Malware Analysis Report

2025-04-13 11:15

Sample ID 230129-m9qsjace49
Target aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
SHA256 aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
Tags
cybergate 1 persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745

Threat Level: Known bad

The file aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745 was found to be: Known bad.

Malicious Activity Summary

cybergate 1 persistence stealer trojan upx

CyberGate, Rebhip

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops startup file

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-29 11:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-29 11:10

Reported

2023-01-29 11:13

Platform

win7-20220812-en

Max time kernel

150s

Max time network

77s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svchost.exe N/A
N/A N/A C:\Windows\Temp\svchost.exe N/A
N/A N/A C:\Windows\Temp\svchost.exe N/A
N/A N/A C:\Windows\Temp\svchost.exe N/A
N/A N/A C:\Windows\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msvcnp .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msvcnp .exe C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcnp = "C:\\Users\\Admin\\AppData\\Roaming\\msvcnp .exe" C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1756 set thread context of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1756 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1760 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1756 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1292 wrote to memory of 1608 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1328 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe

"C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Temp\svchost.exe

"C:\Windows\Temp\svchost.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 hobolicker.servebeer.com udp

Files

memory/1756-54-0x0000000076171000-0x0000000076173000-memory.dmp

memory/1756-55-0x00000000749B0000-0x0000000074F5B000-memory.dmp

memory/1760-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

memory/1292-59-0x0000000000000000-mapping.dmp

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2008-63-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-64-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-66-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-67-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-68-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-69-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-70-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-72-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-73-0x000000000040A0C4-mapping.dmp

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2008-78-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-76-0x0000000000400000-0x000000000044D000-memory.dmp

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1608-85-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 6e11326aa89037c32d94aac927174738
SHA1 002281bc47dab009f00ed9bfa898cb58605ac0c4
SHA256 fe4445a81e9eca7f954f0a5233bed798ba654d39503776d410b071a768147808
SHA512 423c6adb6d3cab2601607b813b1e6d48f60c7b3464f857d8e8f40b2445de1b7b66bc469c6367bd437c7896aec49ba87ab917ad919deeb713f1150c7764df21cf

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Roaming\rundll32-.txt

MD5 a7cf3a9a2608091aeefd3b028f6c8212
SHA1 773f38e2676c57f2b70754aca0a0ddc0e3b3861f
SHA256 aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
SHA512 22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2008-92-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-94-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-96-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-98-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-100-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-102-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-104-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-108-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-106-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-110-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-111-0x0000000000400000-0x000000000044D000-memory.dmp

memory/2008-113-0x0000000010410000-0x0000000010482000-memory.dmp

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1516-118-0x0000000000000000-mapping.dmp

C:\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Windows\Temp\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1516-126-0x0000000010490000-0x0000000010502000-memory.dmp

memory/2008-123-0x0000000010490000-0x0000000010502000-memory.dmp

memory/1516-128-0x0000000010490000-0x0000000010502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 8e88f7ca977aab4c4957850affaf69dc
SHA1 7ce0df92852fda4c1884efda6d839d12d78f2181
SHA256 85067be04b7974987b68c75d5bec4f1b87f03212b89ac3e2a5d1348d7586c670
SHA512 624e53041bd1dca5e3496cb269004f63d3ba895b96eec4bf56d55370bd1288f7f712d90b3457cf8fe26f390441ce8c1af9612edba2cb3eba6bfdbe0918609c44

memory/1516-130-0x0000000010490000-0x0000000010502000-memory.dmp

memory/2008-131-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1756-132-0x00000000749B0000-0x0000000074F5B000-memory.dmp

C:\Users\Admin\AppData\Roaming\msvcnp .exe

MD5 a7cf3a9a2608091aeefd3b028f6c8212
SHA1 773f38e2676c57f2b70754aca0a0ddc0e3b3861f
SHA256 aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
SHA512 22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

memory/1756-134-0x00000000749B0000-0x0000000074F5B000-memory.dmp

memory/1516-135-0x0000000010490000-0x0000000010502000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-29 11:10

Reported

2023-01-29 11:12

Platform

win10v2004-20220812-en

Max time kernel

157s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svchost.exe N/A
N/A N/A C:\Windows\Temp\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msvcnp .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msvcnp .exe C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msvcnp = "C:\\Users\\Admin\\AppData\\Roaming\\msvcnp .exe" C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2052 set thread context of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2052 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 2052 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 2052 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\SysWOW64\cmd.exe
PID 1400 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1400 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1400 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2052 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 2052 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe C:\Windows\Temp\svchost.exe
PID 3436 wrote to memory of 364 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 364 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 3436 wrote to memory of 364 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1136 wrote to memory of 4444 N/A C:\Windows\Temp\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe

"C:\Users\Admin\AppData\Local\Temp\aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java.bat" "

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\java2.bat

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\Temp\svchost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\java2.bat" "

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Temp\svchost.exe

"C:\Windows\Temp\svchost.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 93.184.220.29:80 tcp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 52.168.112.66:443 tcp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.252.51.254:80 tcp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 104.80.225.205:443 tcp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp
N/A 8.8.8.8:53 hobolicker.servebeer.com udp

Files

memory/2052-132-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/1400-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\java.bat

MD5 1896de26a454df8628034ca3e0649905
SHA1 76b98d95a85d043539706b89194c46cf14464abe
SHA256 d85e713743c7e622166fb0f79478de5eabd53d3fe92bd2011ab441bc85ef2208
SHA512 ef69dacd7e717dff05f8a70c5b9a94011f2df3201cc41d5f8cc030f350b069dc090c5b0d3d0bd19098a187977a82d570e1ee153849f609a65889ba789da953d2

memory/3436-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

memory/1136-137-0x0000000000000000-mapping.dmp

memory/1136-138-0x0000000000400000-0x000000000044D000-memory.dmp

memory/1136-140-0x0000000000400000-0x000000000044D000-memory.dmp

C:\Windows\Temp\svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/1448-142-0x0000000000000000-mapping.dmp

memory/1136-141-0x0000000000400000-0x000000000044D000-memory.dmp

C:\Users\Admin\AppData\Roaming\java2.bat

MD5 6e11326aa89037c32d94aac927174738
SHA1 002281bc47dab009f00ed9bfa898cb58605ac0c4
SHA256 fe4445a81e9eca7f954f0a5233bed798ba654d39503776d410b071a768147808
SHA512 423c6adb6d3cab2601607b813b1e6d48f60c7b3464f857d8e8f40b2445de1b7b66bc469c6367bd437c7896aec49ba87ab917ad919deeb713f1150c7764df21cf

memory/364-144-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\rundll32-.txt

MD5 a7cf3a9a2608091aeefd3b028f6c8212
SHA1 773f38e2676c57f2b70754aca0a0ddc0e3b3861f
SHA256 aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
SHA512 22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

memory/1136-147-0x0000000010410000-0x0000000010482000-memory.dmp

memory/4744-151-0x0000000000000000-mapping.dmp

C:\Windows\Temp\svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/1136-153-0x0000000010490000-0x0000000010502000-memory.dmp

memory/4744-156-0x0000000010490000-0x0000000010502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 8e88f7ca977aab4c4957850affaf69dc
SHA1 7ce0df92852fda4c1884efda6d839d12d78f2181
SHA256 85067be04b7974987b68c75d5bec4f1b87f03212b89ac3e2a5d1348d7586c670
SHA512 624e53041bd1dca5e3496cb269004f63d3ba895b96eec4bf56d55370bd1288f7f712d90b3457cf8fe26f390441ce8c1af9612edba2cb3eba6bfdbe0918609c44

memory/4744-158-0x0000000010490000-0x0000000010502000-memory.dmp

memory/2052-159-0x0000000074EC0000-0x0000000075471000-memory.dmp

memory/4744-160-0x0000000010490000-0x0000000010502000-memory.dmp

C:\Users\Admin\AppData\Roaming\msvcnp .exe

MD5 a7cf3a9a2608091aeefd3b028f6c8212
SHA1 773f38e2676c57f2b70754aca0a0ddc0e3b3861f
SHA256 aa15daa6e6e776e23190035b33b26132c24ea5d586f0a23a6c44d369389b7745
SHA512 22ab8c3f06bfc3ce4cb1c886b9fec218cc8a6245c6adc96ac16308a5bdb3ae02fc7ab5437a87182b3d00074009219f1814b84e4b3b1b2a6ebfa38000bfb3185f

memory/2052-162-0x0000000074EC0000-0x0000000075471000-memory.dmp