sality | 149164d48875cd87458d8b77d6921296263f8e2d0b8c2c8e64baf7dc2a03a38a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149164d48875cd87458d8b77d6921296263f8e2d0b8c2c8e64baf7dc2a03a38a_NeikiAnalytics.dll
Size

120KB
MD5

f6271d785de51ecf9e7c2ba2a7049570
SHA1

5923d99c5bbe8cc8fad90040c293f5c42a7d6f86
SHA256

149164d48875cd87458d8b77d6921296263f8e2d0b8c2c8e64baf7dc2a03a38a
SHA512

ad618fd1022db1b36d55312b7f0ea30493d6eb90466206d895eee900d2db97cfb61e7871cb7e8b9e6401c47a950afea2a990234a4c9e29e51792d6c6eca45ebe
SSDEEP

1536:uEYMSa6w2EoS4cInytmNVfZt3seXIq2YHxPeqta6yB1D0vdgN40g34WWTCCQte6H:RYMSL3ZSj4ysbX3sUeMa6y7D003TTRi

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7613fe.exef761564.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761564.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7613fe.exef761564.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761564.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7613fe.exef761564.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7613fe.exe

Executes dropped EXE 3 IoCs

Processes:

f7613fe.exef761564.exef762f98.exe

pid process

2552 f7613fe.exe
2368 f761564.exe
2040 f762f98.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2636 rundll32.exe
2636 rundll32.exe
2636 rundll32.exe
2636 rundll32.exe
2636 rundll32.exe
2636 rundll32.exe

pid	process
2552	f7613fe.exe
2368	f761564.exe
2040	f762f98.exe

pid	process
2636	rundll32.exe
2636	rundll32.exe
2636	rundll32.exe
2636	rundll32.exe
2636	rundll32.exe
2636	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2552-15-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-18-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-16-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-19-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-21-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-22-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-20-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-17-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-23-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-14-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-61-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-62-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-63-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-65-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-64-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-67-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-68-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-83-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-84-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-86-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-105-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-106-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-119-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2552-154-0x0000000000960000-0x0000000001A1A000-memory.dmp	upx
behavioral1/memory/2368-166-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/2368-189-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7613fe.exef761564.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761564.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761564.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761564.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f761564.exef7613fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761564.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7613fe.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7613fe.exe

description	ioc	process
File opened (read-only)	\??\H:	f7613fe.exe
File opened (read-only)	\??\L:	f7613fe.exe
File opened (read-only)	\??\S:	f7613fe.exe
File opened (read-only)	\??\E:	f7613fe.exe
File opened (read-only)	\??\I:	f7613fe.exe
File opened (read-only)	\??\J:	f7613fe.exe
File opened (read-only)	\??\K:	f7613fe.exe
File opened (read-only)	\??\O:	f7613fe.exe
File opened (read-only)	\??\Q:	f7613fe.exe
File opened (read-only)	\??\T:	f7613fe.exe
File opened (read-only)	\??\G:	f7613fe.exe
File opened (read-only)	\??\M:	f7613fe.exe
File opened (read-only)	\??\N:	f7613fe.exe
File opened (read-only)	\??\P:	f7613fe.exe
File opened (read-only)	\??\R:	f7613fe.exe

Drops file in Windows directory 3 IoCs

Processes:

f7613fe.exef761564.exe

description ioc process

File created C:\Windows\f76144c f7613fe.exe
File opened for modification C:\Windows\SYSTEM.INI f7613fe.exe
File created C:\Windows\f76643f f761564.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f7613fe.exef761564.exe

pid process

2552 f7613fe.exe
2552 f7613fe.exe
2368 f761564.exe

description	ioc	process
File created	C:\Windows\f76144c	f7613fe.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7613fe.exe
File created	C:\Windows\f76643f	f761564.exe

pid	process
2552	f7613fe.exe
2552	f7613fe.exe
2368	f761564.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f7613fe.exef761564.exe

description	pid	process
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2552	f7613fe.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe
Token: SeDebugPrivilege	2368	f761564.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef7613fe.exef761564.exe

description	pid	process	target process
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2636	2436	rundll32.exe	rundll32.exe
PID 2636 wrote to memory of 2552	2636	rundll32.exe	f7613fe.exe
PID 2636 wrote to memory of 2552	2636	rundll32.exe	f7613fe.exe
PID 2636 wrote to memory of 2552	2636	rundll32.exe	f7613fe.exe
PID 2636 wrote to memory of 2552	2636	rundll32.exe	f7613fe.exe
PID 2552 wrote to memory of 1048	2552	f7613fe.exe	Dwm.exe
PID 2552 wrote to memory of 1060	2552	f7613fe.exe	taskhost.exe
PID 2552 wrote to memory of 1144	2552	f7613fe.exe	Explorer.EXE
PID 2552 wrote to memory of 2136	2552	f7613fe.exe	DllHost.exe
PID 2552 wrote to memory of 2436	2552	f7613fe.exe	rundll32.exe
PID 2552 wrote to memory of 2636	2552	f7613fe.exe	rundll32.exe
PID 2552 wrote to memory of 2636	2552	f7613fe.exe	rundll32.exe
PID 2636 wrote to memory of 2368	2636	rundll32.exe	f761564.exe
PID 2636 wrote to memory of 2368	2636	rundll32.exe	f761564.exe
PID 2636 wrote to memory of 2368	2636	rundll32.exe	f761564.exe
PID 2636 wrote to memory of 2368	2636	rundll32.exe	f761564.exe
PID 2636 wrote to memory of 2040	2636	rundll32.exe	f762f98.exe
PID 2636 wrote to memory of 2040	2636	rundll32.exe	f762f98.exe
PID 2636 wrote to memory of 2040	2636	rundll32.exe	f762f98.exe
PID 2636 wrote to memory of 2040	2636	rundll32.exe	f762f98.exe
PID 2552 wrote to memory of 1048	2552	f7613fe.exe	Dwm.exe
PID 2552 wrote to memory of 1060	2552	f7613fe.exe	taskhost.exe
PID 2552 wrote to memory of 1144	2552	f7613fe.exe	Explorer.EXE
PID 2552 wrote to memory of 2368	2552	f7613fe.exe	f761564.exe
PID 2552 wrote to memory of 2368	2552	f7613fe.exe	f761564.exe
PID 2552 wrote to memory of 2040	2552	f7613fe.exe	f762f98.exe
PID 2552 wrote to memory of 2040	2552	f7613fe.exe	f762f98.exe
PID 2368 wrote to memory of 1048	2368	f761564.exe	Dwm.exe
PID 2368 wrote to memory of 1060	2368	f761564.exe	taskhost.exe
PID 2368 wrote to memory of 1144	2368	f761564.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f7613fe.exef761564.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7613fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761564.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1048

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1060

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1144

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\149164d48875cd87458d8b77d6921296263f8e2d0b8c2c8e64baf7dc2a03a38a_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\149164d48875cd87458d8b77d6921296263f8e2d0b8c2c8e64baf7dc2a03a38a_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636

C:\Users\Admin\AppData\Local\Temp\f7613fe.exe
C:\Users\Admin\AppData\Local\Temp\f7613fe.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2552

C:\Users\Admin\AppData\Local\Temp\f761564.exe
C:\Users\Admin\AppData\Local\Temp\f761564.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368

C:\Users\Admin\AppData\Local\Temp\f762f98.exe
C:\Users\Admin\AppData\Local\Temp\f762f98.exe
4⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2136

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
255B

MD5
805e99f5e1d1ef6938eb06e9fa33d38c

SHA1
b126c46037722004b93841dc89d168c368b1733c

SHA256
cb00988f43e80b5a7a237fad8c6870a278c8e18ea66805fb87456cf5ea83717d

SHA512
54cad6d6d9e68402179ea73dc0aed7b4cc8eeb203a1d09c31ed5ef440f8b69f3fcb9e673cd50de88d80dcf2d5e5dd7dfa656ad08009b6357c798f69d65c0657e

Download Submit
\Users\Admin\AppData\Local\Temp\f7613fe.exe
Filesize
97KB

MD5
1c2d5bb6263bb48cc7aff395f9257982

SHA1
916ee7cd7e9519bf22187f574ba5c80764193565

SHA256
efaa42ae4d5d46b18c889d5c2e0f4091eccdc0917c93d27c15f39bb07e03d916

SHA512
fc2962790d69fa9c35201999cc682720df2ce653cc0dedf2e11e196813d6ecff8d5162ba2bd690c11d6c901cb335f17446fe86ee014fe1d582bd3576eee0475a

Download Submit
memory/1048-29-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2040-102-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2040-104-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2040-193-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-101-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2040-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2368-189-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2368-166-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2368-188-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2368-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2368-96-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2368-97-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2552-49-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2552-19-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-15-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-57-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2552-18-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-153-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-20-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-17-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-23-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-14-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-61-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-62-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-63-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-65-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-64-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-67-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-68-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-154-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-119-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-106-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-83-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-84-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-86-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-22-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-47-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/2552-105-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-21-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2552-16-0x0000000000960000-0x0000000001A1A000-memory.dmp

Filesize
16.7MB

Download
memory/2636-46-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2636-38-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2636-77-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2636-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2636-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2636-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2636-37-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2636-58-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/2636-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2636-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2636-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads