cybergate | 7b7ebcaee4ccdd40dcd63aaba90c337de85d65a19a8db44a6fbef8620327345f

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
Size

341KB
MD5

c529feb6ee32ab7437fdae205e318cfc
SHA1

11d0d160c7f6e62554f2d6fd59b5fff301379a8f
SHA256

7b7ebcaee4ccdd40dcd63aaba90c337de85d65a19a8db44a6fbef8620327345f
SHA512

caec3b0cdbd0ef38b8be502cbcd3bcad53b6f7fa685a537b289cd2baf2bad6bcc45ed80a1d2412e93612e89f1b6be4a081860ba1fc36830126caef5d289161d3
SSDEEP

6144:yzbFac5lLo1xvAEO8l1hKZY6o4RDtWEWHuY8AYCpQOkve0NR8t0goS:yzbFaa4xvAEO8l2o4RZjWHu9CbaPgoS

Score

10^/10

cybergate dylan discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Dylan

dylanlumps.no-ip.org:8567

127.0.0.1:8567

Mutex

mutex

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	atidisp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	atidisp32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	atidisp32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe"	atidisp32.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{LVB61BF3-M1AN-171S-46E2-CI0S2KPX0WL4}	atidisp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{LVB61BF3-M1AN-171S-46E2-CI0S2KPX0WL4}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart"	atidisp32.exe

Executes dropped EXE 5 IoCs

pid	Process
2228	atidisp32.exe
2820	atidisp32.exe
2936	atidisp32.exe
2692	server.exe
2236	server.exe

Loads dropped DLL 7 IoCs

pid	Process
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2936	atidisp32.exe
2936	atidisp32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\ATI Display Driver = "C:\\Users\\Admin\\AppData\\Roaming\\atidisp32\\atidisp32.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 2820	2228	atidisp32.exe	34
PID 2692 set thread context of 2236	2692	server.exe	38

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2496-2-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/files/0x0008000000015d64-32.dat	upx
behavioral1/memory/2228-39-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/memory/2496-38-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/memory/2820-43-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2228-47-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/memory/2820-48-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2820-49-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2820-50-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2820-51-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2820-58-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/2820-55-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/2820-379-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2692-403-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/memory/2936-401-0x0000000005860000-0x00000000059BD000-memory.dmp	upx
behavioral1/memory/2236-413-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2692-412-0x0000000000400000-0x000000000055D000-memory.dmp	upx
behavioral1/memory/2236-416-0x0000000000400000-0x0000000000458000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atidisp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atidisp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atidisp32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	atidisp32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2936	atidisp32.exe
Token: SeRestorePrivilege	2936	atidisp32.exe
Token: SeDebugPrivilege	2936	atidisp32.exe
Token: SeDebugPrivilege	2936	atidisp32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
2228	atidisp32.exe
2692	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2192	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2192	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2192	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2192	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	30
PID 2192 wrote to memory of 1168	2192	cmd.exe	32
PID 2192 wrote to memory of 1168	2192	cmd.exe	32
PID 2192 wrote to memory of 1168	2192	cmd.exe	32
PID 2192 wrote to memory of 1168	2192	cmd.exe	32
PID 2496 wrote to memory of 2228	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2228	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2228	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2228	2496	c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe	33
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2228 wrote to memory of 2820	2228	atidisp32.exe	34
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35
PID 2820 wrote to memory of 2780	2820	atidisp32.exe	35

C:\Users\Admin\AppData\Local\Temp\c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c529feb6ee32ab7437fdae205e318cfc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\kLwjG.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "ATI Display Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1168
- C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe
  "C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe
    "C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe
      "C:\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2936
    - - C:\directory\CyberGate\install\server.exe
        
        "C:\directory\CyberGate\install\server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\directory\CyberGate\install\server.exe
        
        "C:\directory\CyberGate\install\server.exe"
        6⤵
        Executes dropped EXE
        
        PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
d6ea4409086bd4ec01a84a18cda5a535

SHA1
9606f93c4fcf92136f2d31dbcb167b3e36cc9a8a

SHA256
ff6535ed743552794dca4b2df6849e1e3f26e300ec3b4379c3a20334a731570f

SHA512
3471692ddf337afa9844e4b5c7462d04f97db7607a4e99a80ccafc9b46835d1e39e40b9ac4159baf7b2ff831046d89fb651627eeed8a5eeb4adf4f8984074bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f18a7d129c018d9bfca05e28068af053

SHA1
0b7bd1d45577281c4ff0608ba03066423d62ed3f

SHA256
1dd9a1ce47c1e6499a474afe9abcfa8e60461f4138fc4cf6ecd57b5cdc094013

SHA512
d7bbe18f61af4c76af453e4bd39822d11527bda68fa0fd488aafdd65d92c427bc651092b85c44eb02c10f5ea759297f6f9e98dc0634d323745041a829975430c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
c2ee01251bcbb7634148c02ddca40516

SHA1
4b721a570a3f671e1ae98d36767a5ad7fcc50135

SHA256
deb222c90736afa2295618517f7e47dbf9d2899190b34a2d795b86b38be85ce6

SHA512
3943921a94b253913909aac3e04befd373c6698ff0949a5a7792004444f8466525af10cf9cb009c4f6f32067b07dc6b7c8d9e6d160fa6d368616ad382ea99c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
055953e860a2dcb9dd264adab997aafd

SHA1
c378e4ca76834ca845b12b7cfd2057532803d918

SHA256
b409e35b91d31369933a0785d86f5ec4104ad21dce5a239523d746c661254fe5

SHA512
0b34cc498c4b8186134946e1f4a3b35e9b73797da26ba802636be0da422a8e21ef61540b902982ff9119528df1701342b1ef95a0f58aa8875cf932b55bbde178

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8f5a8c72fda8fdc129d48de6cc078e0a

SHA1
9868291739d91798758b9fef2c4d86a9a90ca034

SHA256
51370dddc0f38ff2c7f066d27d6740b119c8b690f0e5bfb0ec0e72fe30fc3ce6

SHA512
f4590d5a1ea53883e8d9555cd60ead91245a69c555496b80aaf7f0aaa3899ca1f45e5481cbfebda2da966989eb34fefbd71c8fabe9dc6e0446352790785c206b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fb869f74a335e02972ccc0134866ddba

SHA1
57556b959e957f5adb6acfa25f948005270d34eb

SHA256
0e5f56b1b9c7edce1489a4d072ff50b698f41d7137a071a933edf9751915e0e5

SHA512
a676181e3813e095fa98918c25d0e43e4543bdc0085ea9f446ab42c734200e2b36e88994cff7c1553255e95ad0b77648434672205921d2b6bd10dc95be00a450

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a615dfeac5bebc12ef2a6fad470a53ee

SHA1
56bbf65f7dcad96aa7bc3611ee4f543bf59f6dd1

SHA256
5f354d616e2ba04fad81513046606e23d19a2b5bef810a537a118e5d9f081f85

SHA512
6796084d2d81ac60efe1021db29a25e25975762652b73c0c1f8590358caec55a3569b693a6396e5d4a3d31d4a9d81623e5c9861d83ee5a080f878f8d48dbafc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
beb893c03e0092fb73ebd13cf7a24cff

SHA1
4b5b9a1601ed90161c047a2a1574a6063c4603bd

SHA256
e44bbc7f400cdb8178c42c03e94c7781c37803fed84c5af40cb31e614e287e09

SHA512
8871c3dedfa955298d411963acf9cb773773f66b96cb7191a0569f67d8aafedf32d61080d1856569f30c51234f56490cc7b103dad5499236b98ba812988de90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d3d40b21c1b0475abb6f206c286aed0f

SHA1
6e87b733754ad2d2f0753b02bdebc377dcd0630b

SHA256
00e1f84f9a6517e4d54263e1fc0f64627681d97b5d42fb46d2b07a91128795f7

SHA512
58adf6900b28fde2e5807e750750381ef8164d742803658be7b1f8cb305fa87a343ce970825bb8aa5a54a40c1b604cf8e5cc0d2f585e5eafd345893617a66f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
dc6a754f17b3dc5b82d0cb146a0e7d54

SHA1
700e4a32692390995a37a435e17c1e219723e06a

SHA256
1b2ccb37604a3959658f4f1625435e3d227b4decbd8423c6d2f98018a24a80f0

SHA512
f81c559d94aa8c166f4ac4e04343ebb1734aa6aa1604d4432cd2615dec373d0b8961ae952d16ea39243539856a0de879a904f6556fad69b3ad37ea961dfded77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
cbd7c9cf2867915e3923f175ff70dd31

SHA1
21deb25853dfc9025349881b73757a087f2fbe4f

SHA256
e47dd50512acb41f7bafc4f0053edf0d4f6e4c5a946445e389cc513d600b0b7b

SHA512
31705589b2bec81418e43a2ad5b78b65931182d708ac948b5cc6867e0af763e766ed4de51b34838d169d3077c3bc4a95a426927a8721ccd5ff2830a99eeb0c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
567137f5bbd7724ef2bb0ea27cc1cb1e

SHA1
9134890c771dd679b1513a98b9e973eb4c6a9f72

SHA256
57fe8f944b7b4efcb3cb677178321904832bf79337e69207b247326b1e013ca7

SHA512
51dca8bc1f4f2e65a12fd488219d693e4f06a6119f364532a103d4d61ab2abb3285ec77b7965259a76d3d6c758683e1d4d8bdee40539a883dc8638e15dbb258e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4161004b605e41f30c095d37303e5595

SHA1
e421c69c1d4c0312a8debb3ba29888c6d5b49235

SHA256
24b0f378d9c284f175d2b39ff2ee510af21d3ce6f7b9009eab49d2b5d0a357e9

SHA512
163a93c1ebcf3818bf2b96e4947f61d03d69e9881f59eb9c8d3d40f0b5eb245be1a44fb6f83aac866ebaaa098b4313a0962268b210ce361da903f950c707042e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
012c446180b49856d3fe75ba6adc3854

SHA1
55a575fba5a9fbf6e16a6e90720d1e8a3b015d7e

SHA256
06c4bbab306065ae9f4a4574585badc078fb16fa6ecb70be327e2ac0cc54ca71

SHA512
292af773a98d73e5a3f22e9fed9481a1f48609c76e18add94f0056b877dca33813cc1b2c96ddcee6113ff34c21d7384db333c1364ba614c9d97cdb5511bca313

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
259bee2370c650b30ec38de033758a6f

SHA1
391ba98505b761dabfec0b95733e59242251573c

SHA256
6925c34d0c41ed3ae5138ff0b26aa2b2abda60282dddb54a97b22acf60d17c14

SHA512
bef835daf39ea5f363a0310d398bc6cc0aba22e866f1f8be9959bbe19f5f714a1b84ad966ac6865b9067db6b488bf4cec124df13dd8ee9c2fbe048bbd6c9e87a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a8e5a56c51c51699ea81da6a18661df2

SHA1
e5aca7d6ffa733ccd40b2b4ba72385a4419adfbc

SHA256
9a5fcb5f2b6a2d8b55cb92b18be824939e46bc8bf31e2c4d573671e2e4fada09

SHA512
586d04fe40c037e429fadbd7055407f211239af2fe385fe5ffa515f183eee15d903c10232bc4396b3ca0780c2674dd9f5610c848c6e797f6bbd3e68537cb0133

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d8bdf0162678003d27986a8d44742739

SHA1
a17d675d318e28edce4c1c0343702b781d5c5b66

SHA256
9b15d46dfc40e883f2847b4e19f203b1ab617c3480ed85bb2e6253f89b897cc2

SHA512
4d6e938594989c73b32ac02077f700480daba7693d7b2e736ccfa7b7e8f68301c840fc4fba9238e29d9d381365ca2ce5066201808aacaabbdeae7d2802e819cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d99dcdce1d0b095f81ef996bb8b42e78

SHA1
f7320b922ebaa1b6d2d3c3b02707e289f7536c34

SHA256
225fde540f5636ec0876357c967c5ab43d34855c62e0b00382139d17d411916e

SHA512
0507f9f484067773aad78de7268e07af57ab8c33e78af8564ee9b4d6ead01e50104cf611c16afb34af756510593aea3c774851a6d5cd288f575fb7ad2a56e25d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a6e0932c9e1dc93513ec34b8021fe3c8

SHA1
7ef3a28b177ac0b124f166d874788fde6ff58449

SHA256
158735e81dbbc59d847a6be6ea6188ec268e7abe8123c1e5acd8f740e77e8f73

SHA512
dcc44013a3719342b3a08e94dcbce80214509ab58119880046b87415a3ab7a0c74eb664d11ba75fda5a120d086cbfdcf57a9a92e7d377fbd0b27feb8bd7ed206

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8046d4dc161bdcdec625e5685b221710

SHA1
e1288a9bf33e9fbe7a947606e3cb57d322d72e80

SHA256
f9c4ea4845597fa0df3ad4b07b04a8cd8961bc08871dc501ee408ccc6ebe3709

SHA512
730be9698ebeab26affe7ca4756d657d01e93fe47d40cbd7771296b349adcbf3bbb4c11ad9b37ff6dffe8e625254a8cbef99a99cb14079681523925967b101cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8eccade08211475edf0222db995f81a1

SHA1
55efb025afaf4bbe4c05966d98fe6bc9bf5bdf8c

SHA256
72baafecbb9065a34fc1e94d475a0384fb09535ead3b751ec74c19a35990a32d

SHA512
23ed19f9b85a69a6ad178593ce964df842d557e0f9a2c2ccea7f2c537b62f548519a617ac97f3a4697ad73a2b4970c43cd65cb4990a21c0adefacab0e851441f

Download Submit
C:\Users\Admin\AppData\Local\Temp\kLwjG.bat

Filesize
157B

MD5
15caf9d73a10032703086477c78f8a06

SHA1
79ff878df3b774ff5ad2bf54ad3a41d990cf7d31

SHA256
1ef63f20b9f52b2e1f8c848a9218b7de1b7cdbeea178f3a6646a4014d0b1083e

SHA512
b6daae9fad92225e4e539a722f81df60958d9708ce7c275932b59ca27af4f148255513159391cec2902f2a4a16d6e1e6ecbc77e482a1fa1ab6a409b3f0a409a6

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
\Users\Admin\AppData\Roaming\atidisp32\atidisp32.exe

Filesize
341KB

MD5
c529feb6ee32ab7437fdae205e318cfc

SHA1
11d0d160c7f6e62554f2d6fd59b5fff301379a8f

SHA256
7b7ebcaee4ccdd40dcd63aaba90c337de85d65a19a8db44a6fbef8620327345f

SHA512
caec3b0cdbd0ef38b8be502cbcd3bcad53b6f7fa685a537b289cd2baf2bad6bcc45ed80a1d2412e93612e89f1b6be4a081860ba1fc36830126caef5d289161d3

Download Submit
memory/2228-47-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2228-39-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2236-413-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2236-416-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2496-38-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2496-2-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2496-35-0x00000000033C0000-0x000000000351D000-memory.dmp

Filesize
1.4MB

Download
memory/2496-34-0x00000000033C0000-0x000000000351D000-memory.dmp

Filesize
1.4MB

Download
memory/2692-412-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2692-403-0x0000000000400000-0x000000000055D000-memory.dmp

Filesize
1.4MB

Download
memory/2820-55-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/2820-379-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2820-49-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2820-43-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2820-48-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2820-58-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2820-51-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2820-50-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2936-402-0x0000000005860000-0x00000000059BD000-memory.dmp

Filesize
1.4MB

Download
memory/2936-70-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2936-65-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2936-59-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2936-417-0x0000000005860000-0x00000000059BD000-memory.dmp

Filesize
1.4MB

Download
memory/2936-401-0x0000000005860000-0x00000000059BD000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads