cybergate | db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1

Analysis

max time kernel
151s
max time network
64s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Size

472KB
MD5

78fbe923f18ef15502eb291f8f59b8b8
SHA1

847ec0db408043ae272120a1f711685e2b681e60
SHA256

db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1
SHA512

350a731925a33478768dedf2695c5eb81344ad5834e2daf0ce29b9c9e5e99656e6f9495f0a86f1ebeacb97b87a7f10ad4312ebc4febc2ca73a8861a566b3a472
SSDEEP

6144:hAk4qmrpOFRnTV2iqefCQWR7WSDuBMLPb8FEyj21M163E4H9/:F9B2r2LSDuOEEyj21Q63B

Score

10^/10

cybergate ôçê ãóäìñ çáßáè persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÔÇÊ ãÓäÌÑ ÇáßáÈ

dardesh.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
services.exe
install_file
sse.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
t?tulo da mensagem
password
123451
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\sse.exe"	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\sse.exe"	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	sse.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{05BHQ5YA-PD07-43XT-6FE8-K08646JR38A5}	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05BHQ5YA-PD07-43XT-6FE8-K08646JR38A5}\StubPath = "C:\\Windows\\system32\\sse.exe Restart"	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{05BHQ5YA-PD07-43XT-6FE8-K08646JR38A5}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05BHQ5YA-PD07-43XT-6FE8-K08646JR38A5}\StubPath = "C:\\Windows\\system32\\sse.exe"	explorer.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1492-55-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1492-57-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1492-66-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/276-71-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/files/0x000500000000b2d2-73.dat	upx
behavioral1/memory/276-74-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1492-76-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/932-83-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1492-84-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1492-90-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/932-89-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/files/0x000500000000b2d2-135.dat	upx
behavioral1/files/0x000500000000b2d2-136.dat	upx
behavioral1/files/0x000500000000b2d2-138.dat	upx
behavioral1/memory/276-140-0x00000000318E0000-0x00000000318ED000-memory.dmp	upx
behavioral1/memory/932-142-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1960-143-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1960-147-0x0000000031900000-0x000000003190D000-memory.dmp	upx
behavioral1/memory/1960-148-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1960-149-0x0000000031900000-0x000000003190D000-memory.dmp	upx
behavioral1/memory/932-151-0x00000000066C0000-0x0000000006736000-memory.dmp	upx
behavioral1/memory/276-150-0x00000000318E0000-0x00000000318ED000-memory.dmp	upx
behavioral1/memory/932-152-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\sse.exe"	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\sse.exe"	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sse.exe	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
File opened for modification	C:\Windows\SysWOW64\	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
File created	C:\Windows\SysWOW64\sse.exe	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
File opened for modification	C:\Windows\SysWOW64\sse.exe	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
Token: SeDebugPrivilege	932	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12
PID 1492 wrote to memory of 1424	1492	db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe	12

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:968
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1480
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1280
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1048
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:456
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:880
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:2012
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:764
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1424
- C:\Users\Admin\AppData\Local\Temp\db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
  "C:\Users\Admin\AppData\Local\Temp\db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:276
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe
    "C:\Users\Admin\AppData\Local\Temp\db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:932
  - - C:\Windows\SysWOW64\sse.exe
      "C:\Windows\system32\sse.exe"
      4⤵
      Executes dropped EXE
      PID:1960

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
59b2b010d57db61e5845f2f3e5e17ae1

SHA1
f624f5112ead7bebf13c221e25b79356be96ae5e

SHA256
05e245e8dd3162b4cd190d03f758b701dc702be55caea0d5d82bb1bf416bf272

SHA512
6aaab4ac437ab76b94077fe215c4567917d607a7746a7506e577fd6896209ea14eff0bd8c890c5bf3a1cf006a35546309517fc17e4cab7d0f6d287cd9a2177fd

Download Submit
C:\Windows\SysWOW64\sse.exe

Filesize
472KB

MD5
78fbe923f18ef15502eb291f8f59b8b8

SHA1
847ec0db408043ae272120a1f711685e2b681e60

SHA256
db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1

SHA512
350a731925a33478768dedf2695c5eb81344ad5834e2daf0ce29b9c9e5e99656e6f9495f0a86f1ebeacb97b87a7f10ad4312ebc4febc2ca73a8861a566b3a472

Download Submit
C:\Windows\SysWOW64\sse.exe

Filesize
472KB

MD5
78fbe923f18ef15502eb291f8f59b8b8

SHA1
847ec0db408043ae272120a1f711685e2b681e60

SHA256
db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1

SHA512
350a731925a33478768dedf2695c5eb81344ad5834e2daf0ce29b9c9e5e99656e6f9495f0a86f1ebeacb97b87a7f10ad4312ebc4febc2ca73a8861a566b3a472

Download Submit
\Windows\SysWOW64\sse.exe

Filesize
472KB

MD5
78fbe923f18ef15502eb291f8f59b8b8

SHA1
847ec0db408043ae272120a1f711685e2b681e60

SHA256
db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1

SHA512
350a731925a33478768dedf2695c5eb81344ad5834e2daf0ce29b9c9e5e99656e6f9495f0a86f1ebeacb97b87a7f10ad4312ebc4febc2ca73a8861a566b3a472

Download Submit
\Windows\SysWOW64\sse.exe

Filesize
472KB

MD5
78fbe923f18ef15502eb291f8f59b8b8

SHA1
847ec0db408043ae272120a1f711685e2b681e60

SHA256
db5c56922ce073f44f39dad675bee32140eac3360ed3864453d09b772e7f04e1

SHA512
350a731925a33478768dedf2695c5eb81344ad5834e2daf0ce29b9c9e5e99656e6f9495f0a86f1ebeacb97b87a7f10ad4312ebc4febc2ca73a8861a566b3a472

Download Submit
memory/260-91-0x0000000031770000-0x000000003177D000-memory.dmp

Filesize
52KB

Download
memory/276-150-0x00000000318E0000-0x00000000318ED000-memory.dmp

Filesize
52KB

Download
memory/276-140-0x00000000318E0000-0x00000000318ED000-memory.dmp

Filesize
52KB

Download
memory/276-65-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/276-71-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/276-74-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/932-142-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/932-83-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/932-152-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/932-151-0x00000000066C0000-0x0000000006736000-memory.dmp

Filesize
472KB

Download
memory/932-89-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/932-141-0x00000000066C0000-0x0000000006736000-memory.dmp

Filesize
472KB

Download
memory/1424-60-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1492-57-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1492-66-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1492-82-0x0000000000480000-0x00000000004F6000-memory.dmp

Filesize
472KB

Download
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-76-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1492-90-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1492-55-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1492-84-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1960-143-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1960-147-0x0000000031900000-0x000000003190D000-memory.dmp

Filesize
52KB

Download
memory/1960-148-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1960-149-0x0000000031900000-0x000000003190D000-memory.dmp

Filesize
52KB

Download