sality | 1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll
Size

120KB
MD5

7144b38532c87843b7f66325935cf410
SHA1

b9c8faff7e2991498dfad842abd0b66e16a1ef01
SHA256

1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f
SHA512

5ae28fe7340445f729ea468d750994b916d568666d90fe32ac538e6edb54839a1e68e87ff1bf2466c9d83d2f38b412b7c9cbdfce134165fe6c4289053900e95c
SSDEEP

3072:HP4/LEiEUW01B4vmphKuLJuRfCnLJ+fzsTFO:v4/AiEURBWmf9mfCnLJ+fzs

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f760c31.exef760e14.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760e14.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760e14.exef760c31.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760c31.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760e14.exef760c31.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760e14.exe

Executes dropped EXE 3 IoCs

Processes:

f760c31.exef760e14.exef762961.exe

pid process

380 f760c31.exe
2692 f760e14.exe
2548 f762961.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe
2452 rundll32.exe

pid	process
380	f760c31.exe
2692	f760e14.exe
2548	f762961.exe

pid	process
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe
2452	rundll32.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/380-12-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-14-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-16-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-15-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-18-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-20-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-19-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-17-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-22-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-21-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-64-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-63-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-65-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-67-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-66-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-82-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-83-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-85-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-104-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-106-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-116-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/380-153-0x00000000006E0000-0x000000000179A000-memory.dmp	upx
behavioral1/memory/2692-165-0x0000000000970000-0x0000000001A2A000-memory.dmp	upx
behavioral1/memory/2692-188-0x0000000000970000-0x0000000001A2A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760c31.exef760e14.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760e14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760e14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760e14.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f760c31.exef760e14.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e14.exe

Enumerates connected drives 3 TTPs 13 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760c31.exe

description	ioc	process
File opened (read-only)	\??\E:	f760c31.exe
File opened (read-only)	\??\H:	f760c31.exe
File opened (read-only)	\??\K:	f760c31.exe
File opened (read-only)	\??\I:	f760c31.exe
File opened (read-only)	\??\M:	f760c31.exe
File opened (read-only)	\??\P:	f760c31.exe
File opened (read-only)	\??\J:	f760c31.exe
File opened (read-only)	\??\N:	f760c31.exe
File opened (read-only)	\??\O:	f760c31.exe
File opened (read-only)	\??\Q:	f760c31.exe
File opened (read-only)	\??\G:	f760c31.exe
File opened (read-only)	\??\L:	f760c31.exe
File opened (read-only)	\??\R:	f760c31.exe

Drops file in Windows directory 3 IoCs

Processes:

f760c31.exef760e14.exe

description ioc process

File created C:\Windows\f760cae f760c31.exe
File opened for modification C:\Windows\SYSTEM.INI f760c31.exe
File created C:\Windows\f765cdf f760e14.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f760c31.exef760e14.exe

pid process

380 f760c31.exe
380 f760c31.exe
2692 f760e14.exe

description	ioc	process
File created	C:\Windows\f760cae	f760c31.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760c31.exe
File created	C:\Windows\f765cdf	f760e14.exe

pid	process
380	f760c31.exe
380	f760c31.exe
2692	f760e14.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f760c31.exef760e14.exe

description	pid	process
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	380	f760c31.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe
Token: SeDebugPrivilege	2692	f760e14.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef760c31.exef760e14.exe

description	pid	process	target process
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 352 wrote to memory of 2452	352	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 380	2452	rundll32.exe	f760c31.exe
PID 2452 wrote to memory of 380	2452	rundll32.exe	f760c31.exe
PID 2452 wrote to memory of 380	2452	rundll32.exe	f760c31.exe
PID 2452 wrote to memory of 380	2452	rundll32.exe	f760c31.exe
PID 380 wrote to memory of 1116	380	f760c31.exe	taskhost.exe
PID 380 wrote to memory of 1172	380	f760c31.exe	Dwm.exe
PID 380 wrote to memory of 1204	380	f760c31.exe	Explorer.EXE
PID 380 wrote to memory of 1912	380	f760c31.exe	DllHost.exe
PID 380 wrote to memory of 352	380	f760c31.exe	rundll32.exe
PID 380 wrote to memory of 2452	380	f760c31.exe	rundll32.exe
PID 380 wrote to memory of 2452	380	f760c31.exe	rundll32.exe
PID 2452 wrote to memory of 2692	2452	rundll32.exe	f760e14.exe
PID 2452 wrote to memory of 2692	2452	rundll32.exe	f760e14.exe
PID 2452 wrote to memory of 2692	2452	rundll32.exe	f760e14.exe
PID 2452 wrote to memory of 2692	2452	rundll32.exe	f760e14.exe
PID 2452 wrote to memory of 2548	2452	rundll32.exe	f762961.exe
PID 2452 wrote to memory of 2548	2452	rundll32.exe	f762961.exe
PID 2452 wrote to memory of 2548	2452	rundll32.exe	f762961.exe
PID 2452 wrote to memory of 2548	2452	rundll32.exe	f762961.exe
PID 380 wrote to memory of 1116	380	f760c31.exe	taskhost.exe
PID 380 wrote to memory of 1172	380	f760c31.exe	Dwm.exe
PID 380 wrote to memory of 1204	380	f760c31.exe	Explorer.EXE
PID 380 wrote to memory of 2692	380	f760c31.exe	f760e14.exe
PID 380 wrote to memory of 2692	380	f760c31.exe	f760e14.exe
PID 380 wrote to memory of 2548	380	f760c31.exe	f762961.exe
PID 380 wrote to memory of 2548	380	f760c31.exe	f762961.exe
PID 2692 wrote to memory of 1116	2692	f760e14.exe	taskhost.exe
PID 2692 wrote to memory of 1172	2692	f760e14.exe	Dwm.exe
PID 2692 wrote to memory of 1204	2692	f760e14.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f760c31.exef760e14.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760c31.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760e14.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\f760c31.exe
C:\Users\Admin\AppData\Local\Temp\f760c31.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:380

C:\Users\Admin\AppData\Local\Temp\f760e14.exe
C:\Users\Admin\AppData\Local\Temp\f760e14.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2692

C:\Users\Admin\AppData\Local\Temp\f762961.exe
C:\Users\Admin\AppData\Local\Temp\f762961.exe
4⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1912

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
255B

MD5
14f587b6f3d3c4e1099ffb55124ad6cb

SHA1
c9d686d684f65967ae8a5d9338e011b46174116c

SHA256
57e379048577a3268238aec4249856354f95cda1306873b9d2353bbf49434d62

SHA512
1a072de17beed429532f70babc69eb9e1d7d094ee5b8f59ae4fb208a284edf96686e3f52dbc81b917bf7f75890c71cb29bd2e8fd80f488cf3a65b1563e98a571

Download Submit
\Users\Admin\AppData\Local\Temp\f760c31.exe
Filesize
97KB

MD5
b3304659798796c8c06a95bb0ceba755

SHA1
8556158323976244fcb787e77a2ea89c4a77cf79

SHA256
5cedd5c1e37451823cdb4269934e7e6ebda03e7aa80588e6d618fdd616cd8726

SHA512
b083219be9bed92301974efbc88a1deab656c12757439824014b7d25fa84162f672a509a77806f9a2cfcfb61f235ed27657dc5d78d77f8a4ac45b8b2a0518cdf

Download Submit
memory/380-63-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-14-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-64-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-12-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/380-16-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-15-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-18-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-20-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-153-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-48-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/380-50-0x0000000000450000-0x0000000000452000-memory.dmp

Filesize
8KB

Download
memory/380-152-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/380-51-0x0000000000450000-0x0000000000452000-memory.dmp

Filesize
8KB

Download
memory/380-116-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-65-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-19-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-17-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-22-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-21-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-106-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-104-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-85-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-83-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-82-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-66-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/380-67-0x00000000006E0000-0x000000000179A000-memory.dmp

Filesize
16.7MB

Download
memory/1116-28-0x0000000001F90000-0x0000000001F92000-memory.dmp

Filesize
8KB

Download
memory/2452-38-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2452-80-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/2452-61-0x0000000000760000-0x0000000000762000-memory.dmp

Filesize
8KB

Download
memory/2452-9-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/2452-58-0x0000000000760000-0x0000000000762000-memory.dmp

Filesize
8KB

Download
memory/2452-60-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/2452-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2452-10-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/2452-47-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2452-37-0x0000000000760000-0x0000000000762000-memory.dmp

Filesize
8KB

Download
memory/2548-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2548-100-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2548-192-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2548-103-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2548-101-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2692-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2692-187-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2692-93-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2692-94-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2692-165-0x0000000000970000-0x0000000001A2A000-memory.dmp

Filesize
16.7MB

Download
memory/2692-188-0x0000000000970000-0x0000000001A2A000-memory.dmp

Filesize
16.7MB

Download
memory/2692-102-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads