memory of 2088	1928	f760657.exe	rundll32.exe
PID 2088 wrote to memory of 2628	2088	rundll32.exe	f7608e6.exe
PID 2088 wrote to memory of 2628	2088	rundll32.exe	f7608e6.exe
PID 2088 wrote to memory of 2628	2088	rundll32.exe	f7608e6.exe
PID 2088 wrote to memory of 2628	2088	rundll32.exe	f7608e6.exe
PID 2088 wrote to memory of 1356	2088	rundll32.exe	f762240.exe
PID 2088 wrote to memory of 1356	2088	rundll32.exe	f762240.exe
PID 2088 wrote to memory of 1356	2088	rundll32.exe	f762240.exe
PID 2088 wrote to memory of 1356	2088	rundll32.exe	f762240.exe
PID 1928 wrote to memory of 1060	1928	f760657.exe	taskhost.exe
PID 1928 wrote to memory of 1152	1928	f760657.exe	Dwm.exe
PID 1928 wrote to memory of 1180	1928	f760657.exe	Explorer.EXE
PID 1928 wrote to memory of 2628	1928	f760657.exe	f7608e6.exe
PID 1928 wrote to memory of 2628	1928	f760657.exe	f7608e6.exe
PID 1928 wrote to memory of 1356	1928	f760657.exe	f762240.exe
PID 1928 wrote to memory of 1356	1928	f760657.exe	f762240.exe
PID 1356 wrote to memory of 1060	1356	f762240.exe	taskhost.exe
PID 1356 wrote to memory of 1152	1356	f762240.exe	Dwm.exe
PID 1356 wrote to memory of 1180	1356	f762240.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f762240.exef760657.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762240.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760657.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1060

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1152

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\f760657.exe
C:\Users\Admin\AppData\Local\Temp\f760657.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928

C:\Users\Admin\AppData\Local\Temp\f7608e6.exe
C:\Users\Admin\AppData\Local\Temp\f7608e6.exe
4⤵
- Executes dropped EXE
PID:2628

C:\Users\Admin\AppData\Local\Temp\f762240.exe
C:\Users\Admin\AppData\Local\Temp\f762240.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1560

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
255B

MD5
2eee87badad42d5b0918148b37aebef0

SHA1
e48b0ce636935b24d04bb4ddc000ccaff1bf0241

SHA256
edbfe5dca4c15d899b7072e0df851f80423dc79175038f195ac00801ddf0e0cd

SHA512
38116e1dd78cdfdf5053533a76ffdca6f0d5bf6871e06d31168c643c5f51cc47e9974ba6ef9d143655420b7fb8c218002a401b8d451d69f28e3bb61e43f25c28

Download Submit
\Users\Admin\AppData\Local\Temp\f760657.exe
Filesize
97KB

MD5
3f664a324913fda2bf792a776356e085

SHA1
fc195655e89fbf7dd0db27cfae7a717ddea266d4

SHA256
bc8b78804854df9818cb406ad7b1c3f2e1fbb2aa8c978e46b8cf7578edd1105e

SHA512
64c27ea109e9e63b372614cd2d93e95d357921a7c12d7e37f2e687301fe68368c867fa7531bd46040e2a0b7c119b0d3fa2dc1500f72eaf09b4dce39e3b41bf62

Download Submit
memory/1060-29-0x0000000002090000-0x0000000002092000-memory.dmp

Filesize
8KB

Download
memory/1356-200-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-201-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/1356-167-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/1356-105-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1356-100-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1356-102-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1356-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1928-61-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-15-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-22-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-18-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-19-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-23-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-48-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/1928-57-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/1928-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1928-13-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-145-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1928-146-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-45-0x00000000016E0000-0x00000000016E1000-memory.dmp

Filesize
4KB

Download
memory/1928-106-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-103-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-17-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-60-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-21-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-62-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-63-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-64-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-66-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-67-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-20-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-16-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-85-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-81-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/1928-83-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2088-39-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2088-55-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2088-10-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2088-78-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2088-75-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2088-36-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2088-56-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download
memory/2088-37-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2088-46-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2088-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2628-104-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2628-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2628-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2628-95-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2628-93-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads