Malware Analysis Report

2025-08-05 12:36

Sample ID 221106-l2d84ahafm
Target f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
Tags
modiloader cybergate hunter persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c

Threat Level: Known bad

The file f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c was found to be: Known bad.

Malicious Activity Summary

modiloader cybergate hunter persistence stealer trojan upx

Modiloader family

ModiLoader, DBatLoader

ModiLoader Second Stage

CyberGate, Rebhip

ModiLoader Second Stage

Adds policy Run key to start application

Executes dropped EXE

UPX packed file

Modifies Installed Components in the registry

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-06 10:01

Signatures

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A

Modiloader family

modiloader

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-06 10:01

Reported

2022-11-06 11:58

Platform

win7-20220812-en

Max time kernel

151s

Max time network

63s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\System\javaw.exe N/A
N/A N/A C:\Windows\SysWOW64\System\javaw.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W} C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W}\StubPath = "C:\\Windows\\system32\\System\\javaw.exe Restart" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\System\javaw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\WinDbg\\windbg.exe\" " C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\System\javaw.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
File opened for modification C:\Windows\SysWOW64\System\javaw.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 836 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 836 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 836 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 836 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 1272 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe

"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Debugger" /t reg_sz /d """"C:\Users\Admin\AppData\Roaming\WinDbg\windbg.exe"""

C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe

"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\System\javaw.exe

"C:\Windows\system32\System\javaw.exe"

C:\Windows\SysWOW64\System\javaw.exe

"C:\Windows\SysWOW64\System\javaw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 Huntercyber.no-ip.org udp

Files

memory/836-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

memory/960-55-0x0000000000000000-mapping.dmp

memory/1272-56-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1272-58-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1272-60-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1272-59-0x000000000040E1A8-mapping.dmp

memory/1272-62-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1272-63-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1272-65-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1352-68-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1508-71-0x0000000000000000-mapping.dmp

memory/1508-73-0x0000000074F51000-0x0000000074F53000-memory.dmp

memory/1272-74-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/1272-80-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1508-79-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 08b1acf06b2540d855699c2efc46f2dd
SHA1 7d872f354870f4bb8a725ca7278fa3c50400413e
SHA256 1de38c6609db5c8da1f60a0928540ffe760b7b7678a9f932d46332ff88ade9f8
SHA512 9108c962a11d11f6146ac231ae9867a579c54fb3f8994acc0592f06f78c826829b278b9275f2af3b7bcdceb98c755f476b2ec9fad3fc715702a75eee9cd13387

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

memory/1084-85-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

memory/1048-92-0x000000000040E1A8-mapping.dmp

memory/1048-96-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1048-97-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1508-98-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/1048-99-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1508-100-0x0000000010480000-0x00000000104E5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-06 10:01

Reported

2022-11-06 11:58

Platform

win10v2004-20220901-en

Max time kernel

150s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\System\javaw.exe N/A
N/A N/A C:\Windows\SysWOW64\System\javaw.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W} C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W}\StubPath = "C:\\Windows\\system32\\System\\javaw.exe Restart" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\WinDbg\\windbg.exe\" " C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\System\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\System\javaw.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A
File opened for modification C:\Windows\SysWOW64\System\javaw.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\System\javaw.exe

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4548 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 4548 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 4548 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 4548 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 4548 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE
PID 4556 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe

"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Debugger" /t reg_sz /d """"C:\Users\Admin\AppData\Roaming\WinDbg\windbg.exe"""

C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe

"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\System\javaw.exe

"C:\Windows\system32\System\javaw.exe"

C:\Windows\SysWOW64\System\javaw.exe

"C:\Windows\SysWOW64\System\javaw.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 596

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
FR 2.18.109.224:443 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
IE 20.50.80.209:443 tcp
NL 96.16.53.148:80 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
NL 67.26.109.254:80 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
NL 67.26.109.254:80 tcp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp
US 8.8.8.8:53 Huntercyber.no-ip.org udp

Files

memory/1724-132-0x0000000000000000-mapping.dmp

memory/4556-133-0x0000000000000000-mapping.dmp

memory/4556-134-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4556-135-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4556-136-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4556-137-0x0000000000400000-0x000000000044F000-memory.dmp

memory/4556-139-0x0000000010410000-0x0000000010475000-memory.dmp

memory/916-143-0x0000000000000000-mapping.dmp

memory/4556-144-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/916-147-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4556-148-0x0000000000400000-0x000000000044F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 08b1acf06b2540d855699c2efc46f2dd
SHA1 7d872f354870f4bb8a725ca7278fa3c50400413e
SHA256 1de38c6609db5c8da1f60a0928540ffe760b7b7678a9f932d46332ff88ade9f8
SHA512 9108c962a11d11f6146ac231ae9867a579c54fb3f8994acc0592f06f78c826829b278b9275f2af3b7bcdceb98c755f476b2ec9fad3fc715702a75eee9cd13387

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

memory/3780-151-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

memory/916-153-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/5024-154-0x0000000000000000-mapping.dmp

C:\Windows\SysWOW64\System\javaw.exe

MD5 033edeec6f38f5783124a6ba7a4d2458
SHA1 b80175459763f17888c2750bf64e4bc618b161c7
SHA256 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512 add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22

memory/5024-158-0x0000000000400000-0x000000000044F000-memory.dmp

memory/5024-159-0x0000000000400000-0x000000000044F000-memory.dmp

memory/5024-160-0x0000000000400000-0x000000000044F000-memory.dmp

memory/916-161-0x0000000010480000-0x00000000104E5000-memory.dmp