Malware Analysis Report

2024-09-22 11:13

Sample ID 240624-ljjqvsvhqc
Target 07bad6782ef51f9e799dcee4128b6311_JaffaCakes118
SHA256 f47a4176e8a757edd281ed49ad5717adf4b60f2d60a9cfbfa9e77812993d2f36
Tags
persistence upx cybergate remote stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f47a4176e8a757edd281ed49ad5717adf4b60f2d60a9cfbfa9e77812993d2f36

Threat Level: Known bad

The file 07bad6782ef51f9e799dcee4128b6311_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx cybergate remote stealer trojan

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Program crash

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-24 09:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-24 09:33

Reported

2024-06-24 09:36

Platform

win7-20240611-en

Max time kernel

147s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536} C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
N/A N/A C:\Windows\SysWOW64\install\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 2044 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 2044 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 2044 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\file1.exe

file1.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\install\svchost.exe

"C:\Windows\system32\install\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2044-0-0x000007FEF550E000-0x000007FEF550F000-memory.dmp

memory/2044-1-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

memory/2044-2-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\file1.exe

MD5 533edd3b6d4846cb2302e50c46aed78a
SHA1 8b3af4f684e015abaaa261e48b4a946875d32841
SHA256 d414cc83be8f7917f482fe719c96c8ad5361c1e666bf930798e53c84ca8038fc
SHA512 0c07441a5a3ded4556365e905e081e8b78d9a5fa0981bb7775aa99d62d81278e2c37c1d65d5ba9ba8355a63ee000d2f96fe1991b741193f272eca0d783c49fdb

memory/2044-9-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

memory/1224-14-0x0000000002540000-0x0000000002541000-memory.dmp

memory/2868-13-0x0000000010410000-0x0000000010471000-memory.dmp

memory/1092-258-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/1092-323-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1092-556-0x0000000010480000-0x00000000104E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 bd82483ff9ff0676f7f64b483a8a116b
SHA1 b13fc1833995c775795d12094b7d1cf29000b90a
SHA256 84415816c5ba9dbd77b5aa2bf78887e94193a59d50e47a9d0eef94cb88e381cf
SHA512 f05df78a937ebb822a3b54c9d2d543f096254c98e0620afee2e7bc819d3aaa7d6c07fbd74d13220e0f7d8116ade99f0a057c23679145da0104fcea1f0e52ba88

C:\Users\Admin\AppData\Roaming\cglogs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2044-901-0x000007FEF5250000-0x000007FEF5BED000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3f03f43414aeb52e01fa37cb3b4ac407
SHA1 a1d92ef26c07b2a640953e0aca5b16c41e39d513
SHA256 b9273a601fadd23fde3e01ce7f86f3e5e1709ff07d540ca757e925ce97f26e29
SHA512 1323bb738839d648b3ed01e3bb7b4d40211b76bc5396db3ec4ee43d813aa0b397699983343b2703ebbf09ec1f506cf3170c75baebcc26e64bf76b70d84a2d78d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 fb2400b54875d88d10fe9a7d5aeb5e52
SHA1 3f39aa9401f69d92308b80d1a2dcfb0be9a3680d
SHA256 f2b3479dda55f18631cc2874c148430b3888f9346e512cf9237bb279350fac1b
SHA512 5388a7f1232d73dd787728dd6f44b0a22d64cd44a19613da036f910a8505726264b277dc0819ac74d37caf516d9dee8b5fc872d74c3cfdcd2270504bdfc8b9c1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 420b88fc982d0f9a3a39cb7000f85a92
SHA1 54557e09164ceebe9410e7a07bc9274f184f01b3
SHA256 868590b83599b42f7d5831cde566afa4c3e757c68786ec6705e821ed97fe7135
SHA512 1fd991aa437e778ea5f3fd1ed810412fadd7d37dfdd4afd798b9fe8760bc2d64e84ddeb0fecff5ca1119bed191222c16d55693b6aca8f92c925aa680db6543ae

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3d149a2196437431a4c4ddc30cbeeb9c
SHA1 927e7e4df9748c5a63f14d9531e298768c34c717
SHA256 bcd9a92b58b64281eebc6780702c675ebf74a0323d569d35787b0cc3e9619bbd
SHA512 92e058a2560b4ace953cdddeb5608edaa33c31e527217c915b7bcab4266f2041b0d78e2ef123b27f363d453dbe4487530b64810b1029819cec52301c2050f8fa

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 70bedb282616e51db466635e0987b236
SHA1 ff93291b994db211692293a484077b7d691b311c
SHA256 c64ce0aeebb26fb573ea1fad113a27c08a3a498f1ea53151fc9923d54d6b45fa
SHA512 c26542c595265bde699e6980cf04ebd4bf5b7f2526a4f5c35ca77e71b30caf42e4505f4bbb8d84031160a862cb12a8a01f47843e7860c8bb85cbefe9522c808b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a92ab438899c155a5d8567d43319170a
SHA1 4f8416f31d64eb3cebbe1b0bff90026e0c69b91a
SHA256 3df2810e683f4800f9088f98a66435ada8b9f0023a91f818202bbff3237bde62
SHA512 0512a49193e3e706b376df5701982bfcf771dd311d2325461b13aa757455119bd77ea05091f628c29a80becd4b95db7f280c6c74897d0c4764fe708e380424dd

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 6a05b483c9cb87498d36a2e836aaa213
SHA1 a3470c6a65ed232363dc9d8c794f7b527e848c49
SHA256 29b0ab10a0511b91282f00962633cc221916bdc9caf4b5412cd83af20eba21aa
SHA512 7fb26df6bf3e1198fb185817123855db4f6799e9ec35d3e48e2456af6bc99de88f495445771b95fd401d06fd18075ee68923796388a7f783a2d9280892aca873

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 22ba5459106f738933b4c8f982db251e
SHA1 31b0801609f7d028581d987b0d729cbd190872f3
SHA256 3dcadb8d5877c7f3229e88ab6cce64233ba1a4cd2e801affa39df15546391b18
SHA512 50ad953281b293f40f177bf8bcf5feec9f3b64847193aa582238750a1b216049dcee269666478ebf34a861d0a425034ea75d898201dd6f11526af7cf6dee9cbb

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2492de4fc6b5b94fa4ea112121406f66
SHA1 751b745a564d2c965d66abf74f5b6fd3384766cf
SHA256 ba0248ad317fb74066b526912ec99fd098e128284936e00143f8e1d4932fea73
SHA512 3ee062dd2d661a280fb8b192ca6a00a0bdf454e37bd3d38188698f1b287a6dcd028b9d6fcf91eb1ff592b1ddd8aee7210ef5c0e5d1730592cd3172f331dd52a0

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2f9a73592daf84122fdf8201baaf9950
SHA1 16237c26aecbf56b1f52dc916c5a594680b675ee
SHA256 22827f7d1ca7bea08823cea3e8900849772be444d8a9beca929c3ad23d0b055f
SHA512 5ffd8b15f309ada1dd063ee73dbfb4b9482918ad732e5f0a8001cdb02af360e3407645af5e79c4c99fd0d2b8f1abc016f52321b0392d486a42baa71ed4e37c9a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a781fd15d5a2352bf514593154418f86
SHA1 08cc0e197106e2c93cd715cf180c875b9e2afb68
SHA256 cb5953e581c8e119d3083684e680e65f7cadc2e94b225ab08aa572ee193a5c50
SHA512 4b98329c0531c4199884d32ad77d7066bc2735355debd25473db55cae03c0de525fdc8de4e99d8e06df59da5acc5e1d0d025a4514b0dccb752df1e2b491f47f9

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f2e9bc6caa589b3f6d29d6b9ff45b8b5
SHA1 4857bc7445d4bd05ffbcfb0d90077b6f8edad821
SHA256 d1c104f0db369ec137d8082417516bfd3218be649eb9fde3498aaf8ed0aed5e0
SHA512 d707d76eba8edc0624fed684b34f115ccfb3dadde242ebf11348f4fddc68cd4486d140149a9e236447690166d173f0298b12f26433dba80cf95fde59843a526c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2f1fc2955f3c2f4bf5f7dadd4a8c6e0b
SHA1 197ca5203d491b6680c4aa71e91033c6aa18df93
SHA256 d404eb6237a5067909fe2b2e7525ffefe34b958d053f96a817d5c7ec079af2b9
SHA512 61510278ebacdf4809123da5fe44bc47022457e545210158c0b271174d9280099702036a108152c818bbc00e62c7dd1187fca1e00696b6793193d4a5dcd049e8

memory/1092-1730-0x0000000010480000-0x00000000104E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 21291f1d135818d41aa2e3698810c20a
SHA1 c37e9a860cff79478825589d818ecf940e0d4783
SHA256 562797b762f04aee7f0e64fa4421d44dd3498cf6f751dc1559a7bc48cabd920f
SHA512 15e64b5000474387762935087078544dfeae51bc7c59b6e8596e4809d6131fc0e4f841633e2e8406f0cafb49adb0797610369ca625a4f57ccfcaecbb9e7698c2

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 34747694e551caf3e1b22e264bc22768
SHA1 dc8271e8b92cae803e29c6e1e1c7e8a5806f4953
SHA256 c7df5afd3e60443b90460e5b0ab5a7a6210afd8b1e2f791ec1f5ac51c10b15f9
SHA512 1365aeba029b710c44cf24da784b85dc060e5113e8382d1b442ed1d864d32ed6396835ea4253245bea597b299a4f150d48697d07cfb47d05eaf49ce946282dd6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 35a7f5cc290b14e327eceea333d30f7b
SHA1 5510028ec766de4c6f9cc90742dd8eca0cf6e7a2
SHA256 8cb9e20e65078770d493e8097bcc5c11be10c5dba1b8a61631b61f7bf87789a9
SHA512 b3a63a39caeed89dea66f829d07f6b8e72d17b9a76d0abaca20d1c4ae33a299420c779439e23f7e8a9a1df370513b77405c8d40f92d9304321ebf9829b3b579a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 793aa15c969d2b851b81e92586c22bd7
SHA1 71a5dfeec619b0245c6f8014829842bafcefaaa0
SHA256 0e2d3836d2e95e6e663088f67933672e8b75475040b0e0e3c21f14a026bdb3c6
SHA512 8afeca8505e91e11f678b57585d818bbee02ad0f9e521c226386a2169f355714b41a8dc90572d99c0f93f2cc89414cdc3a0dc2f67e406718983b3e032f696592

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-24 09:33

Reported

2024-06-24 09:36

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536} C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{R7TM0AG6-2640-4F7O-A7FA-4GS617800536}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
N/A N/A C:\Windows\SysWOW64\install\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
File opened for modification C:\Windows\SysWOW64\install\svchost.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Windows\SysWOW64\explorer.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\install\svchost.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 6044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 6044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 6044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\file1.exe
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE
PID 2896 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\file1.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\07bad6782ef51f9e799dcee4128b6311_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\file1.exe

file1.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\install\svchost.exe

"C:\Windows\system32\install\svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4552 -ip 4552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 572

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

memory/6044-0-0x00007FFA722F5000-0x00007FFA722F6000-memory.dmp

memory/6044-1-0x000000001B100000-0x000000001B1A6000-memory.dmp

memory/6044-2-0x00007FFA72040000-0x00007FFA729E1000-memory.dmp

memory/6044-3-0x000000001B690000-0x000000001BB5E000-memory.dmp

memory/6044-4-0x000000001BCC0000-0x000000001BD5C000-memory.dmp

memory/6044-5-0x000000001B1B0000-0x000000001B1B8000-memory.dmp

memory/6044-6-0x000000001BE20000-0x000000001BE6C000-memory.dmp

memory/6044-7-0x00007FFA72040000-0x00007FFA729E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\file1.exe

MD5 533edd3b6d4846cb2302e50c46aed78a
SHA1 8b3af4f684e015abaaa261e48b4a946875d32841
SHA256 d414cc83be8f7917f482fe719c96c8ad5361c1e666bf930798e53c84ca8038fc
SHA512 0c07441a5a3ded4556365e905e081e8b78d9a5fa0981bb7775aa99d62d81278e2c37c1d65d5ba9ba8355a63ee000d2f96fe1991b741193f272eca0d783c49fdb

memory/2896-15-0x0000000010410000-0x0000000010471000-memory.dmp

memory/2896-18-0x0000000010480000-0x00000000104E1000-memory.dmp

memory/452-20-0x0000000000E10000-0x0000000000E11000-memory.dmp

memory/452-19-0x0000000000B50000-0x0000000000B51000-memory.dmp

memory/2896-75-0x0000000010480000-0x00000000104E1000-memory.dmp

memory/452-78-0x0000000003900000-0x0000000003901000-memory.dmp

memory/452-80-0x0000000010480000-0x00000000104E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 bd82483ff9ff0676f7f64b483a8a116b
SHA1 b13fc1833995c775795d12094b7d1cf29000b90a
SHA256 84415816c5ba9dbd77b5aa2bf78887e94193a59d50e47a9d0eef94cb88e381cf
SHA512 f05df78a937ebb822a3b54c9d2d543f096254c98e0620afee2e7bc819d3aaa7d6c07fbd74d13220e0f7d8116ade99f0a057c23679145da0104fcea1f0e52ba88

memory/6044-146-0x0000000000B30000-0x0000000000B40000-memory.dmp

C:\Users\Admin\AppData\Roaming\cglogs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/6044-165-0x00007FFA72040000-0x00007FFA729E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 420b88fc982d0f9a3a39cb7000f85a92
SHA1 54557e09164ceebe9410e7a07bc9274f184f01b3
SHA256 868590b83599b42f7d5831cde566afa4c3e757c68786ec6705e821ed97fe7135
SHA512 1fd991aa437e778ea5f3fd1ed810412fadd7d37dfdd4afd798b9fe8760bc2d64e84ddeb0fecff5ca1119bed191222c16d55693b6aca8f92c925aa680db6543ae

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3d149a2196437431a4c4ddc30cbeeb9c
SHA1 927e7e4df9748c5a63f14d9531e298768c34c717
SHA256 bcd9a92b58b64281eebc6780702c675ebf74a0323d569d35787b0cc3e9619bbd
SHA512 92e058a2560b4ace953cdddeb5608edaa33c31e527217c915b7bcab4266f2041b0d78e2ef123b27f363d453dbe4487530b64810b1029819cec52301c2050f8fa

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 70bedb282616e51db466635e0987b236
SHA1 ff93291b994db211692293a484077b7d691b311c
SHA256 c64ce0aeebb26fb573ea1fad113a27c08a3a498f1ea53151fc9923d54d6b45fa
SHA512 c26542c595265bde699e6980cf04ebd4bf5b7f2526a4f5c35ca77e71b30caf42e4505f4bbb8d84031160a862cb12a8a01f47843e7860c8bb85cbefe9522c808b

memory/452-392-0x0000000010480000-0x00000000104E1000-memory.dmp