cybergate | 8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Size

415KB
MD5

6aa1a81f56faae2bab4f431ffc5093de
SHA1

0adcbde8448f11bcce2e893e56ba76c2e0cd0a8e
SHA256

8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0
SHA512

1bffbdf08d092edbbc7d492231d9c1de5e30bf64e8b3a0b9ef0bf58625549d9d7be5585486928ff543230d43e1abda2ca6f0557e36a7b844d7dde78116fe8c19
SSDEEP

12288:GSYEiHfn/AqLOfx7KQdQJs55e/Bta0b01U+:ZqAxTuQM/Ks01D

Score

10^/10

cybergate teste persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Teste

coquetelmoltof.no-ip.org:888

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\explorer.exe"	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\explorer.exe"	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Executes dropped EXE 1 IoCs

pid	Process
4348	explorer.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\explorer.exe Restart"	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\explorer.exe"	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2676-135-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2676-140-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4932-143-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4932-146-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2676-148-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/2676-153-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/5004-156-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/5004-160-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/5004-167-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\dir\\install\\install\\explorer.exe"	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\dir\\install\\install\\explorer.exe"	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	4348	WerFault.exe	86

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
Token: SeDebugPrivilege	5004	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22
PID 2676 wrote to memory of 2824	2676	8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe	22

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2824
- C:\Users\Admin\AppData\Local\Temp\8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
  "C:\Users\Admin\AppData\Local\Temp\8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:4932
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe
    "C:\Users\Admin\AppData\Local\Temp\8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0.exe"
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
  - - C:\dir\install\install\explorer.exe
      "C:\dir\install\install\explorer.exe"
      4⤵
      Executes dropped EXE
      PID:4348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 616
        5⤵
        Program crash
        
        PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4348 -ip 4348
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
8640f42aad43d95dad20bf28dea4aad2

SHA1
da39034f091f8ac59b0e30cd399ebe3ebb4ea634

SHA256
540894b60c732e09815f42fbedffe43f17d13a9743ad83fcec0b5efdc0c70b1a

SHA512
2ace5e39f9effb7f73101309cab5b69bd774e696b599c7e2dfd4d8bae5528844fdc172ad00a27ecc84f5560091974dcce2c55dd6990815aab6b66320f66e9710

Download Submit
C:\dir\install\install\explorer.exe

Filesize
415KB

MD5
6aa1a81f56faae2bab4f431ffc5093de

SHA1
0adcbde8448f11bcce2e893e56ba76c2e0cd0a8e

SHA256
8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0

SHA512
1bffbdf08d092edbbc7d492231d9c1de5e30bf64e8b3a0b9ef0bf58625549d9d7be5585486928ff543230d43e1abda2ca6f0557e36a7b844d7dde78116fe8c19

Download Submit
\??\c:\dir\install\install\explorer.exe

Filesize
415KB

MD5
6aa1a81f56faae2bab4f431ffc5093de

SHA1
0adcbde8448f11bcce2e893e56ba76c2e0cd0a8e

SHA256
8e475dfa209eb12c6759d4f31d46ce747234ceb2559193a6c20795503c0ba8b0

SHA512
1bffbdf08d092edbbc7d492231d9c1de5e30bf64e8b3a0b9ef0bf58625549d9d7be5585486928ff543230d43e1abda2ca6f0557e36a7b844d7dde78116fe8c19

Download Submit
memory/2676-148-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/2676-135-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2676-132-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/2676-133-0x0000000002870000-0x0000000002960000-memory.dmp

Filesize
960KB

Download
memory/2676-158-0x0000000002870000-0x0000000002960000-memory.dmp

Filesize
960KB

Download
memory/2676-157-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/2676-140-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2676-153-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4348-163-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/4348-164-0x00000000027D0000-0x00000000028C0000-memory.dmp

Filesize
960KB

Download
memory/4348-165-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/4932-146-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4932-143-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/5004-156-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/5004-160-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/5004-159-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/5004-166-0x0000000000400000-0x000000000081C000-memory.dmp

Filesize
4.1MB

Download
memory/5004-167-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads