cybergate | eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

Analysis

max time kernel
172s
max time network
90s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Size

395KB
MD5

10e4fe8bc54efabeb33e4692bb38a394
SHA1

c43c715027e6b79a6b47e6bab0ef57ced936ca1e
SHA256

eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62
SHA512

109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c
SSDEEP

12288:RZ7qxcff2f1yjyF267r98e+4nkCcE7DclcM:RZmGfOfPr98h4kCcaIp

Score

10^/10

cybergate hahaha persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

hahaha

bncinvadiu.no-ip.org:2000

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
msn.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\msn.exe"	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\msn.exe"	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Executes dropped EXE 2 IoCs

pid	Process
900	msn.exe
1720	msn.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A70TTWDH-ODJS-AFG1-JUJ5-03P55X862BX7}	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A70TTWDH-ODJS-AFG1-JUJ5-03P55X862BX7}\StubPath = "C:\\Windows\\system32\\install\\msn.exe Restart"	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A70TTWDH-ODJS-AFG1-JUJ5-03P55X862BX7}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A70TTWDH-ODJS-AFG1-JUJ5-03P55X862BX7}\StubPath = "C:\\Windows\\system32\\install\\msn.exe"	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1108-70-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1108-79-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1732-84-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1732-87-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1108-89-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1108-95-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/592-100-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/592-103-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/592-120-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
592	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
592	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\msn.exe"	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\msn.exe"	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\msn.exe	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
File opened for modification	C:\Windows\SysWOW64\install\msn.exe	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
File opened for modification	C:\Windows\SysWOW64\install\msn.exe	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
File opened for modification	C:\Windows\SysWOW64\install\	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
File opened for modification	C:\Windows\SysWOW64\install\msn.exe	msn.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1864 set thread context of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 900 set thread context of 1720	900	msn.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
592	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
Token: SeDebugPrivilege	592	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
900	msn.exe
1720	msn.exe
1720	msn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1584 wrote to memory of 1864	1584	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	28
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1864 wrote to memory of 1108	1864	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	29
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15
PID 1108 wrote to memory of 1256	1108	eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe	15

C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
"C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
  "C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
    "C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:1732
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe
      "C:\Users\Admin\AppData\Local\Temp\eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62.exe"
      4⤵
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:592
    - - C:\Windows\SysWOW64\install\msn.exe
        
        "C:\Windows\system32\install\msn.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:900
      - C:\Windows\SysWOW64\install\msn.exe
        
        "C:\Windows\SysWOW64\install\msn.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
0ad153f7c2a45f0fa601691c7ec8bfae

SHA1
e147593930a2d010b4b53435468948347e331ca2

SHA256
4960bc622e07988ee5d3477baa6bf59130e21208016bf5a8a92091202ca91eac

SHA512
8c908ca3f831b9addd0e0afeb4252f4aca70791ed5aaa6b89bc0f35dbe2ea4cc80494ee0fce66edbe9671e5f0e8d5e9e3cf0cd8bf7252d8ed0b17a4a7e0133bd

Download Submit
C:\Windows\SysWOW64\install\msn.exe

Filesize
395KB

MD5
10e4fe8bc54efabeb33e4692bb38a394

SHA1
c43c715027e6b79a6b47e6bab0ef57ced936ca1e

SHA256
eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

SHA512
109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c

Download Submit
C:\Windows\SysWOW64\install\msn.exe

Filesize
395KB

MD5
10e4fe8bc54efabeb33e4692bb38a394

SHA1
c43c715027e6b79a6b47e6bab0ef57ced936ca1e

SHA256
eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

SHA512
109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c

Download Submit
C:\Windows\SysWOW64\install\msn.exe

Filesize
395KB

MD5
10e4fe8bc54efabeb33e4692bb38a394

SHA1
c43c715027e6b79a6b47e6bab0ef57ced936ca1e

SHA256
eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

SHA512
109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c

Download Submit
\Windows\SysWOW64\install\msn.exe

Filesize
395KB

MD5
10e4fe8bc54efabeb33e4692bb38a394

SHA1
c43c715027e6b79a6b47e6bab0ef57ced936ca1e

SHA256
eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

SHA512
109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c

Download Submit
\Windows\SysWOW64\install\msn.exe

Filesize
395KB

MD5
10e4fe8bc54efabeb33e4692bb38a394

SHA1
c43c715027e6b79a6b47e6bab0ef57ced936ca1e

SHA256
eb05698f699ca9ba9956b1ec5ad8e39f1a5a4ee7950e42976bb0fdf0933f6f62

SHA512
109e54a744f06e523e0200671f12bc585170ce5f0fdf7e3212279c0ac0d17391411644ff19af90e81e37966a2e96be7da5740ee199c6a2692e0868241f22792c

Download Submit
memory/592-120-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/592-117-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/592-103-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/592-102-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/592-100-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/900-114-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1108-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1108-70-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1108-79-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1108-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1108-89-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1108-66-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1108-95-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1108-101-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1108-67-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1108-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1256-73-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1584-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1720-118-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1720-119-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1732-84-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1732-87-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1732-78-0x0000000074EA1000-0x0000000074EA3000-memory.dmp

Filesize
8KB

Download
memory/1864-65-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1864-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download