sality | 2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll
Size

120KB
MD5

d69dfec7f5a9e84d55c3510d787271f0
SHA1

eb3aa83ddbb5f64d6f0846dcc4753d9de7847fd8
SHA256

2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90
SHA512

75fc6c571fcbdf0d98c0cfb2ae8c77f28252e0a13d66fd2b0451976d522a5ea9621bbda15af56ed88cb14f52f9e69648c207b31f606015fa85432214c12af666
SSDEEP

3072:WblUlsAESGBIh658GqAdQ4PWVFJqajhkrdoTHuIpltTcVs:htDGBI1GJLEJu6TOkT7

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f763340.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763340.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763340.exe

Executes dropped EXE 3 IoCs

Processes:

f7617c5.exef7619f6.exef763340.exe

pid process

2960 f7617c5.exe
2896 f7619f6.exe
2308 f763340.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe
2272 rundll32.exe

pid	process
2960	f7617c5.exe
2896	f7619f6.exe
2308	f763340.exe

pid	process
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2960-12-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-15-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-17-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-20-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-21-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-19-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-22-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-18-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-16-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-14-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-61-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-62-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-63-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-65-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-64-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-81-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-82-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-84-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-85-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-107-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2960-152-0x0000000000520000-0x00000000015DA000-memory.dmp	upx
behavioral1/memory/2308-169-0x0000000000920000-0x00000000019DA000-memory.dmp	upx
behavioral1/memory/2308-204-0x0000000000920000-0x00000000019DA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7617c5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f763340.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f763340.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7617c5.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763340.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f7617c5.exef763340.exe

description	ioc	process
File opened (read-only)	\??\E:	f7617c5.exe
File opened (read-only)	\??\H:	f7617c5.exe
File opened (read-only)	\??\K:	f7617c5.exe
File opened (read-only)	\??\N:	f7617c5.exe
File opened (read-only)	\??\O:	f7617c5.exe
File opened (read-only)	\??\G:	f763340.exe
File opened (read-only)	\??\J:	f7617c5.exe
File opened (read-only)	\??\E:	f763340.exe
File opened (read-only)	\??\I:	f7617c5.exe
File opened (read-only)	\??\G:	f7617c5.exe
File opened (read-only)	\??\L:	f7617c5.exe
File opened (read-only)	\??\M:	f7617c5.exe
File opened (read-only)	\??\P:	f7617c5.exe
File opened (read-only)	\??\R:	f7617c5.exe

Drops file in Windows directory 3 IoCs

Processes:

f7617c5.exef763340.exe

description ioc process

File created C:\Windows\f761822 f7617c5.exe
File opened for modification C:\Windows\SYSTEM.INI f7617c5.exe
File created C:\Windows\f76691f f763340.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f7617c5.exef763340.exe

pid process

2960 f7617c5.exe
2960 f7617c5.exe
2308 f763340.exe

description	ioc	process
File created	C:\Windows\f761822	f7617c5.exe
File opened for modification	C:\Windows\SYSTEM.INI	f7617c5.exe
File created	C:\Windows\f76691f	f763340.exe

pid	process
2960	f7617c5.exe
2960	f7617c5.exe
2308	f763340.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f7617c5.exef763340.exe

description	pid	process
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2960	f7617c5.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe
Token: SeDebugPrivilege	2308	f763340.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef7617c5.exef763340.exe

description	pid	process	target process
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2272	2268	rundll32.exe	rundll32.exe
PID 2272 wrote to memory of 2960	2272	rundll32.exe	f7617c5.exe
PID 2272 wrote to memory of 2960	2272	rundll32.exe	f7617c5.exe
PID 2272 wrote to memory of 2960	2272	rundll32.exe	f7617c5.exe
PID 2272 wrote to memory of 2960	2272	rundll32.exe	f7617c5.exe
PID 2960 wrote to memory of 1112	2960	f7617c5.exe	taskhost.exe
PID 2960 wrote to memory of 1168	2960	f7617c5.exe	Dwm.exe
PID 2960 wrote to memory of 1204	2960	f7617c5.exe	Explorer.EXE
PID 2960 wrote to memory of 1640	2960	f7617c5.exe	DllHost.exe
PID 2960 wrote to memory of 2268	2960	f7617c5.exe	rundll32.exe
PID 2960 wrote to memory of 2272	2960	f7617c5.exe	rundll32.exe
PID 2960 wrote to memory of 2272	2960	f7617c5.exe	rundll32.exe
PID 2272 wrote to memory of 2896	2272	rundll32.exe	f7619f6.exe
PID 2272 wrote to memory of 2896	2272	rundll32.exe	f7619f6.exe
PID 2272 wrote to memory of 2896	2272	rundll32.exe	f7619f6.exe
PID 2272 wrote to memory of 2896	2272	rundll32.exe	f7619f6.exe
PID 2272 wrote to memory of 2308	2272	rundll32.exe	f763340.exe
PID 2272 wrote to memory of 2308	2272	rundll32.exe	f763340.exe
PID 2272 wrote to memory of 2308	2272	rundll32.exe	f763340.exe
PID 2272 wrote to memory of 2308	2272	rundll32.exe	f763340.exe
PID 2960 wrote to memory of 1112	2960	f7617c5.exe	taskhost.exe
PID 2960 wrote to memory of 1168	2960	f7617c5.exe	Dwm.exe
PID 2960 wrote to memory of 1204	2960	f7617c5.exe	Explorer.EXE
PID 2960 wrote to memory of 2896	2960	f7617c5.exe	f7619f6.exe
PID 2960 wrote to memory of 2896	2960	f7617c5.exe	f7619f6.exe
PID 2960 wrote to memory of 2308	2960	f7617c5.exe	f763340.exe
PID 2960 wrote to memory of 2308	2960	f7617c5.exe	f763340.exe
PID 2308 wrote to memory of 1112	2308	f763340.exe	taskhost.exe
PID 2308 wrote to memory of 1168	2308	f763340.exe	Dwm.exe
PID 2308 wrote to memory of 1204	2308	f763340.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f7617c5.exef763340.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7617c5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f763340.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f0354a1e29e767b9ea0f878c0169669e9ea9647f92cffe57236ae9536debf90_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\f7617c5.exe
C:\Users\Admin\AppData\Local\Temp\f7617c5.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2960

C:\Users\Admin\AppData\Local\Temp\f7619f6.exe
C:\Users\Admin\AppData\Local\Temp\f7619f6.exe
4⤵
- Executes dropped EXE
PID:2896

C:\Users\Admin\AppData\Local\Temp\f763340.exe
C:\Users\Admin\AppData\Local\Temp\f763340.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2308

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1640

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
944fdb767ccb5ae66739afaa5b4480fd

SHA1
1058da51408f18c692aeb78ac8eea1e24c9b60a1

SHA256
dfa9f3fe8ae1c58d2f7a169fc2f8700129e1680bb058306a9fccfb7b4fa12a70

SHA512
b3eb07e937caabd54da85ac238775a8b2505aa8cee11698b8c3b716d13d95ebadfa6e68778388390ac6b97627de7a15fb892c07c1338a46e0d3224e823ac239e

Download Submit
\Users\Admin\AppData\Local\Temp\f7617c5.exe
Filesize
97KB

MD5
c255b99dff114b9250322871eca91ab9

SHA1
a72872914ccc310507e00d25d54c758e29425b16

SHA256
f474071435b341d9b856e16be8153a7bff203c8c9b9ae53c5e239b8f2ee63900

SHA512
c42732f9dc256b797fb59d02edf2f89469b7960b2b85b4f0791f29fc51cceca9f2c8e66fcf9c7f925caf33e90089cf35e4a6f6df2b6906929fc5e5d648510ee2

Download Submit
memory/1112-28-0x0000000000420000-0x0000000000422000-memory.dmp

Filesize
8KB

Download
memory/2272-58-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2272-57-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download
memory/2272-77-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/2272-74-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2272-36-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2272-10-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2272-37-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2272-9-0x0000000000140000-0x0000000000152000-memory.dmp

Filesize
72KB

Download
memory/2272-55-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2272-78-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/2272-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2272-45-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2308-106-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2308-104-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2308-102-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2308-169-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2308-204-0x0000000000920000-0x00000000019DA000-memory.dmp

Filesize
16.7MB

Download
memory/2308-203-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2308-80-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-105-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2896-153-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2896-96-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2896-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2960-48-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

Filesize
8KB

Download
memory/2960-63-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-65-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-64-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-62-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-61-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-14-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-16-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-81-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-82-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-84-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-85-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-18-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-22-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-56-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

Filesize
8KB

Download
memory/2960-19-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-21-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-46-0x0000000003C20000-0x0000000003C21000-memory.dmp

Filesize
4KB

Download
memory/2960-107-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-115-0x0000000003BD0000-0x0000000003BD2000-memory.dmp

Filesize
8KB

Download
memory/2960-148-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2960-152-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-20-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-17-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-15-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-12-0x0000000000520000-0x00000000015DA000-memory.dmp

Filesize
16.7MB

Download
memory/2960-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads