cybergate | b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Size

346KB
MD5

4ac582b0f68d0651ef5e13af76e0cff2
SHA1

0099f6b0482a328cf765941ae50d384be2fb4d80
SHA256

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d
SHA512

ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327
SSDEEP

6144:o57zUhoLM6ASK8E6chYRKvVB0rv46KTr9LYOEZrfatoD8HWlGcOnSQwnR8OV7I6Z:2KoL/K8E6chY5D46KTVYzRfRD82lGcOK

Score

10^/10

cybergate hacked persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

hacked

hoota.zapto.org:288

hoota.no-ip.org:288

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
%temp%.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
thise program can not start.tr34.dll is missing
message_box_title
rong
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Executes dropped EXE 3 IoCs

Processes:

%temp%.exe%temp%.exe%temp%.exe

pid process

468 %temp%.exe
628 %temp%.exe
1956 %temp%.exe

pid	process
468	%temp%.exe
628	%temp%.exe
1956	%temp%.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}\StubPath = "C:\\Windows\\install\\%temp%.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}\StubPath = "C:\\Windows\\install\\%temp%.exe Restart"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/596-90-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-95-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-93-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-101-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-102-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-103-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/596-105-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/596-114-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/600-119-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/600-122-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/596-124-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/596-136-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1948-135-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/596-130-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1948-138-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1956-198-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1956-199-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1948-200-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1948-201-0x0000000006C50000-0x0000000006CCB000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe%temp%.exe%temp%.exe

pid	process
1948	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
1948	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
468	%temp%.exe
628	%temp%.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe%temp%.exe%temp%.exe

description	pid	process	target process
PID 836 set thread context of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 set thread context of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 468 set thread context of 628	468	%temp%.exe	%temp%.exe
PID 628 set thread context of 1956	628	%temp%.exe	%temp%.exe

Drops file in Windows directory 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
File created	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe%temp%.exe

pid process

596 b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
1956 %temp%.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid process

1948 b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid	process
596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
1956	%temp%.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	pid	process
Token: SeDebugPrivilege	1948	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Token: SeDebugPrivilege	1948	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid process

596 b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid	process
596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	pid	process	target process
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 836 wrote to memory of 880	836	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 880 wrote to memory of 596	880	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 596 wrote to memory of 1268	596	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
  "C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
    C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
      C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Modifies Installed Components in the registry
        
        PID:600
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe"
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
      - C:\Windows\install\%temp%.exe
        
        "C:\Windows\install\%temp%.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:468
        
        C:\Windows\install\%temp%.exe
        
        C:\Windows\install\%temp%.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:628
        
        C:\Windows\install\%temp%.exe
        
        C:\Windows\install\%temp%.exe
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
7a7279f792cd2016b0e00d0af76db92c

SHA1
f0b791863ee22c1b1ae67a97499be31c29f994f5

SHA256
fcf7f149b92b548d7a260e76ab7eeabcbf2675ea5b84324093d22542c21121df

SHA512
1edd856b0f889c329550e05468574440ebb0429588257a9860183c38dabe209aa644f9bceaf282a2b7605e6e470870d65bb37b718ce7eab23c65b8b02c081156

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
memory/468-175-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/468-148-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/468-151-0x0000000000480000-0x00000000004FB000-memory.dmp

Filesize
492KB

Download
memory/468-141-0x0000000000000000-mapping.dmp

Download
memory/468-150-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/596-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-124-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/596-100-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/596-130-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/596-114-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/596-105-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/596-103-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-102-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-89-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-90-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-95-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-93-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-101-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/596-97-0x0000000000455C20-mapping.dmp

Download
memory/600-113-0x00000000746C1000-0x00000000746C3000-memory.dmp

Filesize
8KB

Download
memory/600-122-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/600-111-0x0000000000000000-mapping.dmp

Download
memory/600-119-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/628-194-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/628-181-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/628-180-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/628-172-0x0000000000468B23-mapping.dmp

Download
memory/836-58-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/836-59-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/836-61-0x0000000000230000-0x00000000002AB000-memory.dmp

Filesize
492KB

Download
memory/836-81-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/880-84-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/880-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-80-0x0000000000468B23-mapping.dmp

Download
memory/880-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-85-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/880-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/880-86-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/1268-108-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1948-146-0x0000000006C50000-0x0000000006CCB000-memory.dmp

Filesize
492KB

Download
memory/1948-144-0x0000000006C50000-0x0000000006CCB000-memory.dmp

Filesize
492KB

Download
memory/1948-137-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1948-138-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1948-135-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1948-128-0x0000000000000000-mapping.dmp

Download
memory/1948-200-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1948-201-0x0000000006C50000-0x0000000006CCB000-memory.dmp

Filesize
492KB

Download
memory/1956-191-0x0000000000455C20-mapping.dmp

Download
memory/1956-198-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1956-199-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download