sality | a7fe4006c7381ea9e439b33266f77c2d769981ae9ebbfca9031bd5340f6366a4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7fe4006c7381ea9e439b33266f77c2d769981ae9ebbfca9031bd5340f6366a4_NeikiAnalytics.dll
Size

120KB
MD5

be620595ee4485ffc8bd851fa9039bc0
SHA1

c8e84727ebb8573a305c62448982a832ba48d841
SHA256

a7fe4006c7381ea9e439b33266f77c2d769981ae9ebbfca9031bd5340f6366a4
SHA512

84b3a327e4c2f5a705477cbf1fcc94b166540c8ba23dfdd6c94166710f88b190183258c78b6b7a2adaef3658c43b20558064c0bff8f352844c6ce35806eeac97
SSDEEP

3072:TGeS2raOVZz6RCWELJ3VOUYR3c3HxxVL:TGrYcRCWEV3VOyr1

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7628e4.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762a1c.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7628e4.exe

Executes dropped EXE 3 IoCs

Processes:

f7628e4.exef762a1c.exef76448f.exe

pid process

2188 f7628e4.exe
2688 f762a1c.exe
1648 f76448f.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2192 rundll32.exe
2192 rundll32.exe
2192 rundll32.exe
2192 rundll32.exe
2192 rundll32.exe
2192 rundll32.exe

pid	process
2188	f7628e4.exe
2688	f762a1c.exe
1648	f76448f.exe

pid	process
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe
2192	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2188-13-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-15-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-18-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-21-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-22-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-20-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-19-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-16-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-23-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-17-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-63-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-62-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-64-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-66-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-65-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-68-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-69-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-82-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-87-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-88-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-109-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2188-151-0x00000000005D0000-0x000000000168A000-memory.dmp	upx
behavioral1/memory/2688-170-0x0000000000930000-0x00000000019EA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f762a1c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f762a1c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f762a1c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f762a1c.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762a1c.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7628e4.exe

description	ioc	process
File opened (read-only)	\??\O:	f7628e4.exe
File opened (read-only)	\??\S:	f7628e4.exe
File opened (read-only)	\??\G:	f7628e4.exe
File opened (read-only)	\??\H:	f7628e4.exe
File opened (read-only)	\??\I:	f7628e4.exe
File opened (read-only)	\??\L:	f7628e4.exe
File opened (read-only)	\??\T:	f7628e4.exe
File opened (read-only)	\??\E:	f7628e4.exe
File opened (read-only)	\??\K:	f7628e4.exe
File opened (read-only)	\??\J:	f7628e4.exe
File opened (read-only)	\??\M:	f7628e4.exe
File opened (read-only)	\??\N:	f7628e4.exe
File opened (read-only)	\??\P:	f7628e4.exe
File opened (read-only)	\??\Q:	f7628e4.exe
File opened (read-only)	\??\R:	f7628e4.exe

Drops file in Windows directory 3 IoCs

Processes:

f762a1c.exef7628e4.exe

description ioc process

File created C:\Windows\f767899 f762a1c.exe
File created C:\Windows\f762942 f7628e4.exe
File opened for modification C:\Windows\SYSTEM.INI f7628e4.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f7628e4.exe

pid process

2188 f7628e4.exe
2188 f7628e4.exe

description	ioc	process
File created	C:\Windows\f767899	f762a1c.exe
File created	C:\Windows\f762942	f7628e4.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7628e4.exe

pid	process
2188	f7628e4.exe
2188	f7628e4.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f7628e4.exe

description	pid	process
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe
Token: SeDebugPrivilege	2188	f7628e4.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef7628e4.exe

description	pid	process	target process
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 3016 wrote to memory of 2192	3016	rundll32.exe	rundll32.exe
PID 2192 wrote to memory of 2188	2192	rundll32.exe	f7628e4.exe
PID 2192 wrote to memory of 2188	2192	rundll32.exe	f7628e4.exe
PID 2192 wrote to memory of 2188	2192	rundll32.exe	f7628e4.exe
PID 2192 wrote to memory of 2188	2192	rundll32.exe	f7628e4.exe
PID 2188 wrote to memory of 1124	2188	f7628e4.exe	taskhost.exe
PID 2188 wrote to memory of 1184	2188	f7628e4.exe	Dwm.exe
PID 2188 wrote to memory of 1208	2188	f7628e4.exe	Explorer.EXE
PID 2188 wrote to memory of 1028	2188	f7628e4.exe	DllHost.exe
PID 2188 wrote to memory of 3016	2188	f7628e4.exe	rundll32.exe
PID 2188 wrote to memory of 2192	2188	f7628e4.exe	rundll32.exe
PID 2188 wrote to memory of 2192	2188	f7628e4.exe	rundll32.exe
PID 2192 wrote to memory of 2688	2192	rundll32.exe	f762a1c.exe
PID 2192 wrote to memory of 2688	2192	rundll32.exe	f762a1c.exe
PID 2192 wrote to memory of 2688	2192	rundll32.exe	f762a1c.exe
PID 2192 wrote to memory of 2688	2192	rundll32.exe	f762a1c.exe
PID 2192 wrote to memory of 1648	2192	rundll32.exe	f76448f.exe
PID 2192 wrote to memory of 1648	2192	rundll32.exe	f76448f.exe
PID 2192 wrote to memory of 1648	2192	rundll32.exe	f76448f.exe
PID 2192 wrote to memory of 1648	2192	rundll32.exe	f76448f.exe
PID 2188 wrote to memory of 1124	2188	f7628e4.exe	taskhost.exe
PID 2188 wrote to memory of 1184	2188	f7628e4.exe	Dwm.exe
PID 2188 wrote to memory of 1208	2188	f7628e4.exe	Explorer.EXE
PID 2188 wrote to memory of 2688	2188	f7628e4.exe	f762a1c.exe
PID 2188 wrote to memory of 2688	2188	f7628e4.exe	f762a1c.exe
PID 2188 wrote to memory of 1648	2188	f7628e4.exe	f76448f.exe
PID 2188 wrote to memory of 1648	2188	f7628e4.exe	f76448f.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f7628e4.exef762a1c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7628e4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f762a1c.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7fe4006c7381ea9e439b33266f77c2d769981ae9ebbfca9031bd5340f6366a4_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7fe4006c7381ea9e439b33266f77c2d769981ae9ebbfca9031bd5340f6366a4_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192

C:\Users\Admin\AppData\Local\Temp\f7628e4.exe
C:\Users\Admin\AppData\Local\Temp\f7628e4.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2188

C:\Users\Admin\AppData\Local\Temp\f762a1c.exe
C:\Users\Admin\AppData\Local\Temp\f762a1c.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2688

C:\Users\Admin\AppData\Local\Temp\f76448f.exe
C:\Users\Admin\AppData\Local\Temp\f76448f.exe
4⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1028

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
d08e20f451b463a8960144aea92b46bd

SHA1
4df9c8985cd5187fc68f07d118cadac67cdf11d2

SHA256
ffec8bdbe291a7975707eeccb0472b7b0a4352c6fedef003f823e51d9ee6d244

SHA512
a702b77b9d306956d068e1c73217bfde7c37fa05c82f00caa3e43f390c27265975129c67a51031baae3a5942049f681e2507a3a71a4036e16a9845638b2680eb

Download Submit
\Users\Admin\AppData\Local\Temp\f7628e4.exe
Filesize
97KB

MD5
a3095f5d02201471fc3d7f214286c00e

SHA1
32fd59e54d608a962e7e6d919347fc53d1d5c0af

SHA256
6244c4b619858d8c209c619cd96a1f8308b0182dbc79aa52499efcd62e4247e0

SHA512
3142e45430d2cb18577614ea996af57a220735374ee80c44f9f25535535de01435c0a337fd15911cb6f53aa34dcef5e25e662de56c8d1e6bc4e48b86225ae6e8

Download Submit
memory/1124-24-0x0000000000450000-0x0000000000452000-memory.dmp

Filesize
8KB

Download
memory/1648-179-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1648-104-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1648-105-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1648-107-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1648-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2188-62-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-66-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2188-151-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-152-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2188-58-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/2188-13-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-20-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-19-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-47-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2188-122-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/2188-16-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-109-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-15-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-49-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/2188-23-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-17-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-18-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-63-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-88-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-64-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-22-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-65-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-68-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-69-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-21-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-82-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2188-87-0x00000000005D0000-0x000000000168A000-memory.dmp

Filesize
16.7MB

Download
memory/2192-32-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2192-56-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2192-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2192-60-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2192-80-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/2192-10-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2192-4-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2192-59-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/2192-31-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2192-46-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2688-97-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2688-100-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2688-106-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2688-170-0x0000000000930000-0x00000000019EA000-memory.dmp

Filesize
16.7MB

Download
memory/2688-175-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2688-61-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads