Analysis
- max time kernel
22s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 23:58
Errors
General
- Target 8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008.exe
- Size 5.0MB
- Sample260910-31lp8azths
- SHA256 8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008
Malware Config
Extracted
-
quasar
-
encryption_key
6D4A4249F385558E6764D6D6FE7C7D31F942200B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
xworm
-
uchiwa5.duckdns.org:8887
-
176.160.157.96:8887
-
Install_directory
%Temp%
-
install_file
javaw.exe
Extracted
-
cybergate
-
v3.4.2.2
-
spasiba2
-
uchiwa5.duckdns.org:7777
-
176.160.157.96:7777
-
monbondns.duckdns.org:7777
-
1PSQVR0MY4AJ88
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
System32
-
install_file
dllhost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate92
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
- Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- PulsaRAT library module 3 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Stops running service(s) 4 TTPs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008.exe"C:\Users\Admin\AppData\Local\Temp\8f20020d5b0669c889435750b00452672cb17fc2a87225a5341040bc05afc008.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"2⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 844⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
-
C:\Directory\Windows\System32\dllhost.exe"C:\Directory\Windows\System32\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\Windows\RuntimeBroker.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3420 -ip 34201⤵
-
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe1⤵
-
C:\ProgramData\System\System32.exeC:\ProgramData\System\System32.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
System32.exe
System32.exe
Admin2.txt
Admin2.txt
Admin7
Admin7
Admin7
Admin7
Admin7
Client-built.exe
XClient.exe
miner.exe
server.exe
update.exe
__PSScriptPolicyTest_qoukdwzz.ute.ps1
memory/756-19-0x000001A38ED60000-0x000001A38EF26000-memory.dmp
memory/756-56-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-35-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-32-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-45-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-38-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-46-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-20-0x000001A3A9440000-0x000001A3A946E000-memory.dmp
memory/756-34-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-57-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-31-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/756-33-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/1088-363-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1088-362-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1088-361-0x0000000140000000-0x000000014002B000-memory.dmp
memory/1088-360-0x0000000140000000-0x000000014002B000-memory.dmp
memory/2616-29-0x0000000000380000-0x000000000039E000-memory.dmp
memory/2816-147-0x0000000004400000-0x0000000004401000-memory.dmp
memory/2816-148-0x00000000104F0000-0x0000000010560000-memory.dmp
memory/2824-84-0x0000000010480000-0x00000000104F0000-memory.dmp
memory/2824-67-0x0000000010480000-0x00000000104F0000-memory.dmp
memory/2824-151-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2824-144-0x00000000104F0000-0x0000000010560000-memory.dmp
memory/2824-134-0x0000000000400000-0x0000000000471000-memory.dmp
memory/2824-63-0x0000000010410000-0x0000000010480000-memory.dmp
memory/3420-69-0x00000000012D0000-0x00000000012D1000-memory.dmp
memory/3420-68-0x0000000001210000-0x0000000001211000-memory.dmp
memory/3676-158-0x000001D2AEF00000-0x000001D2AEF1E000-memory.dmp
memory/3676-153-0x000001D2AEE50000-0x000001D2AEE72000-memory.dmp
memory/3676-159-0x000001D2AEF20000-0x000001D2AEFD2000-memory.dmp
memory/3676-160-0x000001D2AEFE0000-0x000001D2AEFEA000-memory.dmp
memory/3852-337-0x0000000000400000-0x0000000000471000-memory.dmp
memory/3852-161-0x0000000010410000-0x0000000010480000-memory.dmp
memory/3852-218-0x0000000010410000-0x0000000010480000-memory.dmp
memory/4132-62-0x00000000008B0000-0x00000000008BA000-memory.dmp
memory/4132-70-0x0000000005910000-0x0000000005ECA000-memory.dmp
memory/4132-73-0x00000000052A0000-0x00000000052AA000-memory.dmp
memory/4132-71-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/4300-77-0x0000014D73F10000-0x0000014D73F4A000-memory.dmp
memory/4300-80-0x0000014D73FC0000-0x0000014D73FEA000-memory.dmp
memory/4300-75-0x0000014D73F60000-0x0000014D73F72000-memory.dmp
memory/4300-78-0x0000014D73F70000-0x0000014D73FBC000-memory.dmp
memory/4300-79-0x0000014D76A00000-0x0000014D76A4A000-memory.dmp
memory/5164-74-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5164-30-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5164-1-0x0000000000790000-0x0000000000C9A000-memory.dmp
memory/5164-2-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5164-4-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5164-0-0x00007FF8B85AF000-0x00007FF8B85B0000-memory.dmp
memory/5164-9-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5164-18-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp
memory/5780-234-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-232-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-228-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-226-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-225-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-222-0x0000000010410000-0x0000000010480000-memory.dmp
memory/5780-224-0x0000000010410000-0x0000000010480000-memory.dmp