cybergate | b85b825a13d2b5277dcecb5020ffdcacdbd1b83a056409a670c1e0aa36c55718

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OP7_Atheuz/OP7_Injector.exe
Size

510KB
MD5

5694f7da1daedb0591c5f76a098e57ef
SHA1

10d34b602dc7efae4603725e15f80a3ae335c535
SHA256

ebd82554ff28e53d135a3be94c51879106eff01f511f6755cd7bf54ba3432096
SHA512

501df940a9be6d92b7dacb9bbacc5b782535d42e830b1f241447d0d5c716208ecd0096942c330b9770f685b7526f9e0a08dfd72a07d43572a49d5069d46cbd62
SSDEEP

12288:YMDRxxcZ8V9gYLpvr25Bm9Z/pUz6N0k8Cy2LVaP7D0:BZcZ8V97r2OXFoA

Score

10^/10

cybergate operation7 discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

OPERATION7

polluelos.no-ip.org:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
syystem32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Not compatible with SO
message_box_title
Atheuz V1
password
admin
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	syystem32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	OP7_Injector.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	syystem32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\syystem32.exe"	syystem32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\syystem32.exe"	syystem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	OP7_Injector.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\syystem32.exe Restart"	syystem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}\StubPath = "C:\\Windows\\system32\\system32\\syystem32.exe Restart"	OP7_Injector.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}\StubPath = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAT4DON-A4Q0-1N20-265P-0AK6Y1F205U2}	syystem32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OP7_Injector.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	syystem32.exe

Executes dropped EXE 4 IoCs

pid	Process
3780	syystem32.exe
628	syystem32.exe
744	syystem32.exe
1236	syystem32.exe

Loads dropped DLL 1 IoCs

pid	Process
4996	syystem32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\syystem32.exe"	syystem32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\syystem32.exe"	syystem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\system32\\syystem32.exe"	OP7_Injector.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\system32\syystem32.exe	OP7_Injector.exe
File opened for modification	C:\Windows\SysWOW64\system32\syystem32.exe	OP7_Injector.exe
File opened for modification	C:\Windows\SysWOW64\system32\syystem32.exe	syystem32.exe
File opened for modification	C:\Windows\SysWOW64\system32\syystem32.exe	syystem32.exe
File created	C:\Windows\SysWOW64\system32\syystem32.exe	syystem32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 3520	1688	OP7_Injector.exe	84
PID 3780 set thread context of 628	3780	syystem32.exe	101
PID 744 set thread context of 1236	744	syystem32.exe	110

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/3520-9-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral4/memory/3520-12-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral4/memory/3520-18-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral4/memory/3520-20-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral4/memory/3520-21-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral4/memory/3520-24-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1976	2068	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OP7_Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OP7_Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OP7_Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syystem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syystem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syystem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syystem32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4996	syystem32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	syystem32.exe
Token: SeDebugPrivilege	4996	syystem32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3520	OP7_Injector.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1688	OP7_Injector.exe
3780	syystem32.exe
744	syystem32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 1688 wrote to memory of 3520	1688	OP7_Injector.exe	84
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56
PID 3520 wrote to memory of 3428	3520	OP7_Injector.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe
  "C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe
    "C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 84
        5⤵
        Program crash
        
        PID:1976
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe
      "C:\Users\Admin\AppData\Local\Temp\OP7_Atheuz\OP7_Injector.exe"
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Checks computer location settings
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:436
    - - C:\Windows\SysWOW64\system32\syystem32.exe
        
        "C:\Windows\system32\system32\syystem32.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3780
      - C:\Windows\SysWOW64\system32\syystem32.exe
        
        "C:\Windows\SysWOW64\system32\syystem32.exe"
        6⤵
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\system32\syystem32.exe
        
        "C:\Windows\SysWOW64\system32\syystem32.exe"
        7⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
        
        C:\Users\Admin\AppData\Roaming\system32\syystem32.exe
        
        "C:\Users\Admin\AppData\Roaming\system32\syystem32.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:744
        
        C:\Users\Admin\AppData\Roaming\system32\syystem32.exe
        
        "C:\Users\Admin\AppData\Roaming\system32\syystem32.exe"
        9⤵
        Executes dropped EXE
        
        PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2068 -ip 2068
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
025a23c7ba8ef978c313e501545f2cc0

SHA1
dfdec075bd489434a59bf32c5bf5624a7502af31

SHA256
bbacf6d8e5b6588e3163171327aac1e7425c80b432f96a9a872f7bf6fb3fc149

SHA512
5b9d1e1a4ec815769741999be335845b0604df5ab389c2211a925df20071e69bab13ec7c266e3f1718823f1128686f8837b16c4af43feee141047c369a3299e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
d22ae3d7b3efbc99b42d3fbb22429ce7

SHA1
302f0ac22c9335af0cea9d404c62191a0c648e2e

SHA256
a957e978fc2b1d5706897cc6f7846fb27e601da192d60e805b86c2bd23671573

SHA512
063f6060a71f8f4ac8a1b43f02a258be60992a822e13e05e1b0321964bfc5c112d6b350e7ef56a0d1f0bb05113d4692b5304c5d47a248f06b200cb49944affcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2d81cdb95e2b07c308cce3ab849bcd91

SHA1
ab4005363f2d898e579f52e6c902f83fa1e13ae4

SHA256
37b7d8bfdaabe8019d8023f77234a0b7b4ce686ca704922159b79ee251f71fba

SHA512
92384d02d4555c5481cef73fb8e8b4b8aaa08fff8641a6254ce94a440b50dde9976da99df826dcbeb9ad4acfe9b19e2daace1250dd2e85e5e8511942cfae2d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
48f62af4fba5fae3b6e02abd046a40a6

SHA1
6c028a28964eed6ef27fac587073d4a22672c21c

SHA256
f9a683b2c21be974569673958c6e3c4ec1c93ded516fba872ccd2979db20c282

SHA512
5238ea78f33aaac2b5a04e230c4a46de5beb9842d7992263760bace27178177f85cd6dffc8bccb1004268641cc212abbd51e5c9a6de479bf8d881f8b63c9b307

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
dac1a5cc7fae3ce762995672f6c84760

SHA1
4b4cc30a10e7a4105bc10fd3ddfdbf04dd3e67e0

SHA256
e7234230c5a6f8d03f71f2141f7b4b87dca0b97697987412ee0bcc9ffdae5e68

SHA512
0845bacf95c4c0ce35e54658e57cd9c5bee2eef1ac09a109e9b9483ea50d2c22f6ed5df945cc4d0da9d5bc82b0bbf9d735d5a6587d00f144a482a4babdff0157

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
23bfde1933dfe30f99739bfbcf56be95

SHA1
df6c366d04a8065514edb15bc2ded3c47d48227c

SHA256
a46701c855dc5d021622668e628e5ac82655dd218d59fb5def7cb65bca068f06

SHA512
09f79848a3db8444d1f1ca1df7a4923e45510734a184824d676cb1efb977a5f7f82a80e3ba0048337b71e0225eeb9cd813ab6d3da0704e665ed6bd6f3e37fa21

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
80c21f105f3a10bf670617ee2127cbf1

SHA1
5922301622ccfa281d3c3a0e6389d7c2fb51637c

SHA256
2cf523b3b654024a60b94e0bc9e22b933c0f3b88c71559a8c04c3189989eccd1

SHA512
e09d7f2b09e001a52f386ba5e935ab1a0297ed82599eac743058c7d456cac20cb7d69494bad21e0ee6462b97080a5de35aa87926d5530e9dfb74a6ad4314c38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
505d12b71a5eed5f40483c624b945213

SHA1
896767223875d60708fbdb9c7ad1d181a7c29c6d

SHA256
54aed37dd5c400bad24cf8beaa768d61afba2e69cfb0340a8fad612a9a5a7345

SHA512
0f80c82ffaff2488178b25dd2eb2178affe7286a02d5535f87308babf68163bf6e577ebd0c3cb62c0b67909944d5b929c650e6ed7169f6e49cc4185dc717ca30

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
10f2f58e27c5c1e15f75da6d2cd61dc5

SHA1
f8b4da4a141708484e2585c5c1e319d491401485

SHA256
ce85d530ac645c23c0ff9434108a0929d6218c554e6bda6a2e6489125d6f216f

SHA512
a4ff1de8053cec34a45b59c78150ce33b5e27d30fa1aed702b84bc6010b0721dbfe75f73f21e280c9bf95eea89e5c1d105ae27ac4b6f470c9d5865b07e2d026f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
fb6f58389a89158b2620874e31e57f64

SHA1
2fdfa0aa8349975047362cd8c519b964043d78f4

SHA256
56eba0c70c6bf2ae6336afa9f26dc21234ab29e20ac47d32829fce609d244111

SHA512
162d38024f5b2687c0c423fc6610f6609177d98735787c69ce6354e2cdd7c8eaee9e8370c5f2e3feeac3a52172bfcb64ab1d4cab71cfc248137fcebc0f1ce72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
48dd556447e893adf4401812b3885cf0

SHA1
547855297e621ace40097748193806225b20882e

SHA256
62ec2784db4840ad69905188b1001975f4654295c755b38cc6660023babafdad

SHA512
d2f2006593950afdf46bc9f7f00fc81c84918823f7884a1658f1f2b6b8ecf0b4b0a8ec306c3951deea4be30c02b22ed31e0d7c85dae66f27091fda90e0e22c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2df668891c2de3128e3f3ce248a3573d

SHA1
bfd5582dceab77e25a60828895d5ee64e46f1d50

SHA256
2213f558aece9d9e920303b7cce67c3c090dcec26a2af9ebab7d8bebe15d6c9f

SHA512
d6e06d277926cb0379cc4153ea610c0a04d30c788277f7787c91ac610b7650f54d1f5fd2d9e4aeadec213938745f3ff7facf743bac12dd66fbdcb1acf62d738c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
43b41070a2809ff4b3755677eb808ec4

SHA1
343bee7cdcf2fb7199c53ca4581642285203813d

SHA256
b56400b7835b4e22147851fbf24c529344b8c885d5cb2e147846473be58269b5

SHA512
4831dcfa78c6dd9105ebc87abbfeeef50873a7e184006715a41f859e3fb7a720afb98aec0ab3090d751d486a3e5b5fb298dac30c3dfa2c30ba95100835d6c0e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
eeefc6701ea66b8bf535a6b5ea8990b3

SHA1
a716242fe6b5e0d5ade77e45e1db598abe5355e7

SHA256
1f7d9031968ff10949e9b82cae276a13dc44202c1872ace0890c31b122f1627d

SHA512
196502a7b5ae79d7b73415e5a4814c386fe3cf8b19c5ff31d7432d560cb08c22a478d949531dbc316d55ef59546f0dbc1e7fecea27d16c7c74b09d3643d313a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
90abe137836475ba963b7a323dcba381

SHA1
940337203dd6bc458c49c2b7e3ecb70fd426f6f4

SHA256
98ec0e29f4f97b963414942c0d21c169d133dcdae11a58ac3290767c48dbeb24

SHA512
77d06797d496b981b9411c2c5ef5d14aec3b85bc18615608c595cdfa6d3f63618e8367bf7c7e9a202629327054ff3007902f626aee8c2a8171211d55a0cf25d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b25511940a80eea4ed32e60b7dc9009e

SHA1
5edab5b1a603f544a5c2c61cf21615eaa09f5e1f

SHA256
ada63d2a1beec14d368b08a86a22594d7034686bb426518706c0f2ae09b62da9

SHA512
a2b141c2970851b78b60c3292c00332f818ec9c88d6409c7d86db316feaf883aceb82f52aafebc061d2b71e82e11da78ae6940c1920b3f0be6fcab91470f8aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
28481b6330304117e5ac8f862d073343

SHA1
a1d5988118113fd40f772f3ec51b225e25906185

SHA256
47f8ce4b38495455a313804092c82cb418629422021d400ac881d2b374476300

SHA512
c031ea2d4f9ce03caa116e6a90de865ad407855d8717c4a88bc280ef79bb9156d2f7e595567f96bc032903e189cb05de088df8af9b4c3109d6a02ba1e308e14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
c54c7cbff84a79bf1d430f3eea3cdd1e

SHA1
ac27583bcc5daf3891b2a01c46dfda4b9642357c

SHA256
d6535381395ff7f91323a597032cf6257b825bc8cade4b193eefca811bb40de2

SHA512
a852fc9df733e2b111cfa23b264b6321b6fef4f3e8935d66a434f52f837b6d00c2bfa805d8940914d789525824a55bc8630df7fe2b9b93293b2fe661322afab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7d6975f87d2dc521f293ba072bffb07b

SHA1
16506a861da3d0ce9778c6ccd6a9dfc810504166

SHA256
f5207595fa65c672a69353955cb4c2bf98dcbf35c8b4bcc1e8d579badf5f9f08

SHA512
f9161b919493285a2d57ffa94130b887b694bd3178a1bf03d7bb964e265c9e7c45e5b959f4ce28352482022f3083494f821e556f094aeaa4d3de91711ebc4f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7680b10a370997d22aa0e2d94384aeaa

SHA1
eff23f2c3c3c6683006adfe65380fc1edc507a68

SHA256
a288e4b5f4ead234ef3dd705818a3c2d8cfbcf8e1402ef86a13f2f8bdfa5c395

SHA512
bec4d9415b1fbebc2ad43aa2306dbb7d6b0dd425f4be3887a1b1fd9d945e9b0c454d03d679c37b3e8553bb73cc3b4f95d95bb7bff0408de1336b9bd1aef7199e

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
e21bd9604efe8ee9b59dc7605b927a2a

SHA1
3240ecc5ee459214344a1baac5c2a74046491104

SHA256
51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

SHA512
42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

Download Submit
C:\Windows\SysWOW64\system32\syystem32.exe

Filesize
510KB

MD5
5694f7da1daedb0591c5f76a098e57ef

SHA1
10d34b602dc7efae4603725e15f80a3ae335c535

SHA256
ebd82554ff28e53d135a3be94c51879106eff01f511f6755cd7bf54ba3432096

SHA512
501df940a9be6d92b7dacb9bbacc5b782535d42e830b1f241447d0d5c716208ecd0096942c330b9770f685b7526f9e0a08dfd72a07d43572a49d5069d46cbd62

Download Submit
memory/436-28-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2068-14-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/2068-13-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/3520-18-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3520-24-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3520-21-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3520-20-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3520-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3520-34-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3520-12-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3520-90-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3520-9-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3520-3-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3520-4-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3520-5-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads