cybergate | 51d860373b830d0027a736e58e738b339561f2869ea539c17e9e62a3f5fddaee

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8262ca3e69de66bb37dc00f054d37dfc.exe
Size 1.4MB
Sample240130-n7fp8afdf2
SHA256 51d860373b830d0027a736e58e738b339561f2869ea539c17e9e62a3f5fddaee
MD5 8262ca3e69de66bb37dc00f054d37dfc
SHA1 c4e94d3ea29ceb6783ef9f55ad45a34d7f21b172
SHA512 0dc82298679bc300eed9331dee9daea1f56f1318b8b8daa68db20c08a7af8c9987e1597e715b9bd88bec7090f498c02089bfcb3d9155e10b48b83f3274d4c08c
SSDEEP 24576:DtARjIeeDaTda+aqDjb3UnurwCYFf9lVUcyTQ+NRbH5PnUL9hxDj4GKR/:DtAR8R+Tda+jLUnEP29lKcQjrLhUJhxu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

mlbhouse.no-ip.org:999

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
motorola
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8262ca3e69de66bb37dc00f054d37dfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	8262ca3e69de66bb37dc00f054d37dfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8262ca3e69de66bb37dc00f054d37dfc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	8262ca3e69de66bb37dc00f054d37dfc.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I747A1T4-C05K-S3D8-OVNV-2PEW6A0105P8}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I747A1T4-C05K-S3D8-OVNV-2PEW6A0105P8}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I747A1T4-C05K-S3D8-OVNV-2PEW6A0105P8}	8262ca3e69de66bb37dc00f054d37dfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I747A1T4-C05K-S3D8-OVNV-2PEW6A0105P8}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	8262ca3e69de66bb37dc00f054d37dfc.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	8262ca3e69de66bb37dc00f054d37dfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	8262ca3e69de66bb37dc00f054d37dfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 4 IoCs

pid	Process
1256	Elite Utilitario 2.0.exe
2776	server.exe
116	server.exe
4336	Elite Utilitario 2.0.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4476-0-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/32-9-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/32-12-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/32-17-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/32-18-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/32-26-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4476-44-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/32-55-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4476-54-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/4032-99-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/files/0x000600000002315b-101.dat	upx
behavioral2/memory/4700-109-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/32-171-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4700-172-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4032-191-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/116-198-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2776-201-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/116-204-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4700-1001-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	8262ca3e69de66bb37dc00f054d37dfc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	8262ca3e69de66bb37dc00f054d37dfc.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4476-44-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe
behavioral2/memory/4476-54-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe
behavioral2/memory/2776-201-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	8262ca3e69de66bb37dc00f054d37dfc.exe
File opened for modification	C:\Windows\SysWOW64\install\	8262ca3e69de66bb37dc00f054d37dfc.exe
File created	C:\Windows\SysWOW64\install\server.exe	8262ca3e69de66bb37dc00f054d37dfc.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	8262ca3e69de66bb37dc00f054d37dfc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 2776 set thread context of 116	2776	server.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	116	WerFault.exe	93

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8262ca3e69de66bb37dc00f054d37dfc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
32	8262ca3e69de66bb37dc00f054d37dfc.exe
32	8262ca3e69de66bb37dc00f054d37dfc.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe
1256	Elite Utilitario 2.0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4700	8262ca3e69de66bb37dc00f054d37dfc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	8262ca3e69de66bb37dc00f054d37dfc.exe
Token: SeDebugPrivilege	4700	8262ca3e69de66bb37dc00f054d37dfc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
32	8262ca3e69de66bb37dc00f054d37dfc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	Elite Utilitario 2.0.exe
4336	Elite Utilitario 2.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 4476 wrote to memory of 32	4476	8262ca3e69de66bb37dc00f054d37dfc.exe	84
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43
PID 32 wrote to memory of 3464	32	8262ca3e69de66bb37dc00f054d37dfc.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe
  "C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe
    "C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:32
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:4032
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe
      "C:\Users\Admin\AppData\Local\Temp\8262ca3e69de66bb37dc00f054d37dfc.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4700
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2776
      - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\SysWOW64\install\server.exe"
        6⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 564
        7⤵
        Program crash
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 116 -ip 116
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Elite Utilitario 2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe
Size 1.5MB
SHA256 8451fdb22659f2d56549ee6f9a293c2f40d19727e4e18b157c557ccfcfcc0bbb
MD5 bd0e4bb5d963c1b52337f4b9d1093381
SHA1 c8e2eacdbeac46f802053dbc5aa8d1558cb3bd0a
SHA512 07e4dffa1a2368487c0ae5a56ce8c8b9fdca0a81a93f850930e66b36e430176e8c9bc9c805535715e76c4a243a90ce8b88b7583aae5c0502e012279addbf2cdd
SSDEEP 24576:/8dvAXeBJchW/AY6aS6emG4FhZz0eoZ3j/MHMQuiETWtkwqw:0dviCzZOZzIaiETa9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elite Utilitario 2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe
Size 640KB
SHA256 343b1408121f66e8c756b4e3b26320a819bbe8f6ba89d342231650c2db1e3670
MD5 209aaa5af33a85eb53c6fe91fea47b7f
SHA1 7425bffa54597e971d1bb3aa470a1416e169bb67
SHA512 bdd21abe2251310beb7d46678975d7f5dcb238703a3d0565e825efef2873bfac2561a5c08ad897052eb0369795b6f9f984a607352be4c27126f704b5b38f6fb7
SSDEEP 12288:/PUd3/AOGe5RBJcCiW/AWUyvu86kRbf+vzu2qGTX2vQz4FhV1G6vV7G:/8dvAXeBJchW/AY6aS6emG4FhZq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elite Utilitario 2.0.exe

Path C:\Users\Admin\AppData\Local\Temp\Elite Utilitario 2.0.exe
Size 128KB
SHA256 3a88d7c6ddb176bdfc7deb2ba4aafeb3c0278db47396680d9e16269d3cf19c7c
MD5 abb486b6d7e656c659b87e41ffebf80c
SHA1 8de315dc7f9d20361688fa3e4ceb5292622c4cb1
SHA512 1e95e63fcf8862fbfe40c7ea73cef397f95e4282b1024aba5695161efb84192dbcc04e481f6a0a195d67d9677f239f75f2610f5f82424ae4e067c1b8c23e84c4
SSDEEP 3072:SxFC0Dae9dtt/TsLwDEgkBPXt9Y4+OsFRarWOM/k9mx44wAbHX0:/0We9d3/AOGBk5RBZX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 229KB
SHA256 96c3589d5755759eefdc4ff8914164f821924802fae0a5b154bae7f2bec3d0fb
MD5 cb3acc0de0a4b46869d23791750acc08
SHA1 fa5d5a3923fb1e7269fa97a35f21659531e73f46
SHA512 e983a2bfacb9ad80b0ad18da8d3bcd1caf3022817ffea0cad29a397168ad7c59747b1e70e51ecac82e0a587202b095b11626c57549fb2e70c4a92f770d475517
SSDEEP 3072:oZP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiCT:O5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 3a0a3175a481d57099b0e905bbfa99340de2b54ac6c35ac48423e52026116305
MD5 bc059f54bed6b0297f90f744b01ab81e
SHA1 3cf39c41280c451f4bf353763c780a68f0a65bce
SHA512 303836045b5e1f1f7d316ba96febc85628ac51b9d8103cf4a50518225b489d77a4767180d9a6d9cedb402e2fa1934d01811b1d5f37e1b099a305775a4d9ccead
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 563dfeac8eaa2c8b91abb4b657e00e158d490edb5917cdbcdd5dba5a3033a177
MD5 4456be4146a652d4633e42ac7af5ac87
SHA1 97e7901056540a15115406d3787e65d67227c676
SHA512 5179f604bacecb3e4e35c13dd4b633ee37ec3bca19936400cdd6b73ca04bc7a50f2eedf73fad8154bf2442b36c2581c27e448c0072d1b052871d4ea864e05584
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e4e4a4ba985dc2a19bea81f939cb57df156fcece4ca1fc332b1ca11150dd3243
MD5 e029d5c12692dda59ced3973ce796f3c
SHA1 0374c8bfad643e97fd1a5ea54e2e3d0acfd57106
SHA512 d7e53cde0fb0e3fde6bdb5e88cb8c902720e98da62a95372db5e30be0c385a489ff10aa759130a5f5de99c4edadf3b6a616509b1f422280f49de85cb69170a8f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a7699f0e8f865805e11e45ac4ba6f86bce86de55d0ac8c99c5f6c30be6b095d6
MD5 3c53e192c15053d49289c750a56a97ab
SHA1 38949c746fddbc9cf7a6136be6fd933344f690f0
SHA512 7c3f09e6127f56efc33b78eefbf5f9c548e0bf51ddc9a6b0dc62524d18d1cd3cb5af56f9b06f6710fdedb03d00ac990b86e652f7695c5404c9267c605e3895f6
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6ae7372c391d2272b1f65108cbf6fa3fe890c0598c84b1d3f9e11f6d81f85a13
MD5 3671c707958ab13672372ab2bf06342b
SHA1 24db14d817e6a610f9dbdc515e3ad517dc0ffbfe
SHA512 1f806812badb0fe79b79c925e0b049c992191f9eff5a23282ad00a534c52a82bff84d333560f57381fa50d95194e79fffc6c3221d23d32c6f9bcf19ba51ba40a
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a7163186a7bfeb3d7d6176e0f9dbace3afe4d8f7d55945253ee0b23aebc5ab0d
MD5 72b31cd69fb7dc300f45bb8f7e6b5e24
SHA1 6b97b5224872391a1a0832c6e5cc132fe3fe375f
SHA512 eabf32d0b35826fa99ab798764677995ac5713d4b1f3aabf8af47f57220c4a4a6e2fe0d2a0868a4a4799c2c11e5ff4dab8f80ff25203716c13c086e05f016dfc
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 56368d5c6ab20715ab166b18425573ebb50949539116b408cd3fcf04590e92bd
MD5 e3fffd5d6440f1b77811fe6e67740abc
SHA1 a7ae4bf2558f8401bb89fd524ec31899d44fa0d8
SHA512 93f09e9c211348f22cb24ea674484d61d928947ce5ed27cd38d8778604fa111485293339364e26ef066fe085b6eb88de188f76e0db23e58adb3a643e1c7cb935
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ec079ac3502d5c99cc27ddebdf36ae9f7bc5f12c86c2cbfeb33a8b68b20107e2
MD5 bb9e24c37fcc63f43454639881b29cdc
SHA1 60470c899f7de1b692ab115872e3a6e0d4587772
SHA512 6bb21461e8eb61eda184718289093edf2d4314bd2f646d0fe3c81cbaf254b485fe75df8c79cb215566f1f383cb13d3596cc06b4fd35b94bdc6d273fd151e6799
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 b59bbc1ff70c1a5a94afe77a73e6382a685a9cc43726e1fc4ea1158322bef93c
MD5 77a6146465f65674d09aa801cb565bc4
SHA1 5245717b2ab7f53ed52fcfd021e356f32fddcfaf
SHA512 2c7c1d654c664d5f1168e0bff26f2a7ae7c87a948a1ea9b43c61e8784ce2c1b90ba00828c39c1db1114d0fc714b1be552589643150c23635bdd7a585b2a49d0c
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 07d8e8e7bab64d50dd6880307033ffdb66b501e0f51fcab78ecd9554e71816c7
MD5 50e84f34082ed56ca025e02a99f12fc4
SHA1 2fe5728ee9ae5013c6be43276e8fba36e424ec70
SHA512 3cea2339d3afabf353707d2bac8ccd99bae2d6ee159901639dca16b58b795d175ae82441dd10424714ba3559b8fbc90b86614561eb640e543354e41a732f98a4
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2faeb0f8a23080b046a4cf4c6bd4c7ed85c0594c7a308d9a9abe0e654617c806
MD5 504a02ee606689a7557d5b131dbf7239
SHA1 64e25066d90c5b2bf06a6abe9c9171307abfa299
SHA512 79146abbfb73ad19cca24f5c7c5228aab4a6a58eb88564e97248045a398ca9590864838b2857d9752f1d608c51f8fbf827e7752ada733a1cd308bd8af379ba60
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6ef9534cf38395e93a431f3747438f4cee0f5361f334766dfde3fb42922dc682
MD5 891ef76ccec66d409126a3797f75aef4
SHA1 5a6d8aeeed6fc6534254221d9d4f051b1c8cbfb6
SHA512 73e8a3f466071571935f7453de3691d927c2ab5c44c42575e81179271f3553de92288b1592b416125890e27861b6c3c8e15608a2eb49e55626c93fb05629d238
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 ba7b5a763f30ae30460afa594befa7e8a8a6b4a75eaa5198ed6d6d5d6423fd7e
MD5 4997f17d820e86dea0d3d5bdd8c979fc
SHA1 e7bb692cef6176174cc92653074b910a8e361bf1
SHA512 be523e63f1aca39ab80f0e12e6f90142fc6962a68fdec94c67a96159c10455ef72500330f6b94899dc5d768c60e5415e100c2f71562df54194a723630e925546
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 389f22a77aac1490a4312ef5e0695917b812991f0942a6994d32a13ad500c57a
MD5 49e6e347ced339cd2b0f41239a8f1122
SHA1 26e90990f9af9e20ea592e4f5e8b7b50adebd4b4
SHA512 1951ff35176338e6663681fd810ebe0fa490e898c4238b2222bfb63e26389d01f1025d966b02682a12af2b2cbb12aa799deedf9d6b000db13bbfc1353831c139
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a8adb68df966d96f64ee915bb5334112138406bdf94ec7a2bd410a04361bd554
MD5 d152ff720c60e3bff2a8ee570db3b25e
SHA1 c818be57098d36a8645d6fcd7835d276267b5dc9
SHA512 53015c8b3278a04e57bfca0d1ab3880a2d0ff956e02f76eba8f2c7928ee5710ce12933d4e8a3a25e83aa8727dbd25b1c15c113ad98acb1824ce1830295045b7a
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e6f439ac21883462d578b5b8d7185feede2531c118bb5d55b4b30ce7a321e9b8
MD5 4881e0453b42b5c8f422b04a1f890336
SHA1 cd904f6e66035387db24ef7f1f417d9a01dc054e
SHA512 b80ccf484d0402c22957154c8240b51fe833966e4bb1904b93d7a3016802499316b54e5f82d39ee60844b374bfac8a9916904083c14a2bbfc7e1caee5b0a6d69
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 fc6f695142e2fe66e19ae404a0f7abe67769ed6418719210dd6313ad6999c494
MD5 925bf1a3ad712a448ef741e90ddf3958
SHA1 56234ccd406fb7a1fa9524d829c84dbba7218c94
SHA512 97e2f875d114994206ad1c231e875863727a77df553603c7c4a9f00d46a2116822c89ecfd7281cb69bc2cd29e5abc1e85f1b10dc76a92fbf0a7428a5926135a3
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8c4ae85de99312b82d85c85840df4e4d6f2a78b11d4342e57dd117106902ba22
MD5 60168e3f21a3213f7ead0b83b90b5a30
SHA1 be92103c99b1dbaf0b8f82e470df4c47a71fa2f9
SHA512 0f36f26fe918b5a9b8954e29af3275d18ad002349c45ac270e3fae4b03dd677fd13400a306deb72089b034157300d03ac1024b704243faeb6644b4942e119492
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e1c9f86080643ce36a1291099cba5ca6783c8286b9a005697097ab46fe1b72c0
MD5 63fa47e0e6a314f912e16274ba0f6307
SHA1 25606dd133ada3881fdaf96acf78778e1aa22c04
SHA512 e78ce931550c75104e06748291a6288cf80de48cbea2eb36f13b1fb088f88695e36666ea485adb1a9cf9e7217708c0f6f613916e885b2a889b9709df4818df2f
MD5 SHA1 SHA512

Submit Download

aut15D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut15D5.tmp
Size 276KB
SHA256 7c8e5851fade0dea62dad89087886a4d9a0f7e9c3ce6a04e49a32253d5687e6d
MD5 c3cf50857ecc0a2d89c0f7524112dc58
SHA1 a6dbd576b539dd4df17318f72cfeda838e28becc
SHA512 2dc09308f7ad38043f6eca94f6c0f914bb05f0dbb8f87ab41c4d02f98402728aaf41b27c2f50f9b9271c028ffb6f16572654e22c9e4723b7950730b463c333fa
SSDEEP 6144:I+6sL7HmItxl5eBYMUbYfNY6OoXft5z8ibL09aoy:ImfGItxl+YVbYfNJOonR09ad
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\SysWOW64\install\server.exe
Size 1.4MB
SHA256 51d860373b830d0027a736e58e738b339561f2869ea539c17e9e62a3f5fddaee
MD5 8262ca3e69de66bb37dc00f054d37dfc
SHA1 c4e94d3ea29ceb6783ef9f55ad45a34d7f21b172
SHA512 0dc82298679bc300eed9331dee9daea1f56f1318b8b8daa68db20c08a7af8c9987e1597e715b9bd88bec7090f498c02089bfcb3d9155e10b48b83f3274d4c08c
SSDEEP 24576:DtARjIeeDaTda+aqDjb3UnurwCYFf9lVUcyTQ+NRbH5PnUL9hxDj4GKR/:DtAR8R+Tda+jLUnEP29lKcQjrLhUJhxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/32-171-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-9-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-55-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-12-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-17-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-18-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/32-26-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/116-198-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/116-204-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/1256-170-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/1256-59-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/2776-201-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4032-191-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4032-30-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download

memory/4032-31-0x0000000001220000-0x0000000001221000-memory.dmp

Download

memory/4032-99-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4336-202-0x0000000002100000-0x0000000002101000-memory.dmp

Download

memory/4336-1922-0x0000000002100000-0x0000000002101000-memory.dmp

Download

memory/4476-0-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4476-44-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4476-54-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4700-1001-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/4700-172-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/4700-109-0x0000000000400000-0x00000000004AE000-memory.dmp

Download