sality | ae7978c00e28886c82186caf38cc76736d9057da7460e5028447fbf1bb88fed0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae7978c00e28886c82186caf38cc76736d9057da7460e5028447fbf1bb88fed0_NeikiAnalytics.dll
Size

120KB
MD5

179d5d4f5affdefb5ffad8382fa8b290
SHA1

4bd5d3fd78484c4da56b65361bbd62434d301787
SHA256

ae7978c00e28886c82186caf38cc76736d9057da7460e5028447fbf1bb88fed0
SHA512

54db8879128f6785ce1d0a0e44b6bd04dc2d3210eed44e7468f5a9a6e77768ef8fde19403142dc5d4867c00b2367b339834887473bcaa071eca05749594f62ad
SSDEEP

1536:alDY15pYhNgS+iVZi3ntSxHfauJNKytvzcVIzjkj0THEFqMprvTn2:X5yhNgS+iV2MxHfauTTvzcuzQwkbDb

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7605ea.exef760770.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760770.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760770.exef7605ea.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7605ea.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7605ea.exef760770.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760770.exe

Executes dropped EXE 3 IoCs

Processes:

f7605ea.exef760770.exef762175.exe

pid process

2392 f7605ea.exe
2704 f760770.exe
1792 f762175.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2176 rundll32.exe
2176 rundll32.exe
2176 rundll32.exe
2176 rundll32.exe
2176 rundll32.exe
2176 rundll32.exe

pid	process
2392	f7605ea.exe
2704	f760770.exe
1792	f762175.exe

pid	process
2176	rundll32.exe
2176	rundll32.exe
2176	rundll32.exe
2176	rundll32.exe
2176	rundll32.exe
2176	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2392-20-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-13-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-17-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-15-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-18-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-19-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-16-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-14-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-22-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-21-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-64-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-65-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-66-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-67-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-68-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-70-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-71-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-86-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-88-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-89-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-107-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2392-156-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/2704-168-0x0000000000910000-0x00000000019CA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7605ea.exef760770.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760770.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7605ea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760770.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760770.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f7605ea.exef760770.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760770.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7605ea.exe

description	ioc	process
File opened (read-only)	\??\E:	f7605ea.exe
File opened (read-only)	\??\P:	f7605ea.exe
File opened (read-only)	\??\T:	f7605ea.exe
File opened (read-only)	\??\K:	f7605ea.exe
File opened (read-only)	\??\L:	f7605ea.exe
File opened (read-only)	\??\N:	f7605ea.exe
File opened (read-only)	\??\O:	f7605ea.exe
File opened (read-only)	\??\Q:	f7605ea.exe
File opened (read-only)	\??\H:	f7605ea.exe
File opened (read-only)	\??\J:	f7605ea.exe
File opened (read-only)	\??\G:	f7605ea.exe
File opened (read-only)	\??\I:	f7605ea.exe
File opened (read-only)	\??\M:	f7605ea.exe
File opened (read-only)	\??\R:	f7605ea.exe
File opened (read-only)	\??\S:	f7605ea.exe

Drops file in Windows directory 3 IoCs

Processes:

f7605ea.exef760770.exe

description ioc process

File created C:\Windows\f760657 f7605ea.exe
File opened for modification C:\Windows\SYSTEM.INI f7605ea.exe
File created C:\Windows\f76563b f760770.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f7605ea.exe

pid process

2392 f7605ea.exe
2392 f7605ea.exe

description	ioc	process
File created	C:\Windows\f760657	f7605ea.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7605ea.exe
File created	C:\Windows\f76563b	f760770.exe

pid	process
2392	f7605ea.exe
2392	f7605ea.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f7605ea.exe

description	pid	process
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe
Token: SeDebugPrivilege	2392	f7605ea.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef7605ea.exe

description	pid	process	target process
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 2176	2220	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2392	2176	rundll32.exe	f7605ea.exe
PID 2176 wrote to memory of 2392	2176	rundll32.exe	f7605ea.exe
PID 2176 wrote to memory of 2392	2176	rundll32.exe	f7605ea.exe
PID 2176 wrote to memory of 2392	2176	rundll32.exe	f7605ea.exe
PID 2392 wrote to memory of 1100	2392	f7605ea.exe	taskhost.exe
PID 2392 wrote to memory of 1164	2392	f7605ea.exe	Dwm.exe
PID 2392 wrote to memory of 1200	2392	f7605ea.exe	Explorer.EXE
PID 2392 wrote to memory of 1864	2392	f7605ea.exe	DllHost.exe
PID 2392 wrote to memory of 2220	2392	f7605ea.exe	rundll32.exe
PID 2392 wrote to memory of 2176	2392	f7605ea.exe	rundll32.exe
PID 2392 wrote to memory of 2176	2392	f7605ea.exe	rundll32.exe
PID 2176 wrote to memory of 2704	2176	rundll32.exe	f760770.exe
PID 2176 wrote to memory of 2704	2176	rundll32.exe	f760770.exe
PID 2176 wrote to memory of 2704	2176	rundll32.exe	f760770.exe
PID 2176 wrote to memory of 2704	2176	rundll32.exe	f760770.exe
PID 2176 wrote to memory of 1792	2176	rundll32.exe	f762175.exe
PID 2176 wrote to memory of 1792	2176	rundll32.exe	f762175.exe
PID 2176 wrote to memory of 1792	2176	rundll32.exe	f762175.exe
PID 2176 wrote to memory of 1792	2176	rundll32.exe	f762175.exe
PID 2392 wrote to memory of 1100	2392	f7605ea.exe	taskhost.exe
PID 2392 wrote to memory of 1164	2392	f7605ea.exe	Dwm.exe
PID 2392 wrote to memory of 1200	2392	f7605ea.exe	Explorer.EXE
PID 2392 wrote to memory of 2704	2392	f7605ea.exe	f760770.exe
PID 2392 wrote to memory of 2704	2392	f7605ea.exe	f760770.exe
PID 2392 wrote to memory of 1792	2392	f7605ea.exe	f762175.exe
PID 2392 wrote to memory of 1792	2392	f7605ea.exe	f762175.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f7605ea.exef760770.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7605ea.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760770.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1100

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae7978c00e28886c82186caf38cc76736d9057da7460e5028447fbf1bb88fed0_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae7978c00e28886c82186caf38cc76736d9057da7460e5028447fbf1bb88fed0_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\f7605ea.exe
C:\Users\Admin\AppData\Local\Temp\f7605ea.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2392

C:\Users\Admin\AppData\Local\Temp\f760770.exe
C:\Users\Admin\AppData\Local\Temp\f760770.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2704

C:\Users\Admin\AppData\Local\Temp\f762175.exe
C:\Users\Admin\AppData\Local\Temp\f762175.exe
4⤵
- Executes dropped EXE
PID:1792

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1864

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
5b099e8522c5dc2460f9d8b5fa29d90e

SHA1
e948efa553bc2d5c10b0ed9df6a383796fccd619

SHA256
67ec724ad8fac0d5d3c5f4a7e2bced08269acd524f7bb27c5983d5100dcef9a7

SHA512
4513e4080525dae240ebafe3709152dfc23b1f73ec06a290fc51796f3b2e51025dd2b8ec037f21621c6a888978227feb1c96aac00b6f767fe022eee26723110e

Download Submit
\Users\Admin\AppData\Local\Temp\f7605ea.exe
Filesize
97KB

MD5
ba74bb0a05086497e54ebe9cd11ceab7

SHA1
279cdbd430df62cd1935a8a570e3f4cf3247ac72

SHA256
b9bdee6845d729f002727a6fdd432284a6fc48ceb8dda87fa02f36aff3f67c62

SHA512
f028f798f39d9afed231635eedf52f94fde0ab57435fa4679b32d5012521f5ce2cf780dc9ad80e8cc82795e551177dc52137f5f9fcc16746deed9a8f97ae6b93

Download Submit
memory/1100-28-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/1792-185-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1792-103-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1792-106-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1792-104-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1792-84-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2176-38-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2176-61-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2176-9-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/2176-48-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2176-79-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2176-39-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2176-83-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2176-59-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2176-60-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/2392-68-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-86-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-21-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2392-14-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-54-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2392-16-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-64-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-65-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-66-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-67-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-49-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/2392-70-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-71-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-18-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-15-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-19-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-22-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-88-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-89-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-17-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-155-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2392-13-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-107-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-20-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-51-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2392-156-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2392-121-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2704-97-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2704-98-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2704-105-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2704-168-0x0000000000910000-0x00000000019CA000-memory.dmp

Filesize
16.7MB

Download
memory/2704-181-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2704-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads