Malware Analysis Report

2025-08-10 17:50

Sample ID 221021-sjmwvagce8
Target e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
Tags
cybergate server persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272

Threat Level: Known bad

The file e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272 was found to be: Known bad.

Malicious Activity Summary

cybergate server persistence stealer trojan upx

Cybergate family

CyberGate, Rebhip

Executes dropped EXE

UPX packed file

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-21 15:09

Signatures

Cybergate family

cybergate

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-21 15:09

Reported

2022-10-21 15:12

Platform

win7-20220812-en

Max time kernel

151s

Max time network

67s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\spynet\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File opened for modification C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File opened for modification C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File opened for modification C:\Windows\SysWOW64\spynet\ C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1480 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe

"C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe

"C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\FLOOD IDS 3400.txt

C:\Windows\SysWOW64\spynet\server.exe

"C:\Windows\system32\spynet\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 foryou0077.dyndns.biz udp

Files

memory/1480-54-0x0000000076201000-0x0000000076203000-memory.dmp

memory/1480-56-0x0000000024010000-0x0000000024072000-memory.dmp

memory/1416-59-0x0000000024010000-0x0000000024072000-memory.dmp

memory/888-62-0x0000000000000000-mapping.dmp

memory/888-64-0x0000000074791000-0x0000000074793000-memory.dmp

memory/1480-65-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/888-70-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 cd28f5cce2ca43c105ff9aec08e678bd
SHA1 55a580ba85665c03949a08b7743b1d63a2818926
SHA256 e7d3f574ff5373ab9cd85834a39dc1aa3133ead721a626c5160d5146bf1b5965
SHA512 571ac25dacd7570d89f3448404dd494603daf24b44f8c275867d34ab57c9cb0e06589b98cdb3a7d28d0aa2616d1a5b66c280bdebb9b332d9aefe09eff2619e32

C:\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

memory/888-73-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/1480-75-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/364-79-0x0000000000000000-mapping.dmp

memory/1480-81-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/364-86-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/364-87-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/1364-88-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\FLOOD IDS 3400.txt

MD5 2044ed3f57b5def1f2f949d7b2a2674d
SHA1 703af488f2201d7b439e0757e392815f5848caf9
SHA256 cbae5d101f509716f339f6bb6ebe4d3c4bb23e535165ae49b1256c0c9f752091
SHA512 cc430e1e2d79308e640e9c940226ac6c24b240c4f6e268b723e3fcb4e9e372bdceebeef5269d748f327de1f797162fa16b7b64c9d0878907d5a73370551eddbb

\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

memory/868-93-0x0000000000000000-mapping.dmp

\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

C:\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

memory/364-96-0x0000000024160000-0x00000000241C2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-21 15:09

Reported

2022-10-21 15:12

Platform

win10v2004-20220901-en

Max time kernel

152s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\spynet\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe" C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File opened for modification C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File opened for modification C:\Windows\SysWOW64\spynet\ C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
File created C:\Windows\SysWOW64\spynet\server.exe C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\spynet\server.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE
PID 1604 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe

"C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe

"C:\Users\Admin\AppData\Local\Temp\e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272.exe"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\FLOOD IDS 3400.txt

C:\Windows\SysWOW64\spynet\server.exe

"C:\Windows\system32\spynet\server.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 332 -ip 332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 572

Network

Country Destination Domain Proto
NL 172.217.168.238:443 tcp
NL 142.251.36.45:443 tcp
IT 109.168.115.229:443 tcp
NL 142.250.179.195:443 tcp
NL 172.217.168.202:443 tcp
US 8.8.4.4:443 tcp
NL 216.58.208.99:443 tcp
US 8.8.4.4:443 tcp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
BE 8.238.110.126:80 tcp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.4.4:443 tcp
NL 142.250.179.195:443 tcp
NL 142.250.179.163:443 tcp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp
US 8.8.8.8:53 foryou0077.dyndns.biz udp

Files

memory/1604-133-0x0000000024010000-0x0000000024072000-memory.dmp

memory/4904-137-0x0000000000000000-mapping.dmp

memory/1604-138-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/4904-141-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/4904-142-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 cd28f5cce2ca43c105ff9aec08e678bd
SHA1 55a580ba85665c03949a08b7743b1d63a2818926
SHA256 e7d3f574ff5373ab9cd85834a39dc1aa3133ead721a626c5160d5146bf1b5965
SHA512 571ac25dacd7570d89f3448404dd494603daf24b44f8c275867d34ab57c9cb0e06589b98cdb3a7d28d0aa2616d1a5b66c280bdebb9b332d9aefe09eff2619e32

C:\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

memory/1604-146-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/2260-150-0x0000000000000000-mapping.dmp

memory/1604-151-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/2260-154-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/2060-155-0x0000000000000000-mapping.dmp

memory/2260-156-0x0000000024160000-0x00000000241C2000-memory.dmp

memory/332-157-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\spynet\server.exe

MD5 1ced584972d8292b170f2381b2978fd4
SHA1 7e13077c0df5ee3d9828d63094446513fdcedff6
SHA256 e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
SHA512 604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

C:\Users\Admin\AppData\Local\Temp\FLOOD IDS 3400.txt

MD5 2044ed3f57b5def1f2f949d7b2a2674d
SHA1 703af488f2201d7b439e0757e392815f5848caf9
SHA256 cbae5d101f509716f339f6bb6ebe4d3c4bb23e535165ae49b1256c0c9f752091
SHA512 cc430e1e2d79308e640e9c940226ac6c24b240c4f6e268b723e3fcb4e9e372bdceebeef5269d748f327de1f797162fa16b7b64c9d0878907d5a73370551eddbb

memory/4904-160-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/2260-161-0x0000000024160000-0x00000000241C2000-memory.dmp