cybergate | a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085

General

Target

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
Size

1.1MB
MD5

69ed0a64f4346cfdf3ff58216fea4cb8
SHA1

1bd2a03cd1c761d4f70383338abe9ca7c96c5f32
SHA256

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085
SHA512

24a918625ba13d71bcfebf1c51994c44e08f8a92538b8dee681241a6fb65ece2401dc0d02e5b245b7f602bd16d63e388f71e395bc5d20e142305e032b0d435c7
SSDEEP

24576:UZ8kT+thCoNJ4GycFTQhCoNJ4GycFTDLn:88koNJ4GyAT5oNJ4GyATH

Score

10^/10

cybergate victima stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

victima

C2

albertiktn.no-ip.org:81

Mutex

***egbuiertbi***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
WinDir
install_file
svchost.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4908-135-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4908-141-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4908-142-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4908-144-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4952-145-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4908-148-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4952-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4908-158-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4952-160-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3392-164-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2232-165-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4908-167-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/4952-166-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3392-168-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2232-169-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3392-171-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3784-178-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3784-179-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3784-180-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3984-186-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/3984-187-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral2/memory/2232-188-0x0000000024010000-0x0000000024072000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Windows\SysWOW64\sexy_girls_wallpaper.jpg explorer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\sexy_girls_wallpaper.jpg	explorer.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exea1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

description	pid	process	target process
PID 3884 set thread context of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 set thread context of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3184 set thread context of 3784	3184	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3184 set thread context of 3984	3184	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4308 3784 WerFault.exe a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2232 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 2232 explorer.exe
Token: SeDebugPrivilege 2232 explorer.exe

pid	pid_target	process	target process
4308	3784	WerFault.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

pid	process
2232	explorer.exe

description	pid	process
Token: SeDebugPrivilege	2232	explorer.exe
Token: SeDebugPrivilege	2232	explorer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exea1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

pid	process
4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exea1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

pid	process
3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
3184	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exea1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exea1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe

description	pid	process	target process
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4908	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 3884 wrote to memory of 4952	3884	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4952 wrote to memory of 3048	4952	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE
PID 4908 wrote to memory of 3048	4908	a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
"C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
"C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe"
5⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
6⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 532
7⤵
- Program crash
PID:4308

C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
C:\Users\Admin\AppData\Local\Temp\a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
6⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3784 -ip 3784
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
267KB

MD5
e097288bb10661dbf227a6aebb4d56c4

SHA1
85135beda9eee384e8ec40fcb5e823555db7836a

SHA256
521b1bc3f1e6e26e24a526e917993bc34c321a0a14a43cc3d75cb05127ab2fc3

SHA512
5a3e25bbae912ab3ea873ea31cad34b152da371bb4be2d76b355c8eb09e347e3484e8457c90be70292c4051c0a72b6f019c5950597712309592a1507a97331e1

Download Submit
memory/2232-156-0x0000000000000000-mapping.dmp

Download
memory/2232-188-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2232-169-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2232-165-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3184-172-0x0000000000000000-mapping.dmp

Download
memory/3392-168-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3392-157-0x0000000000000000-mapping.dmp

Download
memory/3392-164-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3392-171-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3784-180-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3784-179-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3784-178-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3784-175-0x0000000000000000-mapping.dmp

Download
memory/3984-187-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3984-186-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3984-181-0x0000000000000000-mapping.dmp

Download
memory/4908-141-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4908-134-0x0000000000000000-mapping.dmp

Download
memory/4908-167-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4908-142-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4908-158-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4908-144-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4908-148-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4908-135-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4952-145-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4952-137-0x0000000000000000-mapping.dmp

Download
memory/4952-166-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4952-160-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4952-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads