cybergate | 675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b

Analysis

max time kernel
174s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
Size

2.4MB
MD5

0066a6252b945544338587f038579e59
SHA1

8898bf832443d5a65dccdfba900c8af0d1437b80
SHA256

675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b
SHA512

422931e8f41e23d049d22abcec037c4cb89102b06b7e8f21cfad5ebfd95630761b1608d57186ff1f1b4b8993d6ed4c883ae42837fc2c2f9d95750dece62503e5
SSDEEP

49152:YJZoQrbTFZY1iagk2Zm7y2LLb14n9qM+aObmenMJdQQ7q0y0VAyCLhOud:YtrbTA1137jLJ4nibpncXbTVAyqQk

Score

10^/10

cybergate fully trainer new web cheats persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Fully Trainer New WEB CHEATS

ladrao.no-ip.biz:3000

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
Installer
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
194812
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Installer\\svchost.exe"	archivo1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	archivo1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Installer\\svchost.exe"	archivo1.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	archivo1.exe

Executes dropped EXE 8 IoCs

pid	Process
4816	archivo1.exe
4860	archivo2.exe
1772	archivo1.exe
4236	archivo1.exe
4164	archivo1.exe
2200	svchost.exe
408	svchost.exe
3656	svchost.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8P417KN-M420-D26B-W1RK-T3UHQS31GIE1}\StubPath = "C:\\Windows\\Installer\\svchost.exe Restart"	archivo1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8P417KN-M420-D26B-W1RK-T3UHQS31GIE1}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8P417KN-M420-D26B-W1RK-T3UHQS31GIE1}\StubPath = "C:\\Windows\\Installer\\svchost.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8P417KN-M420-D26B-W1RK-T3UHQS31GIE1}	archivo1.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4236-147-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4236-151-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4236-152-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4236-153-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4236-155-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4236-160-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1996-163-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1996-166-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4236-168-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4236-174-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4236-178-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4164-177-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4164-179-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4164-183-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3656-194-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3656-195-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3656-196-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3656-197-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	archivo1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	archivo1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Installer\\svchost.exe"	archivo1.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	archivo1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Installer\\svchost.exe"	archivo1.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0003000000021b43-135.dat	autoit_exe
behavioral2/files/0x0003000000021b43-136.dat	autoit_exe
behavioral2/files/0x0003000000021b43-142.dat	autoit_exe
behavioral2/files/0x0003000000021b43-148.dat	autoit_exe
behavioral2/files/0x0003000000000705-165.dat	autoit_exe
behavioral2/files/0x0003000000021b43-173.dat	autoit_exe
behavioral2/files/0x0003000000000705-181.dat	autoit_exe
behavioral2/files/0x0003000000000705-185.dat	autoit_exe
behavioral2/files/0x0003000000000705-191.dat	autoit_exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\archivo1.exe	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
File opened for modification	\??\c:\windows\SysWOW64\archivo2.exe	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
File opened for modification	C:\windows\SysWOW64\archivo1.exe	archivo1.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 1772	4816	archivo1.exe	81
PID 1772 set thread context of 4236	1772	archivo1.exe	82
PID 2200 set thread context of 408	2200	svchost.exe	89
PID 408 set thread context of 3656	408	svchost.exe	90

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Installer\svchost.exe	archivo1.exe
File opened for modification	C:\Windows\Installer\svchost.exe	archivo1.exe
File opened for modification	C:\Windows\Installer\svchost.exe	archivo1.exe
File opened for modification	C:\Windows\Installer\	archivo1.exe
File opened for modification	C:\Windows\Installer\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	3656	WerFault.exe	90

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Shak4	archivo2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	archivo1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4164	archivo1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	archivo1.exe
Token: SeDebugPrivilege	4164	archivo1.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4236	archivo1.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe
4860	archivo2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
1772	archivo1.exe
4860	archivo2.exe
4860	archivo2.exe
408	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4816	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	79
PID 4712 wrote to memory of 4816	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	79
PID 4712 wrote to memory of 4816	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	79
PID 4712 wrote to memory of 4860	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	80
PID 4712 wrote to memory of 4860	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	80
PID 4712 wrote to memory of 4860	4712	675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe	80
PID 4816 wrote to memory of 1772	4816	archivo1.exe	81
PID 4816 wrote to memory of 1772	4816	archivo1.exe	81
PID 4816 wrote to memory of 1772	4816	archivo1.exe	81
PID 4816 wrote to memory of 1772	4816	archivo1.exe	81
PID 4816 wrote to memory of 1772	4816	archivo1.exe	81
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 1772 wrote to memory of 4236	1772	archivo1.exe	82
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31
PID 4236 wrote to memory of 376	4236	archivo1.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:376
- C:\Users\Admin\AppData\Local\Temp\675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe
  "C:\Users\Admin\AppData\Local\Temp\675bea33dd4b2cd5e61a3c3602d0e733be4ddcb9c00b91aa3158f3b9569a358b.exe"
  2⤵
  - Checks computer location settings
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\windows\SysWOW64\archivo1.exe
    "C:\windows\system32\archivo1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\windows\SysWOW64\archivo1.exe
      "C:\windows\SysWOW64\archivo1.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\windows\SysWOW64\archivo1.exe
        
        "C:\windows\SysWOW64\archivo1.exe"
        5⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4236
      - C:\windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        Modifies Installed Components in the registry
        
        PID:1996
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1480
      - C:\windows\SysWOW64\archivo1.exe
        
        "C:\windows\SysWOW64\archivo1.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
        
        C:\Windows\Installer\svchost.exe
        
        "C:\Windows\Installer\svchost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2200
        
        C:\Windows\Installer\svchost.exe
        
        "C:\Windows\Installer\svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:408
        
        C:\Windows\Installer\svchost.exe
        
        "C:\Windows\Installer\svchost.exe"
        9⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 544
        10⤵
        Program crash
        
        PID:1784
- - C:\windows\SysWOW64\archivo2.exe
    "C:\windows\system32\archivo2.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3656 -ip 3656
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
370e49ca891dd2e6683a30b685e5b968

SHA1
36e587c67c3f70be81c872a5b5a1ff71dd1ab234

SHA256
706564bda4815881a72dcb0849ebd87132c72a10413a8e798d622f6eff666bea

SHA512
92eda88f4f598da56ce5e8e118fc80124c30f2751658579169443f2df43771b99cb779e1839aa3c05103845821b46071f6854cafaaa2e73abfd349f414357fcd

Download Submit
C:\Windows\Installer\svchost.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\Installer\svchost.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\Installer\svchost.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\Installer\svchost.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\SysWOW64\archivo1.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\SysWOW64\archivo1.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\SysWOW64\archivo1.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\SysWOW64\archivo1.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\Windows\SysWOW64\archivo2.exe

Filesize
1.5MB

MD5
8bfd497ef0353bfe6f4c8d76233046d6

SHA1
2a714d089dd9c9763553515b228ac04ef9de7b87

SHA256
5b64aec47fe95f13abfe19a6743c122ad6540bd2661961549579d3a683b18230

SHA512
4489d00b0f95e27a97433149f10252c70430934c284b9e006f3eca6bd97146a4f6f9ead71fd79f25a9498fc8fd8c24da34a33a0593ab883d10b6ba5a5ff3b1cc

Download Submit
C:\windows\SysWOW64\archivo1.exe

Filesize
921KB

MD5
62cd0f5a1dbed7125de762f6b12c944d

SHA1
c7f629b04e6793fc7b3a13f7833179c284355456

SHA256
98a52eb5a8126195b5bc08f585c79722ff055e644b61d740948956f819fada8a

SHA512
e8af8d9c76cea72112f4e67a1f289995b866d6e030d5286cb47e3b0d6a3d57c89f544ab25a3813b47cbeb1c0d276bffdfa69360777de330672e598f6e5120bed

Download Submit
C:\windows\SysWOW64\archivo2.exe

Filesize
1.5MB

MD5
8bfd497ef0353bfe6f4c8d76233046d6

SHA1
2a714d089dd9c9763553515b228ac04ef9de7b87

SHA256
5b64aec47fe95f13abfe19a6743c122ad6540bd2661961549579d3a683b18230

SHA512
4489d00b0f95e27a97433149f10252c70430934c284b9e006f3eca6bd97146a4f6f9ead71fd79f25a9498fc8fd8c24da34a33a0593ab883d10b6ba5a5ff3b1cc

Download Submit
memory/408-193-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1772-141-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1772-150-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1996-166-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1996-163-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3656-197-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3656-196-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3656-195-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3656-194-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4164-183-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4164-177-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4164-179-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4236-174-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4236-152-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4236-151-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4236-147-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4236-178-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4236-160-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4236-153-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4236-168-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4236-155-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads