sality | 2909722287f1d54b9f6c4cf36ea8a29dc826786d8cfe290398758d0fb5bbb19b

Analysis

max time kernel
26s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2909722287f1d54b9f6c4cf36ea8a29dc826786d8cfe290398758d0fb5bbb19b_NeikiAnalytics.dll
Size

120KB
MD5

9840c4893a3c3de3f2f86675bae1ff90
SHA1

7291acadd6de9a086b0fc9b8f4577d09a8a09dbb
SHA256

2909722287f1d54b9f6c4cf36ea8a29dc826786d8cfe290398758d0fb5bbb19b
SHA512

c128b7934c88dcdf91ffe470d11998023f776796cc3a644636870499bdac312b1470923a3523bdce7fd121ea716ce28fa75ef85a31f56dd2495ebe4ad32cd754
SSDEEP

1536:OR5NyAKtYTmxrUyAnkGu4MJm/+Om6gXWUDml+Y6ifAkdtcv43txy:OgxdAndu40m/+O9UWUk+Y6iFw43X

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f761e5a.exef763939.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f763939.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761e5a.exef763939.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763939.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f763939.exef761e5a.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763939.exe

Executes dropped EXE 3 IoCs

Processes:

f761e5a.exef76228e.exef763939.exe

pid process

2376 f761e5a.exe
2644 f76228e.exe
2896 f763939.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1680 rundll32.exe
1680 rundll32.exe
1680 rundll32.exe
1680 rundll32.exe
1680 rundll32.exe
1680 rundll32.exe

pid	process
2376	f761e5a.exe
2644	f76228e.exe
2896	f763939.exe

pid	process
1680	rundll32.exe
1680	rundll32.exe
1680	rundll32.exe
1680	rundll32.exe
1680	rundll32.exe
1680	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2376-15-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-17-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-18-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-19-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-20-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-21-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-23-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-25-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-22-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-24-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-64-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-65-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-66-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-67-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-68-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-70-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-84-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-85-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-87-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-89-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-106-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-108-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-124-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2376-147-0x00000000005A0000-0x000000000165A000-memory.dmp	upx
behavioral1/memory/2896-168-0x0000000000990000-0x0000000001A4A000-memory.dmp	upx
behavioral1/memory/2896-200-0x0000000000990000-0x0000000001A4A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f761e5a.exef763939.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f761e5a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763939.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f763939.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f761e5a.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f761e5a.exef763939.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763939.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f761e5a.exef763939.exe

description	ioc	process
File opened (read-only)	\??\G:	f761e5a.exe
File opened (read-only)	\??\J:	f761e5a.exe
File opened (read-only)	\??\K:	f761e5a.exe
File opened (read-only)	\??\L:	f761e5a.exe
File opened (read-only)	\??\S:	f761e5a.exe
File opened (read-only)	\??\E:	f761e5a.exe
File opened (read-only)	\??\R:	f761e5a.exe
File opened (read-only)	\??\E:	f763939.exe
File opened (read-only)	\??\H:	f761e5a.exe
File opened (read-only)	\??\M:	f761e5a.exe
File opened (read-only)	\??\N:	f761e5a.exe
File opened (read-only)	\??\O:	f761e5a.exe
File opened (read-only)	\??\P:	f761e5a.exe
File opened (read-only)	\??\Q:	f761e5a.exe
File opened (read-only)	\??\I:	f761e5a.exe

Drops file in Windows directory 3 IoCs

Processes:

f761e5a.exef763939.exe

description ioc process

File created C:\Windows\f761f63 f761e5a.exe
File opened for modification C:\Windows\SYSTEM.INI f761e5a.exe
File created C:\Windows\f7671b7 f763939.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f761e5a.exef763939.exe

pid process

2376 f761e5a.exe
2376 f761e5a.exe
2896 f763939.exe

description	ioc	process
File created	C:\Windows\f761f63	f761e5a.exe
File opened for modification	C:\Windows\SYSTEM.INI	f761e5a.exe
File created	C:\Windows\f7671b7	f763939.exe

pid	process
2376	f761e5a.exe
2376	f761e5a.exe
2896	f763939.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f761e5a.exef763939.exe

description	pid	process
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2376	f761e5a.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe
Token: SeDebugPrivilege	2896	f763939.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef761e5a.exef763939.exe

description	pid	process	target process
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 2756 wrote to memory of 1680	2756	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 2376	1680	rundll32.exe	f761e5a.exe
PID 1680 wrote to memory of 2376	1680	rundll32.exe	f761e5a.exe
PID 1680 wrote to memory of 2376	1680	rundll32.exe	f761e5a.exe
PID 1680 wrote to memory of 2376	1680	rundll32.exe	f761e5a.exe
PID 2376 wrote to memory of 1116	2376	f761e5a.exe	taskhost.exe
PID 2376 wrote to memory of 1156	2376	f761e5a.exe	Dwm.exe
PID 2376 wrote to memory of 1184	2376	f761e5a.exe	Explorer.EXE
PID 2376 wrote to memory of 1820	2376	f761e5a.exe	DllHost.exe
PID 2376 wrote to memory of 2756	2376	f761e5a.exe	rundll32.exe
PID 2376 wrote to memory of 1680	2376	f761e5a.exe	rundll32.exe
PID 2376 wrote to memory of 1680	2376	f761e5a.exe	rundll32.exe
PID 1680 wrote to memory of 2644	1680	rundll32.exe	f76228e.exe
PID 1680 wrote to memory of 2644	1680	rundll32.exe	f76228e.exe
PID 1680 wrote to memory of 2644	1680	rundll32.exe	f76228e.exe
PID 1680 wrote to memory of 2644	1680	rundll32.exe	f76228e.exe
PID 1680 wrote to memory of 2896	1680	rundll32.exe	f763939.exe
PID 1680 wrote to memory of 2896	1680	rundll32.exe	f763939.exe
PID 1680 wrote to memory of 2896	1680	rundll32.exe	f763939.exe
PID 1680 wrote to memory of 2896	1680	rundll32.exe	f763939.exe
PID 2376 wrote to memory of 1116	2376	f761e5a.exe	taskhost.exe
PID 2376 wrote to memory of 1156	2376	f761e5a.exe	Dwm.exe
PID 2376 wrote to memory of 1184	2376	f761e5a.exe	Explorer.EXE
PID 2376 wrote to memory of 2644	2376	f761e5a.exe	f76228e.exe
PID 2376 wrote to memory of 2644	2376	f761e5a.exe	f76228e.exe
PID 2376 wrote to memory of 2896	2376	f761e5a.exe	f763939.exe
PID 2376 wrote to memory of 2896	2376	f761e5a.exe	f763939.exe
PID 2896 wrote to memory of 1116	2896	f763939.exe	taskhost.exe
PID 2896 wrote to memory of 1156	2896	f763939.exe	Dwm.exe
PID 2896 wrote to memory of 1184	2896	f763939.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f761e5a.exef763939.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f761e5a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763939.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909722287f1d54b9f6c4cf36ea8a29dc826786d8cfe290398758d0fb5bbb19b_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2909722287f1d54b9f6c4cf36ea8a29dc826786d8cfe290398758d0fb5bbb19b_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\AppData\Local\Temp\f761e5a.exe
C:\Users\Admin\AppData\Local\Temp\f761e5a.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2376

C:\Users\Admin\AppData\Local\Temp\f76228e.exe
C:\Users\Admin\AppData\Local\Temp\f76228e.exe
4⤵
- Executes dropped EXE
PID:2644

C:\Users\Admin\AppData\Local\Temp\f763939.exe
C:\Users\Admin\AppData\Local\Temp\f763939.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1820

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
34801b6ae8eebfb8b2b9ae669aa49161

SHA1
5e6f832f5b4b84510d6c7842a16df2935942d172

SHA256
32f550640ac1d625cd4e7c54c6c378bc59c21f7f744897705d9da35677e9e683

SHA512
d4a4ead2d2c21e0de0f6718e53e68df1c4c74639c8789cb63f3bc2b2c2131f5f6ccb4c847a6893b576cdacdd9df6cf2f409923595305d1d92a7bd86309064af7

Download Submit
\Users\Admin\AppData\Local\Temp\f761e5a.exe
Filesize
97KB

MD5
cce382ee8f29729e0b12bdd94a6afe69

SHA1
2dad1a96835d034854aedb18a22869a185418ea8

SHA256
d3e47b30a4787a3e8583e9821ed656f26ebf957cc441ec048ff1037d9157b7b6

SHA512
0ac17a78e6c0d4ae65755ad4a479faf72fca585c46d88e715f9b5d18c51e004858724ce63ba4161efe7c9568d7fecbef3e75720255a75e727c9b44d15b2a47a4

Download Submit
memory/1116-31-0x0000000001FF0000-0x0000000001FF2000-memory.dmp

Filesize
8KB

Download
memory/1680-82-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1680-39-0x0000000000740000-0x0000000000742000-memory.dmp

Filesize
8KB

Download
memory/1680-12-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1680-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1680-11-0x00000000001F0000-0x0000000000202000-memory.dmp

Filesize
72KB

Download
memory/1680-62-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/1680-4-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1680-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1680-40-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1680-42-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1680-43-0x0000000000740000-0x0000000000742000-memory.dmp

Filesize
8KB

Download
memory/1680-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1680-59-0x0000000000740000-0x0000000000742000-memory.dmp

Filesize
8KB

Download
memory/1680-61-0x0000000000780000-0x0000000000792000-memory.dmp

Filesize
72KB

Download
memory/2376-23-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-15-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-24-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-22-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-60-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/2376-25-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-51-0x0000000000490000-0x0000000000492000-memory.dmp

Filesize
8KB

Download
memory/2376-49-0x0000000001720000-0x0000000001721000-memory.dmp

Filesize
4KB

Download
memory/2376-21-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-20-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-19-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-18-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-17-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-64-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-65-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-66-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-67-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-68-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-70-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-14-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2376-147-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-84-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-85-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-87-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-89-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-148-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2376-124-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-108-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2376-106-0x00000000005A0000-0x000000000165A000-memory.dmp

Filesize
16.7MB

Download
memory/2644-98-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2644-97-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2644-104-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2644-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-102-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2896-103-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2896-105-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2896-83-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-168-0x0000000000990000-0x0000000001A4A000-memory.dmp

Filesize
16.7MB

Download
memory/2896-200-0x0000000000990000-0x0000000001A4A000-memory.dmp

Filesize
16.7MB

Download
memory/2896-199-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads