cybergate | 3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Size

676KB
MD5

92f7c3b8ada8735da4ca4f9669dcff32
SHA1

8e8de3741b203119fd65ded1f84e114c7e46c3f2
SHA256

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1
SHA512

15f9a7042de080eab4ca504ed2450e73ed87f7f4283529180777d2a8e91d94b1a90efddb0dc08732459f738ff8d3abfb913447a8364942bc22a51a89106721dd

Score

10^/10

cybergate pb persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

kauan0802.duckdns.org:5000

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
System
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Esse Software não e Compativel Com essa versão do windows
message_box_title
Windows
password
123
regkey_hkcu
Sistema Operacional 64x
regkey_hklm
Windows Defender

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\System\\explorer.exe"	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\System\\explorer.exe"	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Executes dropped EXE 3 IoCs

Processes:

AutoXP [PBBR] -.exeGerador de Cash 2016.exeexplorer.exe

pid process

1112 AutoXP [PBBR] -.exe
320 Gerador de Cash 2016.exe
1068 explorer.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
1112	AutoXP [PBBR] -.exe
320	Gerador de Cash 2016.exe
1068	explorer.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1540-56-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1540-65-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/820-70-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/820-73-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1540-75-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1540-81-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/536-86-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/536-98-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid	process
536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sistema Operacional 64x = "C:\\Windows\\System\\explorer.exe"	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Windows\\System\\explorer.exe"	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Drops file in Windows directory 4 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

description	ioc	process
File created	C:\Windows\System\explorer.exe	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
File opened for modification	C:\Windows\System\explorer.exe	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
File opened for modification	C:\Windows\System\explorer.exe	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
File opened for modification	C:\Windows\System\	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid process

1540 3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid process

536 3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid	process
1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

description	pid	process
Token: SeDebugPrivilege	536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
Token: SeDebugPrivilege	536	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid process

1540 3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

pid	process
1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe

description	pid	process	target process
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE
PID 1540 wrote to memory of 1400	1540	3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
"C:\Users\Admin\AppData\Local\Temp\3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe
"C:\Users\Admin\AppData\Local\Temp\3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1.exe"
3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Users\Admin\AppData\Local\Temp\AutoXP [PBBR] -.exe
"C:\Users\Admin\AppData\Local\Temp\AutoXP [PBBR] -.exe"
4⤵
- Executes dropped EXE
PID:1112

C:\Users\Admin\AppData\Local\Temp\Gerador de Cash 2016.exe
"C:\Users\Admin\AppData\Local\Temp\Gerador de Cash 2016.exe"
4⤵
- Executes dropped EXE
PID:320

C:\Windows\System\explorer.exe
"C:\Windows\System\explorer.exe"
4⤵
- Executes dropped EXE
PID:1068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AutoXP [PBBR] -.exe
Filesize
299KB

MD5
bf29f3a4bdbee79c0da3717aa44338ef

SHA1
ca7f07e95e428d3f46c5fddff15b3caeb03eea30

SHA256
8af5ba7c1318cf44c818238137109ef7cea0be0853853614168d2f1ce514798d

SHA512
1b8f565304c501abe5c6c71cc8ea4226b4ab445d02bda73ff8d53722ecf68cdb0307f45ffe1f857e73d2d1b5f255903cbef3b18e321ec2de5abb605fb83f4b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AutoXP [PBBR] -.exe
Filesize
299KB

MD5
bf29f3a4bdbee79c0da3717aa44338ef

SHA1
ca7f07e95e428d3f46c5fddff15b3caeb03eea30

SHA256
8af5ba7c1318cf44c818238137109ef7cea0be0853853614168d2f1ce514798d

SHA512
1b8f565304c501abe5c6c71cc8ea4226b4ab445d02bda73ff8d53722ecf68cdb0307f45ffe1f857e73d2d1b5f255903cbef3b18e321ec2de5abb605fb83f4b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gerador de Cash 2016.exe
Filesize
62KB

MD5
d4cd3008892010115bf02ce8b9f06347

SHA1
c7ddf6c6b5ffb32d62b057039e0a0e5700ca1fe6

SHA256
0500d89f67d7f34d582a8a4bdf8f0e4a31c20095cc289c40830dd60873348624

SHA512
e7c188b4989b5c3cc5bf03dd5a2eac251fbe640294672238ec2f11f228ebee0c949b62325cf44a9f77b8402de4e0bab0c9ba8b37991ac93d4386aaf05aee2635

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gerador de Cash 2016.exe
Filesize
62KB

MD5
d4cd3008892010115bf02ce8b9f06347

SHA1
c7ddf6c6b5ffb32d62b057039e0a0e5700ca1fe6

SHA256
0500d89f67d7f34d582a8a4bdf8f0e4a31c20095cc289c40830dd60873348624

SHA512
e7c188b4989b5c3cc5bf03dd5a2eac251fbe640294672238ec2f11f228ebee0c949b62325cf44a9f77b8402de4e0bab0c9ba8b37991ac93d4386aaf05aee2635

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
591KB

MD5
29ee39f1da137929f098de7ea82fc8ba

SHA1
7475ba12e26abf1d8887987cacaee8b7147f4243

SHA256
09a7ee57e3cbd5571e7183987850d34ee31c9bb4f6cc851568b62d327b69aace

SHA512
0c8880a061d7eceea1a877661ea041d58aa03e9513ca0a127ce09a50265b5212670ab1f2871915aaa9902c952b7795f6c4b06465cdbbfe5d8bd6c0dea3b2412d

Download Submit
C:\Windows\System\explorer.exe
Filesize
676KB

MD5
92f7c3b8ada8735da4ca4f9669dcff32

SHA1
8e8de3741b203119fd65ded1f84e114c7e46c3f2

SHA256
3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1

SHA512
15f9a7042de080eab4ca504ed2450e73ed87f7f4283529180777d2a8e91d94b1a90efddb0dc08732459f738ff8d3abfb913447a8364942bc22a51a89106721dd

Download Submit
C:\Windows\system\explorer.exe
Filesize
676KB

MD5
92f7c3b8ada8735da4ca4f9669dcff32

SHA1
8e8de3741b203119fd65ded1f84e114c7e46c3f2

SHA256
3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1

SHA512
15f9a7042de080eab4ca504ed2450e73ed87f7f4283529180777d2a8e91d94b1a90efddb0dc08732459f738ff8d3abfb913447a8364942bc22a51a89106721dd

Download Submit
\Users\Admin\AppData\Local\Temp\AutoXP [PBBR] -.exe
Filesize
299KB

MD5
bf29f3a4bdbee79c0da3717aa44338ef

SHA1
ca7f07e95e428d3f46c5fddff15b3caeb03eea30

SHA256
8af5ba7c1318cf44c818238137109ef7cea0be0853853614168d2f1ce514798d

SHA512
1b8f565304c501abe5c6c71cc8ea4226b4ab445d02bda73ff8d53722ecf68cdb0307f45ffe1f857e73d2d1b5f255903cbef3b18e321ec2de5abb605fb83f4b9e

Download Submit
\Users\Admin\AppData\Local\Temp\Gerador de Cash 2016.exe
Filesize
62KB

MD5
d4cd3008892010115bf02ce8b9f06347

SHA1
c7ddf6c6b5ffb32d62b057039e0a0e5700ca1fe6

SHA256
0500d89f67d7f34d582a8a4bdf8f0e4a31c20095cc289c40830dd60873348624

SHA512
e7c188b4989b5c3cc5bf03dd5a2eac251fbe640294672238ec2f11f228ebee0c949b62325cf44a9f77b8402de4e0bab0c9ba8b37991ac93d4386aaf05aee2635

Download Submit
\Windows\system\explorer.exe
Filesize
676KB

MD5
92f7c3b8ada8735da4ca4f9669dcff32

SHA1
8e8de3741b203119fd65ded1f84e114c7e46c3f2

SHA256
3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1

SHA512
15f9a7042de080eab4ca504ed2450e73ed87f7f4283529180777d2a8e91d94b1a90efddb0dc08732459f738ff8d3abfb913447a8364942bc22a51a89106721dd

Download Submit
\Windows\system\explorer.exe
Filesize
676KB

MD5
92f7c3b8ada8735da4ca4f9669dcff32

SHA1
8e8de3741b203119fd65ded1f84e114c7e46c3f2

SHA256
3f2ba691bdc22a1debdbe20ff59d56d611f1491b08eba4bb7286a14ea3dc7ba1

SHA512
15f9a7042de080eab4ca504ed2450e73ed87f7f4283529180777d2a8e91d94b1a90efddb0dc08732459f738ff8d3abfb913447a8364942bc22a51a89106721dd

Download Submit
memory/320-95-0x000007FEF28F0000-0x000007FEF3313000-memory.dmp

Filesize
10.1MB

Download
memory/320-92-0x0000000000000000-mapping.dmp

Download
memory/320-103-0x000007FEEE310000-0x000007FEEF3A6000-memory.dmp

Filesize
16.6MB

Download
memory/320-104-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/320-105-0x0000000000C86000-0x0000000000CA5000-memory.dmp

Filesize
124KB

Download
memory/536-98-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/536-79-0x0000000000000000-mapping.dmp

Download
memory/536-86-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/820-62-0x0000000000000000-mapping.dmp

Download
memory/820-73-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/820-64-0x0000000074611000-0x0000000074613000-memory.dmp

Filesize
8KB

Download
memory/820-70-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1068-100-0x0000000000000000-mapping.dmp

Download
memory/1112-96-0x0000000000260000-0x00000000002B4000-memory.dmp

Filesize
336KB

Download
memory/1112-88-0x0000000000000000-mapping.dmp

Download
memory/1112-106-0x0000000004935000-0x0000000004946000-memory.dmp

Filesize
68KB

Download
memory/1400-59-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1540-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1540-81-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1540-65-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1540-75-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1540-56-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download