cybergate | b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Size

346KB
MD5

4ac582b0f68d0651ef5e13af76e0cff2
SHA1

0099f6b0482a328cf765941ae50d384be2fb4d80
SHA256

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d
SHA512

ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327
SSDEEP

6144:o57zUhoLM6ASK8E6chYRKvVB0rv46KTr9LYOEZrfatoD8HWlGcOnSQwnR8OV7I6Z:2KoL/K8E6chY5D46KTVYzRfRD82lGcOK

Score

10^/10

cybergate hacked persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

hacked

hoota.zapto.org:288

hoota.no-ip.org:288

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
%temp%.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
thise program can not start.tr34.dll is missing
message_box_title
rong
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Executes dropped EXE 3 IoCs

Processes:

%temp%.exe%temp%.exe%temp%.exe

pid process

1856 %temp%.exe
4420 %temp%.exe
600 %temp%.exe

pid	process
1856	%temp%.exe
4420	%temp%.exe
600	%temp%.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}\StubPath = "C:\\Windows\\install\\%temp%.exe Restart"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8080HLP1-515E-V0O4-705J-004VQMOSM087}\StubPath = "C:\\Windows\\install\\%temp%.exe"	explorer.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2192-155-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-156-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-157-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-161-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-162-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-163-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2192-165-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/2192-170-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3916-173-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3916-174-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2192-178-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/2192-183-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2616-186-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2192-187-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/2616-189-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/600-223-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/600-224-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/600-225-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3916-226-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/600-227-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\%temp%.exe"	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe%temp%.exe%temp%.exe

description	pid	process	target process
PID 4552 set thread context of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 set thread context of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1856 set thread context of 4420	1856	%temp%.exe	%temp%.exe
PID 4420 set thread context of 600	4420	%temp%.exe	%temp%.exe

Drops file in Windows directory 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
File created	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\%temp%.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
File opened for modification	C:\Windows\install\	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe%temp%.exe

pid	process
2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
600	%temp%.exe
600	%temp%.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid process

2616 b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid	process
2616	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	pid	process
Token: SeDebugPrivilege	2616	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
Token: SeDebugPrivilege	2616	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

pid process

2192 b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exeb2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe

description	pid	process	target process
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 4552 wrote to memory of 1368	4552	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 1368 wrote to memory of 2192	1368	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE
PID 2192 wrote to memory of 968	2192	b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:968
- C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
  "C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
    C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
      C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Modifies Installed Components in the registry
        
        PID:3916
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d.exe"
        5⤵
        Checks computer location settings
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
      - C:\Windows\install\%temp%.exe
        
        "C:\Windows\install\%temp%.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1856
        
        C:\Windows\install\%temp%.exe
        
        C:\Windows\install\%temp%.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4420
        
        C:\Windows\install\%temp%.exe
        
        C:\Windows\install\%temp%.exe
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
7a7279f792cd2016b0e00d0af76db92c

SHA1
f0b791863ee22c1b1ae67a97499be31c29f994f5

SHA256
fcf7f149b92b548d7a260e76ab7eeabcbf2675ea5b84324093d22542c21121df

SHA512
1edd856b0f889c329550e05468574440ebb0429588257a9860183c38dabe209aa644f9bceaf282a2b7605e6e470870d65bb37b718ce7eab23c65b8b02c081156

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
C:\Windows\install\%temp%.exe

Filesize
346KB

MD5
4ac582b0f68d0651ef5e13af76e0cff2

SHA1
0099f6b0482a328cf765941ae50d384be2fb4d80

SHA256
b2da4b954666148b9d4a528175842262e4d8c968af7ce9b49269dec632dbac9d

SHA512
ae4ef49f9a496ae6ae71e7bc4fc485aa0cc0c159eb4bfcbe71887b7f3345f829ce0e1bfd4c0913b8860dbb80dda0058a131a77a64a4f934d9dec4d8698488327

Download Submit
memory/600-225-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/600-227-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/600-215-0x0000000000000000-mapping.dmp

Download
memory/600-223-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/600-224-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1368-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-143-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-144-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-148-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-150-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/1368-151-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/1368-149-0x0000000000462000-0x0000000000463000-memory.dmp

Filesize
4KB

Download
memory/1368-152-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-153-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-146-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-142-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-160-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-135-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1368-134-0x0000000000000000-mapping.dmp

Download
memory/1856-190-0x0000000000000000-mapping.dmp

Download
memory/1856-192-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1856-193-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/1856-207-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2192-178-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/2192-165-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/2192-163-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-155-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-156-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-183-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2192-157-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-187-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-154-0x0000000000000000-mapping.dmp

Download
memory/2192-161-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2192-170-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2192-162-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2616-182-0x0000000000000000-mapping.dmp

Download
memory/2616-186-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2616-189-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2616-188-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3916-226-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3916-173-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3916-174-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3916-169-0x0000000000000000-mapping.dmp

Download
memory/4420-213-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4420-222-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4420-211-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4420-209-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4420-194-0x0000000000000000-mapping.dmp

Download
memory/4552-132-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4552-147-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4552-133-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download