cybergate | 08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6

General

Target

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
Size

282KB
MD5

2dcdd2e64ead9603d431c5e032eb3c40
SHA1

d2897ad6f755c2563b05b645aed7d7b37f155ef7
SHA256

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6
SHA512

e3c38782ccbe8f079caa9155660c60e83f661c9b82b7ba03ebbba0adbc7060e3ca31547eec716e9d56ef1101312c3ea579624f0b2107a90a4477ef46a91e4d9e
SSDEEP

6144:dxJsGLnn2oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ7:vJsGr24h/xQp6+tqOYy9zo0c

Score

10^/10

cybergate lammer stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

127.0.0.1:81

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./
ftp_interval
30
injected_process
explorer.exe
install_dir
Microsoft
install_file
Pluguin.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
message_box_title
LAMMER
password
la

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Executes dropped EXE 1 IoCs

Processes:

Pluguin.exe

pid process

2040 Pluguin.exe

pid	process
2040	Pluguin.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1612-58-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1620-63-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1620-71-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1620-72-0x0000000024010000-0x0000000024070000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

pid	process
1620	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
1620	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

pid process

1612 08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

pid process

1620 08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

pid	process
1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

description	pid	process
Token: SeDebugPrivilege	1620	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
Token: SeDebugPrivilege	1620	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

C:\Users\Admin\AppData\Local\Temp\08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
"C:\Users\Admin\AppData\Local\Temp\08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
"C:\Users\Admin\AppData\Local\Temp\08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe"
2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe
"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"
3⤵
- Executes dropped EXE
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
1d649f30932b23188f83b43c065ea8b0

SHA1
8fd2a2e085c3d57a2c4e6be341a445cd6800fd66

SHA256
a0ba5df06d64b9726e5c4944b412eee50bf0df7afd0b672800bc1204a524c8f0

SHA512
31d5cafaf31966b38c7211e8e293082148b0217eeb5c8a902181ae06fb0ffc51573f7476a8c8c2785ba8c010ff1f199ee3e2e028cba175722f0a079c78b6672a

Download Submit
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe
Filesize
282KB

MD5
2dcdd2e64ead9603d431c5e032eb3c40

SHA1
d2897ad6f755c2563b05b645aed7d7b37f155ef7

SHA256
08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6

SHA512
e3c38782ccbe8f079caa9155660c60e83f661c9b82b7ba03ebbba0adbc7060e3ca31547eec716e9d56ef1101312c3ea579624f0b2107a90a4477ef46a91e4d9e

Download Submit
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe
Filesize
282KB

MD5
2dcdd2e64ead9603d431c5e032eb3c40

SHA1
d2897ad6f755c2563b05b645aed7d7b37f155ef7

SHA256
08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6

SHA512
e3c38782ccbe8f079caa9155660c60e83f661c9b82b7ba03ebbba0adbc7060e3ca31547eec716e9d56ef1101312c3ea579624f0b2107a90a4477ef46a91e4d9e

Download Submit
\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe
Filesize
282KB

MD5
2dcdd2e64ead9603d431c5e032eb3c40

SHA1
d2897ad6f755c2563b05b645aed7d7b37f155ef7

SHA256
08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6

SHA512
e3c38782ccbe8f079caa9155660c60e83f661c9b82b7ba03ebbba0adbc7060e3ca31547eec716e9d56ef1101312c3ea579624f0b2107a90a4477ef46a91e4d9e

Download Submit
\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe
Filesize
282KB

MD5
2dcdd2e64ead9603d431c5e032eb3c40

SHA1
d2897ad6f755c2563b05b645aed7d7b37f155ef7

SHA256
08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6

SHA512
e3c38782ccbe8f079caa9155660c60e83f661c9b82b7ba03ebbba0adbc7060e3ca31547eec716e9d56ef1101312c3ea579624f0b2107a90a4477ef46a91e4d9e

Download Submit
memory/1612-58-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1620-63-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1620-61-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1620-56-0x0000000000000000-mapping.dmp

Download
memory/1620-71-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1620-72-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/2040-68-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe
PID 1612 wrote to memory of 1620	1612	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe	08de20df8c4cd3c1f30de8ae54bfa1115bb9982d1f9442a7d03d7fcf14a003d6.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads