Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 17:24

General

  • Target
    729c1c038253da1ef9240cf6b1625623.exe
  • Size 1.2MB
  • Sample240124-vy2pnaecf9
  • SHA256 a03030240bdd94d5e0716bb3c22fdcc8a915c870d644d214d69a62073fa3bdd3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • byatmaca.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    secst.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe
        "C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe
          C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4052
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:1940
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:5224
            • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe
              "C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:5260
              • C:\Windows\install\secst.exe
                "C:\Windows\install\secst.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:6628
                • C:\Windows\install\secst.exe
                  C:\Windows\install\secst.exe
                  6⤵
                  • Executes dropped EXE
                  PID:6760
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 540
                    7⤵
                    • Program crash
                    PID:7052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6760 -ip 6760
        1⤵
          PID:7000

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 9645df22a6bff4899facea5a42635ef938a89e71da77a47a0fe5379eb2ddb1c3
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 850f96c317cede3fcc44b8b3ee49d570665bc2d069b53fac4e009993b808c4fb
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67cab37c620e244e549611fc27cfc0c1ffde41f797ddde71da1ddf9d05d4d871
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d0ad0dcba55319ec82f0c92b8ebcb3c401f54ac598427ea6d56bf9121054930
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2cbec81444eec1e63fdba4ccefdd7e9c55d79faddef6c6acc05767e076b7d73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c189f75051d1c9a017a3d7cbece5e9280e0a6fc30d903b40364e7f8ce90bd0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1050c442edf1cb07658dcc8609ffd499b4ca9d22a3964909ae217f82d99327b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3733820f930412f41d237a68158fbb4bcf9de3b7820fcce4ecdbdaa7833ee4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d347e20c9fc4810e7a72ef9ee22160f2f065969deb25df8ed774c498e9557e8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e834aa8b8873e08b2afee485b55e29e03214dea3e4f871d116d9c00b35343e49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c0cbbd51e4ea650fea6d0c4436601ae8cc883c81bc5de8b2b84bdb73a0669af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a6ad8a489daa6bdb42972c021155c91dac4fc071b3c6ff48e535da2bda8e2fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5346451c1fd582dfe42b12f7a689c3197ed5d0d0e2a20a1abc4d45967a86f672
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80f10229f907e19dfa123379c238b38ca10e96e361e26f4d101a0c13fbf9844b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e732318aa323e7f913b5f1f5fe3222874325df7c96ec6608e8e661ea567f69b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b63e3168078a4d33e37ff7566b6899321608af4c5da424caaec1ed72fda8ccc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8477c207dae569843f5b020c8ff4769554c6356d83b4c0de25fd44e921da75c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69de331c9124345e068080e4c9d8691c891c9071efe222bb5928f451ed2d88f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 749c89f126f1da4be3854bce08e11abc6418bfcfe295599388545605c36e4c68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cc86245096f108f721cf8fbf3386b5933a1782a8ce82c38bbd1e9b98e2d54ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b14c4211e60823243d500ddf70ad655aeb2caf2fc0691fad82561bd86f0825e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bf6a5650d88d1936800f0b54510f24f1d72994493971141875e7688fdffc08b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3937c7dafb00c41adde461f5b9c917bd78d2de78e11f1fd31e988fdcb3e6e683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 274b3cb0d3fed083c7d5704543c752cbd4320e19b96183435528802ebc94e5c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59dfe1aad1b513b5646adaf5ac781d294d6e822ba654bc481adc30934a416662
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e83b293cea09400f730b0497ee3b404df3f45eda937fa69d9b453b3119e9c6ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e195258ed32e2256a4fb0219672a40f7efc4430e3ce3fb20557abb5303f26b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a47095c7c6fdee8c559336c376a858ac61d40a439a9279298a0765ec6bbc70b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcd10a6024acb663e24a519a3b62c5b98e74f971cfe6f6b2c6b193aa269767ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a1989b671d696ddf071d3780ae36d5fa47a9d8d581b4e00fafde8f8a0989ea8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27571bf034a8a68d91c449591b5a1a1b290c33647265c02697c005a4dd36f88e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6274a524b24765c2f0fc0d5fef4022485780c5e3de1a35496ac2ce64593aa189
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81662a0bb8a8f00dcd1a2499952d68e9469b37e0bcb9ecee7d1c555bc09d038a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e10f5391db773e8db2bf2610b88ca63800eeba4d5874d54abdcbae6716104cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b4e496a15329f852890e57de323da38f2cd13237d0d776bdb907ba3fa003e8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0d3ceae12a84f3e480db0e478679b8db9a0a97e149a52473774648ef66f2a91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16e34c7beddf4222a9a1ed9dd8ccd8e7f61d7e842711fa20cfdee4c72a1c9715
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9f0012fc704e301b2b9024bee470d3840c55ebb8341c463f1bea546eae83a27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 185483fe74c5baa3ed0d328ddec6a5a64a8d889745512d74a734772fa0f69158
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcfd34e44af9b098469235e3c174114f30b383e694eb91781bc56772cb91e279
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4accd8af38215e644b17c48e5c7e74755ce1a6bb8cd04cd3b6a89d9dd4812a8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49f56c7e07449d79d0705276cb835d629c377a08a1adabf922d037a87a3f5b0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 432e1093c2f5c7ed600bf03aa20337787e0243718e0100e6aa34f9abb9b60db9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3971dca160222c426f506a5124f5f7aee6d38f8aacbc9b032269c2108bcd0b6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58e1a279b5c3e1144ed086aab0e7ff7075240211fc5ca861711e639a7023295f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19886e5f9e40f3566fdf94431e94242ae7094195ec58ea0b3ca578fb5eba4a36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15162459642f2235af3b8049d067a15e6d6daa03c987ba8af6ad5aef672ca3b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f231a2c865b00a538585d2be6968d6f6e134de620c9b4f7479a5ad7f9c2caa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3944f1c7dfd5bad9e3bd8838ab3b5c5c2241eb6554a7699e657f06dc6495f29e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59e10b5a44b3bcb10593ea97a2a310fa578c30bf26a2ffd9948e7682e7f71286
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f177fc33d994725be35e05d3d4d057494d8c90ebceaef50ecb4ddb8f0e349808
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 698820d96e7faffc0578ff7c46ae9d823ea9dc7b4a528f060ffb2ec7bd6db34d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcf9eb066c2a7287d8cac5b2c08ba6ed6a15693e7e40b80013ae2af492a07d27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6825b945b247949af6664235d6d0d8493edc55a7010d9a5aec31daedbe2e8861
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1fe40affa1dcbd3b748a8f0e959de46824f7b72878cd63028e707160870ca58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 074395405c9cd3284dfe95cfd6dbd5f8ef798b894cf64a6f8f5892da69b3d18d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef2cc2c4f04202f1db24ba41c4505bc8f43a4a2d3fd29220e6422b9b2d1f29f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bacfcadf7965724403f209eaee19ed4a9eb64f6a160c529808df6ccd1925ee49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb88598f7adf4ca5822a0fffac46900047724e8e67e8b70c0211a061a0d4b5cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c579a184764d72c005a6ca7de11d1bdf90711c96883f06c6db9b2a04a36f764b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d01c313f520ba37e69228e79187eac701c0bb2c7ce30f094a931a74c67091432
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d7bde3b81b3d32999a92ba0d01df29b66012bb9485dfc19467c963386e145d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dd9cf9a400d8a048c397f4691c2278aab9b89d9f4b01f46f6dd376c9fcc9568
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a28ec68c98505805781b543cc35d809c827940920e3d14e5ab8a5fbaa0748c4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d465077158da00243a1df640eacea4ff67367dc9418c16f9711f8f1e07076ef6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a7862e511f01e26b9d1ad37a49138f1eb592904b1a626e11ea8abd1860a8e1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67b262c7ce827a437bcbe3510901681ac8fe495ca38eb2f6b3b984b6a8cb462c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af845198303159d8bed103212dd602ae7209ddf2dc8ad48fbd31e814a056f774
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c352e4d0206d4b6a4e7c65d338e501b9a0cceb57ef3b48a466a57baba7accf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71f28890a9bcda7034ac220ed3002fa14802cdfdf829584a5d0c5bf88aaf5a7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ea70d09ce16d52507d551f160a416713b4cbf8327d380289542894ad6922b16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3ce21e70db92a7b474d00cf3a2c26dccbd30e842c812413e7c1326218504f33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 feda3cc43ae5f3c370926ee9ea556eb16ee05b93f4f4af703689a09d65780d59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd87bf71814b4b1d3a34792278c4252bc037b17ead58e58c2571c81eb945000e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 273d600cb00f89ddb96c0135050b10fcf7f3c5b3cb60cfa0a0844a8b7c6fc0b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e71851e0588804fea7277c4b04dcaba5ec90b588b3578dc07e3dcdd31605ac1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6e62aa73ef85e3a6daf65d7babb54ad60e0d97f368ad8b059df0fc1ad14f068
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2faaeb2a4d4ec701cae7ffdcdf87338112b1845404a8182d70afe63501619675
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2622724d0c8646cbb1c95fae1310ac4cfd8fb0e515b1afc6fe2e3a0b2fa846a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4957ba9c27c6299d8cad4b4abfc925b67ed0eb2b8b2f85bc7cc538703a479a49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32a860bf8793faa7a65f493a1986e2de0b7058927e433126a014f8eb4c193654
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9164bb24e0d7e278cd949210836c1eb7d9759a887181892578e431c986e4c543
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3401e61b62bf4244c8a8e154e86fdecbfba041601ab0dd5760203e68fd342199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faad4add36091f21a1ea7b1f23f49118607ca6195391205c9b97bba0b71688fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84c41cf7219a130efd2f79452aadb9ae6360161e2ced9ade35dd73d53da82b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4627380fd693785a860c6840b16aacb099f3edc6b9654cca2bb6a40eb5bfe6c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abf6c1e71e8e773a5a22dd064a39ffde87a4d957519458b4ea16868cf8d0eab8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ff035043205d89b1b786429d4f5431fb306a915c1c849e7a12b827663bb6c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18ba6c900680086488734cbcd77ac43475b78165813e451eaf2844522ffa1ae3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99fb86b97f30451b835ac0452c5cc4d9cb3756ec48f5865fa173186054619be6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fa3a7461db5bc943ac5b99a9a8835d56a408839d4aacea607e30612c06e1df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86b98bfda2d0a91368f703845f751b8a15a4046a23f4e54822dbeee776072f01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0db14fc2c1437936670ebd435196f0c8055349d2ee0871b7a576f2b2d9608a7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9d72cd6f7c98b9a2ad07359e65bc54bdc9bacf8189df6a54194bc33e8885595
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7070cc9e4f6a03125919238312ab2abb53d99c39627788dd8101bebeb5c23b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c370e50bd3fe81b84cb95016237b1e24ec9838ccf5d0f36020f32d53b99fb79a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d10a4a1fcf742744fb349a5ce9448a8e15c85c022a5e8e7cf7f623e89965a33b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed9bd3e6c320581052a41f640fbbb75af3b0cec231e5e320a65823c47d88b9ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62f3cfd91e4e6da7d805c2ab1c4eff9072abfec461901af6fb580a5ddca62292
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba8a4cee5f4b9f4d85c03ec9a124d00d30c9999f4762e4756c130170a549a751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fbe12fce8fdbbe3e588dccd6eb085ac1495edabfa3c29f2c35a1a93df7b9eda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9811e3b7406ec809ea25244b29028369b2e10c30f0b2735dbb5adee4288e6a28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e710c64120be3dc6e2271052566a8d41f561a052c8fbde7627d26ba8ac0ba3ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b5e527d155e223ec82f2920f4f176133139631a35faef82106c566228ca44e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40382bf8228b02e1bef43b0570f94f6107921e4a291646192e62307f962717b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c9ac2298c8e4fe2c2e236752900a16910fd70884623f8317e4c61bd87cd6b4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2f4762dd32afc05a967bf1e7ee492243399b1ba6a40e30234be3fe03dd0352b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eaa1baf82a9d406bed9d6a5fe597c0924289d1a170acaba2c531bbce38ba73cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfe3b26b784de72efcf6779171bc065dba71a4e07e01ac1e26014e27bf9a932a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86a638710ff76789e29918028f72fc7ac54acc4a4f84b96cd0a39a3362d1d785
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d8dbf3856231f00158080036272e343683110fdb63df709b5a0335105f24bf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d74804855dfe4109b6b60c9668d87df57ca780f66191bfca95db49a4ed275346
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1a674527fd8b9841b724c2335d9a6f82c8f88ddd3a7a8e5ed5c2850534d9f02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e0b562a6be2154a0ef3d7f4608737161f768836610ab99a77b497fd09040b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf199e7bbe28b68525cc1a70bd9b49d3ed728821521485311f4ce6df243fcfb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c13c4f40cfe2195cde9943d59749c04df019c346c76eeab08fd5c1ad13c77b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1eaa150228f3e24b2c47be22770f2a183437e20845d45d08696ea995253da22f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2493755725df525661392aaaf42a7e5c28ce0bb43ad73983173c72ff073201ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5772f7894a2d6a432b8d2ac94e69a12f2f92356b7e77305c127049d4ac4796a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cac0240c7d3a674ff5b0a15443669d2bd70335f3b648354bd5152396133cbc8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cef8574c182eb1962c24cc566ed6ba194bd40b6035d453631a1d104ded2ff53f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff7cd6cd8ab3f936e6692ceff24050493775570f2ef92da4ecb95b09ee7679b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb22c1f37444d0b39348d90da53a1eb1d4d6342ebe5dd88854f433e528326dab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bc4783a9d287d564a81508b3b1c7a2a1b5d2fa6053f22495c1c509008081e29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 394d4f52a43011faa68d52b94728a1ddb4616d87b06ec81f25aa59b39a53f485
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f4d9cc88c5b7785988f0c9e1495a2cb2ed756292068a2747e9840dfb47aeabc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f4c732ebffbee2f178f8c0d4961486b27a69d2e17ef4455a4eaa469c5466897
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbdb9bc9abd212f1db65d20200d4fb5741896ab234552ea843f6c2f479ec7817
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60bc4b6e0a928ad0a1cbdbf2601a17ed97af7c431fece7a3a48fbc1a1155778a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c79a2988ccdfb2892b818eb8c1942da87de100faa867987fe5eae549dc8d4c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9ad04d5d5c2080fe8da4525d766b9e22295b5115385133cea1d6522c46e3061
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 886bc920d91372f828f513e215583db6752ff20f22f66d9bdd183e13af522c52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984fc13595177f68066f25fc23047228a6837a623189d780d7741d1ee2fc6fac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0195eb607bcbc2084793aadb2c49625703b37da8cc3576b1f8bb43cb9737b224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8406d57ac9be722c06b0654f5cf949c88f72a49448f2604dae04736db15e009
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5eba1148bec8dbc861ba4a81d2f801d1008904642c463a3bf6333bea06306cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b72c9dc42d8c45d828f854ee7d4c3f2444726235bf07d777d41b75b63871c6ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42318f437fdd7657bb42ee38590486cbf0968443935e1a382dd1edc181bdc671
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fdadc3734e647382f1f90a5a43c0737de2eac5a7f02c1e364969631e8a2b231
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              secst.exe

              • Path C:\Windows\install\secst.exe
              • Size 1.2MB
              • SHA256 a03030240bdd94d5e0716bb3c22fdcc8a915c870d644d214d69a62073fa3bdd3
              • MD5 SHA1 SHA512 SSDEEP

              memory/1940-21-0x0000000000B90000-0x0000000000B91000-memory.dmp

              memory/1940-20-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

              memory/1940-688-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/1940-1407-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/4052-6-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4052-1373-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4052-9-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4052-8-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4052-3-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4052-13-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4900-0-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/4900-7-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/5260-1371-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/5260-1408-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/5260-2097-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/5260-703-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6628-1393-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6628-1403-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6760-1402-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/6760-1406-0x0000000000400000-0x00000000004AD000-memory.dmp