cybergate | e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

General

Target

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Size

334KB
MD5

027bfefca562470107ba1a45b9037c16
SHA1

e3c508fa63b5df2420a750cf198f6862311ca400
SHA256

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755
SHA512

6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e
SSDEEP

6144:2I91jrxoMg+ozTEUvX2WEfd+3Un9KF/4CpPgQeMF+:3tbg7TvRId1PCpPgQeMg

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victima

C2

85.137.57.212:58

Mutex

adobe.exe

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./www/logs/
ftp_interval
5
injected_process
explorer.exe
install_dir
Adobe
install_file
adobe.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
El archivo amtlib.dll no está instalado en el sistema.
message_box_title
Error de DLL
password
159951
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Adobe\\adobe.exe"	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Adobe\\adobe.exe"	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

Executes dropped EXE 2 IoCs

Processes:

adobe.exeadobe.exe

pid process

860 adobe.exe
1584 adobe.exe

pid	process
860	adobe.exe
1584	adobe.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA24AR54-1T21-VVWT-S21U-J1508T24SICI}	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA24AR54-1T21-VVWT-S21U-J1508T24SICI}\StubPath = "C:\\Windows\\Adobe\\adobe.exe Restart"	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA24AR54-1T21-VVWT-S21U-J1508T24SICI}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA24AR54-1T21-VVWT-S21U-J1508T24SICI}\StubPath = "C:\\Windows\\Adobe\\adobe.exe"	explorer.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1432-57-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1432-62-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1432-63-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1432-64-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1432-66-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1432-75-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1296-80-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1296-81-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1432-83-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1432-91-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1432-97-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2020-96-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/2020-99-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/2020-107-0x0000000005B10000-0x0000000005B20000-memory.dmp	upx
behavioral1/memory/1296-109-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2020-110-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1584-117-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1584-118-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1584-119-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1584-120-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

pid	process
2020	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
2020	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Adobe\\adobe.exe"	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Adobe\\adobe.exe"	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exeadobe.exe

description	pid	process	target process
PID 1428 set thread context of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 860 set thread context of 1584	860	adobe.exe	adobe.exe

Drops file in Windows directory 5 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exee36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exeadobe.exe

description	ioc	process
File created	C:\Windows\Adobe\adobe.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
File opened for modification	C:\Windows\Adobe\adobe.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
File opened for modification	C:\Windows\Adobe\adobe.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
File opened for modification	C:\Windows\Adobe\	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
File opened for modification	C:\Windows\Adobe\adobe.exe	adobe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exeadobe.exe

pid process

1432 e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
1584 adobe.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

pid process

2020 e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

pid	process
1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
1584	adobe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

description	pid	process
Token: SeDebugPrivilege	2020	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Token: SeDebugPrivilege	2020	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

pid process

1432 e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exeadobe.exe

pid process

1428 e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
860 adobe.exe

pid	process
1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

pid	process
1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
860	adobe.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exee36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe

description	pid	process	target process
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1428 wrote to memory of 1432	1428	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE
PID 1432 wrote to memory of 1232	1432	e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
"C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
"C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe"
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:1296

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1528

C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
"C:\Users\Admin\AppData\Local\Temp\e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe"
4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\Adobe\adobe.exe
"C:\Windows\Adobe\adobe.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:860

C:\Windows\Adobe\adobe.exe
"C:\Windows\Adobe\adobe.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
76a02063935f727ae45bed918b1bc30e

SHA1
9de8b33cda027b15e4c67eb64958208aac79323d

SHA256
0ba41bcc1a5fc3b8fb370fc96a34726feb3005630d8487c5ce49d44cf7b1b7a0

SHA512
916f1f12ed9f6d05fe037627eb4700e9341e27d544e55cf6b95dbb8b38c5097146e65483ea1850ec3ec6f85ecf566a87ddf1082d5011740bcf087d0b6519ad66

Download Submit
C:\Windows\Adobe\adobe.exe
Filesize
334KB

MD5
027bfefca562470107ba1a45b9037c16

SHA1
e3c508fa63b5df2420a750cf198f6862311ca400

SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e

Download Submit
C:\Windows\Adobe\adobe.exe
Filesize
334KB

MD5
027bfefca562470107ba1a45b9037c16

SHA1
e3c508fa63b5df2420a750cf198f6862311ca400

SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e

Download Submit
C:\Windows\Adobe\adobe.exe
Filesize
334KB

MD5
027bfefca562470107ba1a45b9037c16

SHA1
e3c508fa63b5df2420a750cf198f6862311ca400

SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e

Download Submit
\Windows\Adobe\adobe.exe
Filesize
334KB

MD5
027bfefca562470107ba1a45b9037c16

SHA1
e3c508fa63b5df2420a750cf198f6862311ca400

SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e

Download Submit
\Windows\Adobe\adobe.exe
Filesize
334KB

MD5
027bfefca562470107ba1a45b9037c16

SHA1
e3c508fa63b5df2420a750cf198f6862311ca400

SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755

SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e

Download Submit
memory/860-114-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/860-108-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/860-102-0x0000000000000000-mapping.dmp

Download
memory/1232-69-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1296-72-0x0000000000000000-mapping.dmp

Download
memory/1296-109-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1296-80-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1296-81-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1296-74-0x0000000074561000-0x0000000074563000-memory.dmp

Filesize
8KB

Download
memory/1428-56-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1428-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1432-63-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1432-62-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1432-91-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1432-97-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1432-75-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1432-83-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1432-66-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1432-64-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1432-57-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1432-61-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1432-58-0x0000000000455C00-mapping.dmp

Download
memory/1584-117-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1584-118-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1584-119-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1584-120-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1584-112-0x0000000000455C00-mapping.dmp

Download
memory/2020-99-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2020-110-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2020-107-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download
memory/2020-106-0x0000000005B10000-0x0000000005B20000-memory.dmp

Filesize
64KB

Download
memory/2020-87-0x0000000000000000-mapping.dmp

Download
memory/2020-98-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2020-96-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads