cybergate | 55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

General

Target

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Size

320KB
MD5

b86e4f43915a2dc9e037d2bd2b7f2389
SHA1

14016f5543b76ff757fff046ab0c8019d51b2f71
SHA256

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25
SHA512

2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79
SSDEEP

6144:5dEfA9ko2WlVAsCSGU+JDse9B1lLgjPrmU7gV4UVevTUBebvBg+ySLY:MQAsC97ssYzmOAerdVg+BLY

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Victima

C2

goldemadbeta.zapto.org:4662

Mutex

5BAA46377XH6LI

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system
install_file
windll.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Este archivo No se ha descargado Completamente, Vuelva a descargarlo
message_box_title
Error
password
123456
regkey_hkcu
ctfmon
regkey_hklm
ctfmon

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system\\windll.exe"	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system\\windll.exe"	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Executes dropped EXE 2 IoCs

Processes:

windll.exewindll.exe

pid process

1572 windll.exe
1764 windll.exe

pid	process
1572	windll.exe
1764	windll.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04130111-363S-35CJ-OB4I-UX2672WR1I76}\StubPath = "C:\\Windows\\system32\\system\\windll.exe Restart"	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{04130111-363S-35CJ-OB4I-UX2672WR1I76}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{04130111-363S-35CJ-OB4I-UX2672WR1I76}\StubPath = "C:\\Windows\\system32\\system\\windll.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{04130111-363S-35CJ-OB4I-UX2672WR1I76}	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1780-72-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/1780-81-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/268-86-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/268-89-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1780-91-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral1/memory/1780-97-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1960-102-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1960-104-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1960-128-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid	process
1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\system32\\system\\windll.exe"	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\system32\\system\\windll.exe"	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Drops file in System32 directory 4 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

description	ioc	process
File created	C:\Windows\SysWOW64\system\windll.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
File opened for modification	C:\Windows\SysWOW64\system\windll.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
File opened for modification	C:\Windows\SysWOW64\system\windll.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
File opened for modification	C:\Windows\SysWOW64\system\	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exewindll.exe

description	pid	process	target process
PID 1404 set thread context of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1572 set thread context of 1764	1572	windll.exe	windll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid process

1780 55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid process

1960 55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid	process
1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exe55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

description	pid	process
Token: SeBackupPrivilege	268	explorer.exe
Token: SeRestorePrivilege	268	explorer.exe
Token: SeBackupPrivilege	1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Token: SeRestorePrivilege	1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Token: SeDebugPrivilege	1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Token: SeDebugPrivilege	1960	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid process

1780 55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exewindll.exe

pid process

1404 55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
1572 windll.exe

pid	process
1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

pid	process
1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
1572	windll.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe

description	pid	process	target process
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1404 wrote to memory of 1780	1404	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE
PID 1780 wrote to memory of 1224	1780	55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
"C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
"C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe"
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2016

C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe
"C:\Users\Admin\AppData\Local\Temp\55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25.exe"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\system\windll.exe
"C:\Windows\system32\system\windll.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Windows\SysWOW64\system\windll.exe
"C:\Windows\SysWOW64\system\windll.exe"
6⤵
- Executes dropped EXE
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
3ddfbc5fe28e55a6400df54fa0ed45a5

SHA1
f0951e770f7ec228ed58cfd1925c9196942da4a6

SHA256
c0dd1f6fa8aa0b215c97941877b37614965d2f9eff5ff69185eddb4fa700580f

SHA512
a4b0ef2e2b65bf075d6a7cb2f973ee70a771a1cb19d0bee9229c2cde9686400758f6d0e48e98966e72e4691107d1ebbee412ad0578b542e4bab38857ac03d4f1

Download Submit
C:\Windows\SysWOW64\system\windll.exe
Filesize
320KB

MD5
b86e4f43915a2dc9e037d2bd2b7f2389

SHA1
14016f5543b76ff757fff046ab0c8019d51b2f71

SHA256
55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

SHA512
2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79

Download Submit
C:\Windows\SysWOW64\system\windll.exe
Filesize
320KB

MD5
b86e4f43915a2dc9e037d2bd2b7f2389

SHA1
14016f5543b76ff757fff046ab0c8019d51b2f71

SHA256
55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

SHA512
2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79

Download Submit
C:\Windows\SysWOW64\system\windll.exe
Filesize
320KB

MD5
b86e4f43915a2dc9e037d2bd2b7f2389

SHA1
14016f5543b76ff757fff046ab0c8019d51b2f71

SHA256
55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

SHA512
2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79

Download Submit
\Windows\SysWOW64\system\windll.exe
Filesize
320KB

MD5
b86e4f43915a2dc9e037d2bd2b7f2389

SHA1
14016f5543b76ff757fff046ab0c8019d51b2f71

SHA256
55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

SHA512
2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79

Download Submit
\Windows\SysWOW64\system\windll.exe
Filesize
320KB

MD5
b86e4f43915a2dc9e037d2bd2b7f2389

SHA1
14016f5543b76ff757fff046ab0c8019d51b2f71

SHA256
55cea9e978b0d4009a7d8a66f71bf0223038d3747ca595ec028e815d546e2a25

SHA512
2f288b12374f43c91b3528b080a6fe51960fce661ec8e44d5af80e4e5ba8b54f5d3eb2384ef7c951c7820bdec92ce989669a8342196b23ccb065c2efc6bd7c79

Download Submit
memory/268-78-0x0000000000000000-mapping.dmp

Download
memory/268-86-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/268-80-0x00000000747F1000-0x00000000747F3000-memory.dmp

Filesize
8KB

Download
memory/268-89-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1224-75-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1572-107-0x0000000000000000-mapping.dmp

Download
memory/1764-121-0x000000000040E1A8-mapping.dmp

Download
memory/1764-125-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1764-126-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1764-127-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-67-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-63-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-72-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1780-70-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-69-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-68-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1780-91-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1780-60-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-97-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1780-103-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-59-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-61-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-66-0x000000000040E1A8-mapping.dmp

Download
memory/1780-65-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-57-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1780-81-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1780-62-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1960-104-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1960-102-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1960-95-0x0000000000000000-mapping.dmp

Download
memory/1960-128-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads