sality | 98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll
Size

120KB
MD5

ad0c33a9570cbac2479906690f402a20
SHA1

92b2f183d1b96277446f7ef4ad1b771c2030245f
SHA256

98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf
SHA512

ec99b18b812f3b0c4552f36328eecd31472c06047b9dffe9e472b9f7d82b55d6948c23c35af1b825df81139200c5bdaaa9344c54d212ae66e26469e5d1b287e4
SSDEEP

1536:pbUuETPXHLg6ApxwZKZscFuAqa/sMb/fNyK9kLAnWZKHub1IupVCD02Pj:QDXr6OrMbHN3ycWUObRpI42P

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7638dc.exef761d50.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7638dc.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7638dc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7638dc.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7638dc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761d50.exe

Executes dropped EXE 3 IoCs

Processes:

f761d50.exef761ef6.exef7638dc.exe

pid process

2752 f761d50.exe
2456 f761ef6.exe
2120 f7638dc.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1852 rundll32.exe
1852 rundll32.exe
1852 rundll32.exe
1852 rundll32.exe
1852 rundll32.exe
1852 rundll32.exe

pid	process
2752	f761d50.exe
2456	f761ef6.exe
2120	f7638dc.exe

pid	process
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe
1852	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2752-16-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-20-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-13-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-18-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-14-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-22-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-21-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-19-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-17-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-15-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-61-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-62-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-63-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-64-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-65-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-67-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-68-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-82-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-87-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-89-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-106-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-107-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-109-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2752-149-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2120-165-0x0000000000900000-0x00000000019BA000-memory.dmp	upx
behavioral1/memory/2120-205-0x0000000000900000-0x00000000019BA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761d50.exef7638dc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761d50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7638dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761d50.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7638dc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f761d50.exef7638dc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7638dc.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f761d50.exef7638dc.exe

description	ioc	process
File opened (read-only)	\??\M:	f761d50.exe
File opened (read-only)	\??\R:	f761d50.exe
File opened (read-only)	\??\E:	f7638dc.exe
File opened (read-only)	\??\K:	f761d50.exe
File opened (read-only)	\??\O:	f761d50.exe
File opened (read-only)	\??\J:	f761d50.exe
File opened (read-only)	\??\H:	f761d50.exe
File opened (read-only)	\??\I:	f761d50.exe
File opened (read-only)	\??\L:	f761d50.exe
File opened (read-only)	\??\N:	f761d50.exe
File opened (read-only)	\??\Q:	f761d50.exe
File opened (read-only)	\??\T:	f761d50.exe
File opened (read-only)	\??\E:	f761d50.exe
File opened (read-only)	\??\P:	f761d50.exe
File opened (read-only)	\??\S:	f761d50.exe
File opened (read-only)	\??\G:	f7638dc.exe
File opened (read-only)	\??\G:	f761d50.exe

Drops file in Windows directory 3 IoCs

Processes:

f761d50.exef7638dc.exe

description ioc process

File created C:\Windows\f761dcd f761d50.exe
File opened for modification C:\Windows\SYSTEM.INI f761d50.exe
File created C:\Windows\f766d63 f7638dc.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f761d50.exef7638dc.exe

pid process

2752 f761d50.exe
2752 f761d50.exe
2120 f7638dc.exe

description	ioc	process
File created	C:\Windows\f761dcd	f761d50.exe
File opened for modification	C:\Windows\SYSTEM.INI	f761d50.exe
File created	C:\Windows\f766d63	f7638dc.exe

pid	process
2752	f761d50.exe
2752	f761d50.exe
2120	f7638dc.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f761d50.exef7638dc.exe

description	pid	process
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2752	f761d50.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe
Token: SeDebugPrivilege	2120	f7638dc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef761d50.exef7638dc.exe

description	pid	process	target process
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 2752	1852	rundll32.exe	f761d50.exe
PID 1852 wrote to memory of 2752	1852	rundll32.exe	f761d50.exe
PID 1852 wrote to memory of 2752	1852	rundll32.exe	f761d50.exe
PID 1852 wrote to memory of 2752	1852	rundll32.exe	f761d50.exe
PID 2752 wrote to memory of 1040	2752	f761d50.exe	taskhost.exe
PID 2752 wrote to memory of 1148	2752	f761d50.exe	Dwm.exe
PID 2752 wrote to memory of 1192	2752	f761d50.exe	Explorer.EXE
PID 2752 wrote to memory of 2376	2752	f761d50.exe	DllHost.exe
PID 2752 wrote to memory of 1904	2752	f761d50.exe	rundll32.exe
PID 2752 wrote to memory of 1852	2752	f761d50.exe	rundll32.exe
PID 2752 wrote to memory of 1852	2752	f761d50.exe	rundll32.exe
PID 1852 wrote to memory of 2456	1852	rundll32.exe	f761ef6.exe
PID 1852 wrote to memory of 2456	1852	rundll32.exe	f761ef6.exe
PID 1852 wrote to memory of 2456	1852	rundll32.exe	f761ef6.exe
PID 1852 wrote to memory of 2456	1852	rundll32.exe	f761ef6.exe
PID 1852 wrote to memory of 2120	1852	rundll32.exe	f7638dc.exe
PID 1852 wrote to memory of 2120	1852	rundll32.exe	f7638dc.exe
PID 1852 wrote to memory of 2120	1852	rundll32.exe	f7638dc.exe
PID 1852 wrote to memory of 2120	1852	rundll32.exe	f7638dc.exe
PID 2752 wrote to memory of 1040	2752	f761d50.exe	taskhost.exe
PID 2752 wrote to memory of 1148	2752	f761d50.exe	Dwm.exe
PID 2752 wrote to memory of 1192	2752	f761d50.exe	Explorer.EXE
PID 2752 wrote to memory of 2456	2752	f761d50.exe	f761ef6.exe
PID 2752 wrote to memory of 2456	2752	f761d50.exe	f761ef6.exe
PID 2752 wrote to memory of 2120	2752	f761d50.exe	f7638dc.exe
PID 2752 wrote to memory of 2120	2752	f761d50.exe	f7638dc.exe
PID 2120 wrote to memory of 1040	2120	f7638dc.exe	taskhost.exe
PID 2120 wrote to memory of 1148	2120	f7638dc.exe	Dwm.exe
PID 2120 wrote to memory of 1192	2120	f7638dc.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f761d50.exef7638dc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761d50.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7638dc.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1040

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1148

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852

C:\Users\Admin\AppData\Local\Temp\f761d50.exe
C:\Users\Admin\AppData\Local\Temp\f761d50.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2752

C:\Users\Admin\AppData\Local\Temp\f761ef6.exe
C:\Users\Admin\AppData\Local\Temp\f761ef6.exe
4⤵
- Executes dropped EXE
PID:2456

C:\Users\Admin\AppData\Local\Temp\f7638dc.exe
C:\Users\Admin\AppData\Local\Temp\f7638dc.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2120

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2376

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
256B

MD5
bb46b0202765d741013a8d335b77aa6b

SHA1
d02720e0de7b9d8ffb45f03189a4d09888bfd344

SHA256
9cb921ba313e794335abc89d1c7369d63fb6faaf28fb9880cb76cf44f1e3c978

SHA512
807205059a594e1896c4ff8b584b6cb509db565271379a5ae48a156c93d78fa1937e15517801fe43d6043f0627fccb8b58c373198becf5657163319b3f12c36a

Download Submit
\Users\Admin\AppData\Local\Temp\f761d50.exe
Filesize
97KB

MD5
66b33e2c0594aa9fbe2dfcaf633f3bad

SHA1
05152397d9299f89c4970be7969c0ea740bd4e32

SHA256
e7ca409166beb51c67b2001613769f8e90803ddcdf95bf0a64244102cb773839

SHA512
483901b034680ab7b95d79ce9dd564b798780416743a4e4e7d856bb0a3a714337d760e672ba40bb1efe8aad8bec1c5755fda29b1a29f51952f30fb88cf196900

Download Submit
memory/1040-23-0x00000000021B0000-0x00000000021B2000-memory.dmp

Filesize
8KB

Download
memory/1852-40-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1852-56-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/1852-80-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/1852-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1852-30-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1852-31-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1852-54-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1852-76-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1852-79-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1852-57-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1852-4-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download
memory/2120-102-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2120-105-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2120-103-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2120-205-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/2120-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2120-165-0x0000000000900000-0x00000000019BA000-memory.dmp

Filesize
16.7MB

Download
memory/2120-204-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2456-104-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2456-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2456-97-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2456-96-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2456-169-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2752-21-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-42-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2752-64-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-65-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-67-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-68-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-62-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-61-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-82-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-55-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2752-15-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-87-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-89-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-17-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-19-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-63-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-58-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2752-22-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-14-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-106-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-107-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-109-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-120-0x00000000002D0000-0x00000000002D2000-memory.dmp

Filesize
8KB

Download
memory/2752-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2752-149-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-18-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-13-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-20-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-16-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2752-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads