cybergate | ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49

Analysis

max time kernel
24s
max time network
28s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49.exe
Size 5.0MB
Sample260909-jbn99stejd
SHA256 ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49
MD5 42669ee261fb6ef9d8b2323d58e31340
SHA1 cdd0b82f025680db95118f8a68bd630248ddf69e
SHA512 15a0935b6ddb59ca8a9d168bc9465296068dfc2611c0c4978c959aadd46aa4a97f6cb10722200b6267ebbb18b09c8f99b16fe8c640df635c18852c2807ab87de
SSDEEP 98304:5ni3Tdm6QlRPzh1Sw5AcoKKUj9tRwYaowV17hT9EnHS7YilejQXuXNc:5wTdm6QlZ5AcoSrRG1FqoY8eUSq
TLSH
T1B93633D17C530574F3AB80B9E5522DBB32BAA220F3F4C415A9899A3D97CC5C5BEC281D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spasiba3 defense_evasion discovery execution cybergate quasar xworm persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

176.160.157.96:8887
uchiwa5.duckdns.org:8887
monbondns.duckdns.org:8887

Attributes

Install_directory
%Temp%
install_file
jusched.exe

Extracted

Family

quasar

Attributes

encryption_key
6D4A4249F385558E6764D6D6FE7C7D31F942200B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

spasiba3

uchiwa5.duckdns.org:7777
176.160.157.96:7777
monbondns.duckdns.org:7777

Mutex

0BA8566O60C310

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
System32
install_file
dllhost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate92
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000016cdf-8.dat	family_xworm
behavioral2/memory/4196-17-0x0000000000580000-0x000000000059A000-memory.dmp	family_xworm

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c525-15.dat	family_quasar
behavioral2/memory/4820-27-0x000002B263E60000-0x000002B264026000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4280	powershell.exe
3732	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4196	jusched.exe
4820	Client-built.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2464	powercfg.exe
3652	powercfg.exe
5756	powercfg.exe
2804	powercfg.exe
1140	powercfg.exe
3884	powercfg.exe
3004	powercfg.exe
1960	powercfg.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3580-62-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/3580-59-0x0000000010E10000-0x0000000010E80000-memory.dmp	upx
behavioral2/memory/3580-56-0x0000000010E10000-0x0000000010E80000-memory.dmp	upx
behavioral2/memory/5000-132-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/3580-128-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/3580-135-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/3580-194-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-198-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-200-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-201-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-202-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-207-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-199-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-365-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4252-719-0x0000000010480000-0x00000000104F0000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
568	sc.exe
3664	sc.exe
4104	sc.exe
2104	sc.exe
5652	sc.exe
2832	sc.exe
4988	sc.exe
3352	sc.exe
5744	sc.exe
4920	sc.exe
1132	sc.exe
5052	sc.exe
2192	sc.exe
4324	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe
3544	cmd.exe
1700	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	jusched.exe
Token: SeDebugPrivilege	4820	Client-built.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4196	552	ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49.exe	89
PID 552 wrote to memory of 4820	552	ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49.exe	90

C:\Users\Admin\AppData\Local\Temp\ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49.exe
"C:\Users\Admin\AppData\Local\Temp\ced90667d0c5bab5a5cd3bbd55634d8a308170a866ef16447e87ae13c6a6ee49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\jusched.exe
  "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  PID:3580
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:5000
  - - C:\Directory\Windows\System32\dllhost.exe
      "C:\Directory\Windows\System32\dllhost.exe"
      4⤵
      PID:5324
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4252
- - C:\Directory\Windows\System32\dllhost.exe
    "C:\Directory\Windows\System32\dllhost.exe"
    3⤵
    PID:796
- C:\Users\Admin\AppData\Local\Temp\miner.exe
  "C:\Users\Admin\AppData\Local\Temp\miner.exe"
  2⤵
  PID:3304
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Executes a command shell one-liner
    PID:4584
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4612
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5744
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:568
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4920
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3664
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1132
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2804
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:3884
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:1140
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:3004
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:1116
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "System"
    3⤵
    - Launches sc.exe
    PID:4104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5652
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "System"
    3⤵
    - Launches sc.exe
    PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3544
  - - C:\Windows\System32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4828
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  PID:4228

C:\Users\Admin\AppData\Local\Temp\update.exe
C:\Users\Admin\AppData\Local\Temp\update.exe
1⤵
PID:2160

C:\ProgramData\System\System32.exe
C:\ProgramData\System\System32.exe
1⤵
PID:5236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Executes a command shell one-liner
  PID:1700
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:52
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2832
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:1960
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2464
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3652
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:5756
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1640
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Admin2.txt

Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Size 385KB
SHA256 4c3402bdcf1313ff38d00ae0138d5ac41a4e8f598652d4e1068b31547ab7c2db
MD5 cb5e58bba45d6bfb9a4842d2b3aef651
SHA1 7aa15874532cb0020910b8cfae2682a320c6adb4
SHA512 26d5bd482812081771589a3ec29446db672fbd7c69aa761dff166740bea569ca89f204eb65bef42af1659d6a44192f30ed34518f06ef5254cc58d754b4050b33
SSDEEP 6144:4A0nitqv/nHrHxVPGTZTzq9SkTr2m7mrUsqWBn837FNldObO3k1jh:4Bi8vvrHxVPKyv2m77sZB07FxObO32l
TLSH
T16E8423E4F03CAE861FD59B06273CEA80DBF86D379C93405349AE761CE7AC1352B46661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 b20d735e4dacc3689e6638a29a9c505fa19e62d42f03e67906bb3b30982dcca2
MD5 18f7929cfd4fe33fd4825ef969fbc6be
SHA1 1405c84aefa76d2705563fa8eb94dbd56b404cb7
SHA512 8e58144226ff0368691df684602c98db37007b72eca605d59737097dedd2abfa2ad51092928e91d4aa45bf4529870ea214c9c587e88e400379fb83975e60faf2
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 d535a223830740514a2d51e90fd02eb78b04d8e56bf1a0cf3ac623fefc655459
MD5 9f6a1d79e453f2e4594f3eb4da548fd5
SHA1 0a2bd6b78cdfd93a002612aa6c86a8f5f86dde12
SHA512 2c8670cc200fb3d2953074dacd8dc6a45d1e591320ecd9d7b76c40f9db4a03d7f9621f12163420d3bdc27f1cba5f2453c8114f201e79d37cfdf91e7d8d32b679
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 7ef826a3aab7d51c0791556caaf356c5fa28afd255a95e5998e0461db439f92e
MD5 abfaea878db7b4e1cd9e35109fc75c74
SHA1 603a49d4bab78e002bbb98b3750387c9e109784f
SHA512 1d4ad391f5d8584dc11a76bad1a2d4caf4466cadfc90ae49c91b8f16c49f162700c0e992f9c2a663f60ffdffd42e1a86f34fc2e2a276994e8db99a8befa4fa5c
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 90060abb13e9dd63913cbce6ac21b15a55c2557b5445efa5b977929223d3a8cd
MD5 548cf85dc01023e638f92a3c73f0428c
SHA1 27b4f6ddbb56c0b82616c3b66b6cce21338cd01f
SHA512 3037460fb7d80a299d7cb10f991249d62eb40f70a719e384e62e936dd15073c115bc0bbc4582ebed532002718ee1cf94c2c21599519f9078da098af76fdf532c
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 f17d9f6e97ca7859ea1af8799ed0a4417f8d4f87b2b746913fa120f309573f3d
MD5 fa10fd7f2846fe55b5657d734c89db7b
SHA1 c9d8789748a5bcde0e0f73f4ea8451bf019b9369
SHA512 d082bdd7c753e975ba17089d57d3d3e9c4ee7ab56f778574aaf6024524e9446bd1b6b6a1140f05218a1eb8ebcea8b83ceb1cf8495e481914c9e9411e9a351ba7
MD5 SHA1 SHA512

Submit Download

Admin8

Path C:\Users\Admin\AppData\Local\Temp\Admin8
Size 8B
SHA256 babb0fa77fb7664ec69fe6c97c9d873c6a6d331ed1f26d4dedb5240abd027159
MD5 20ae73d02c28eb0a2a25f76b0e9da92f
SHA1 8df26b21ae3211448ce7745020748ccb09a9ca59
SHA512 ea6edbb604145c1cf694a7ec3a45231ea8ba04c0c46ac2f2e73b834f214b85a8e920636a423352c6a1276c7b84f641e52c0070bbc4753bb2dfbdba64dba61901
MD5 SHA1 SHA512

Submit Download

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\Client-built.exe
Size 1.8MB
SHA256 5b8a12e87daf5efaa21367f99bbc6304bf25d54305bb19752dc69637f22f4566
MD5 6caff190cc5e4924fd7c0c2e81ddcbb3
SHA1 3445b37002085f26cc110e8f3ed9f63d32fda393
SHA512 9a9dfdd9cf5ae3b4358a68cfda486b023875f6547039625e11d95804d734841bef434f5f8c090453870b2f5bc3c2df9d065503c872cb45b51fbcabb4736052b9
SSDEEP 24576:JRbjQmMSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBkE:JxjQfTYj77wRGKKm77LrwCB6hqane6
TLSH
T17685121077F58217E2FF1BB9A4B644060B73FA539A3ACB5F1A48606C1EA77418E513B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.exe

Path C:\Users\Admin\AppData\Local\Temp\jusched.exe
Size 79KB
SHA256 046c9815c258648dafa74879e74c4f4dfdd3e93704aa8d068b1e5469806ada23
MD5 fdc44d8b6b489dc23ab3acc029a17919
SHA1 cc4160ba22d990996d286e2b4590f906919225c5
SHA512 1c95987d9291d4f8bbc2150700d2f484880c459214340e2dfc8e24ee5e20e735b194bfbc1d5c5226a859e4b6426e2afa85eaaf1c35bab907746f1efb4f446218
SSDEEP 1536:uKe2gDL1/uleZwwLI3nbuIn0kNbXtjhJ0Oe96quxFOTXRMm0Xclgvu0nMN:uK9NSIbbXp05EFOThMBXcl5+MN
TLSH
T18B837D683BF54125E0FFAFF04DF13266CB35FA236903D61F14C9068A1626A89CE516F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner.exe

Path C:\Users\Admin\AppData\Local\Temp\miner.exe
Size 2.7MB
SHA256 90245f1a83c588643402419d8fe15916fc5348dde89e85a359f6b080321e262e
MD5 08e9868657289f14b391650fa1ee0efe
SHA1 253b9892b3eb6b5ddd2b377ca45b20f52b614926
SHA512 e9855d2eb388f1b5dd378869bef5745306d8baeb119ff8bb11f4424301f94e1e3638546716862f3e57887013450cad197132828859b2d459c53f7879e98e3818
SSDEEP 49152:H7jGuWkOqGCwu1M22Hbtz1whzBv99AS7n56F22caVIo690T6KqzXZKnCw+23EX:bozpx22Zz1kviEUFcaVIo690+5zJKnxC
TLSH
T185D5335961946ADDC624F93A61354A6068F734ADCFF0A2DBEDC3AF32F46C4E12633160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 428KB
SHA256 7cb5a738280dd8bc9088f2fb49b3169c12498ea72de7e2956a8fd98c7ba5e727
MD5 c08fa2a1217ef65a9839b3c268739f8e
SHA1 cdef4afbdf8ff20908bd9ae32e145ba862688d0c
SHA512 3786214245e7b80ae903a2066af9d77d0bd599e0f8623e88c205282e4ca8c22c59ed87fe20cac03c431dd2b405d340acff703eda96cf3239f789a71cfd6717e0
SSDEEP 12288:BuMwyBi8vvrHxVPKyv2m77sZB07FxObO32t:BHwL8vrx52t07FQay
TLSH
T1A89412A6F4555C77DBA18BFC1E2CD684EB6D3E222C27509399FD3F88C71C262160D1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 11KB
SHA256 d6966099c5998c8fdabf3f7f435856b469a1cefd4c8f8362c2dceebe7dd31c94
MD5 8001a5a10f6f71e5b93703afad23f8aa
SHA1 bb3350de5a04c8c48efdb9e7ebeb30826c37ce9a
SHA512 63e180b64e6d152226127bc636671919173018c50ce408281dddf36a4b90e07263e21d4976795dae7ab054819415124cf6b3227b1725c138be2bab51286debec
SSDEEP 192:DWnbgb7kBSaox8bjIdclNRNxhbmq82MgXw+yJOxMjR8/MY1BZ:ibgbJaPfNrxhmq82MgXw+yYxU8/BB
TLSH
T15E32C741B3E882A6E67B8F36587217110672FA1AAC23CF5E0CCD601D5D777D01A23F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ngphrfrc.rs1.ps1

Path C:\Windows\SystemTemp\__PSScriptPolicyTest_ngphrfrc.rs1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-18-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/552-0-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp

Download

memory/552-28-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/552-3-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/552-75-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/552-1-0x00000000007B0000-0x0000000000CB6000-memory.dmp

Download

memory/552-4-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/796-726-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/1116-696-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1116-697-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1116-695-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/1116-694-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3580-59-0x0000000010E10000-0x0000000010E80000-memory.dmp

Download

memory/3580-62-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/3580-344-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3580-194-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/3580-134-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/3580-135-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/3580-56-0x0000000010E10000-0x0000000010E80000-memory.dmp

Download

memory/3580-128-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/3732-731-0x0000021C1B790000-0x0000021C1B842000-memory.dmp

Download

memory/4196-42-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-43-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-17-0x0000000000580000-0x000000000059A000-memory.dmp

Download

memory/4196-117-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-31-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-33-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-65-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-57-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-40-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4196-41-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4228-67-0x0000000005020000-0x00000000050B2000-memory.dmp

Download

memory/4228-71-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

Download

memory/4228-58-0x00000000005F0000-0x00000000005FA000-memory.dmp

Download

memory/4228-66-0x00000000056B0000-0x0000000005C6A000-memory.dmp

Download

memory/4252-198-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-200-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-719-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-207-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-202-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-201-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-365-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4252-199-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4280-488-0x000001FB56D70000-0x000001FB56D8E000-memory.dmp

Download

memory/4280-494-0x000001FB56D90000-0x000001FB56E42000-memory.dmp

Download

memory/4280-452-0x000001FB3E980000-0x000001FB3E9A2000-memory.dmp

Download

memory/4280-511-0x000001FB56D60000-0x000001FB56D6A000-memory.dmp

Download

memory/4820-29-0x000002B265DB0000-0x000002B265DDE000-memory.dmp

Download

memory/4820-112-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-27-0x000002B263E60000-0x000002B264026000-memory.dmp

Download

memory/4820-69-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-193-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/4820-114-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5000-64-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/5000-63-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/5000-132-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/5000-131-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

Download

memory/5324-665-0x0000000000400000-0x0000000000471000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads