cybergate | e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Size

1.2MB
MD5

0e86fb2120544989ae54edc86983bfed
SHA1

d2e5f4353494e2d99a9287e2f5d0e66d22955a92
SHA256

e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0
SHA512

8820b787e70af246255e68b9f8c8549a38d4fe6bf4e8586bdafbdc1fd970f94a1c6de3250babf97f2e3a6e206505538f1f3fbd27a21770b1e9f583afb92ff763
SSDEEP

24576:U4lavt0LkLL9IMixoEgea7xd6f/QDBFEjzFgzvDywupi25:jkwkn9IMHea7xmO78zuzA1

Score

10^/10

cybergate lammer persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

ipsx.no-ip.org:81

ipsx.no-ip.org:7000

ipsx.no-ip.org:2000

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./
ftp_interval
30
injected_process
explorer.exe
install_dir
Microsoft
install_file
Pluguin.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
message_box_title
LAMMER
password
qwerty
regkey_hkcu
Avirnt
regkey_hklm
Avgnt

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Executes dropped EXE 2 IoCs

pid	Process
4912	Pluguin.exe
1388	Pluguin.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{10XMQ502-48SQ-62BJ-1PEO-DP7460R664P6}	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10XMQ502-48SQ-62BJ-1PEO-DP7460R664P6}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe Restart"	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{10XMQ502-48SQ-62BJ-1PEO-DP7460R664P6}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10XMQ502-48SQ-62BJ-1PEO-DP7460R664P6}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4820-138-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4820-143-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/3984-146-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/3984-147-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/4820-151-0x00000000240D0000-0x0000000024130000-memory.dmp	upx
behavioral2/memory/4820-156-0x0000000024130000-0x0000000024190000-memory.dmp	upx
behavioral2/memory/3068-159-0x0000000024130000-0x0000000024190000-memory.dmp	upx
behavioral2/memory/3068-161-0x0000000024130000-0x0000000024190000-memory.dmp	upx
behavioral2/memory/3984-164-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/3068-165-0x0000000024130000-0x0000000024190000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0006000000022f85-149.dat	autoit_exe
behavioral2/files/0x0006000000022f85-163.dat	autoit_exe
behavioral2/files/0x0006000000022f85-168.dat	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 4912 set thread context of 1388	4912	Pluguin.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3068	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
Token: SeDebugPrivilege	3068	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe
4912	Pluguin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 1792 wrote to memory of 4820	1792	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	88
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49
PID 4820 wrote to memory of 3032	4820	e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe	49

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3032
- C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
  "C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
    "C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:3984
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe
      "C:\Users\Admin\AppData\Local\Temp\e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3068
    - - C:\Windows\SysWOW64\Microsoft\Pluguin.exe
        
        "C:\Windows\system32\Microsoft\Pluguin.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4912
      - C:\Windows\SysWOW64\Microsoft\Pluguin.exe
        
        "C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
        6⤵
        Executes dropped EXE
        
        PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
221KB

MD5
801429de05504a323d188acda5244adf

SHA1
6a6b8f639d244c590741bf804366484f842df2b2

SHA256
dc2aed07a7b10bc0ff5d5f727c710335481d170ead9c9d8f0928de457e7ca645

SHA512
c10599c58bab7800f5c06ac803beb9169dadd7d801e85791c3956e88bfe59d031c86108d1876c894e7188312e6bed48d3be19ddaa8ad61e2982d4c12d6553d85

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe

Filesize
1.2MB

MD5
0e86fb2120544989ae54edc86983bfed

SHA1
d2e5f4353494e2d99a9287e2f5d0e66d22955a92

SHA256
e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0

SHA512
8820b787e70af246255e68b9f8c8549a38d4fe6bf4e8586bdafbdc1fd970f94a1c6de3250babf97f2e3a6e206505538f1f3fbd27a21770b1e9f583afb92ff763

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe

Filesize
1.2MB

MD5
0e86fb2120544989ae54edc86983bfed

SHA1
d2e5f4353494e2d99a9287e2f5d0e66d22955a92

SHA256
e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0

SHA512
8820b787e70af246255e68b9f8c8549a38d4fe6bf4e8586bdafbdc1fd970f94a1c6de3250babf97f2e3a6e206505538f1f3fbd27a21770b1e9f583afb92ff763

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe

Filesize
1.2MB

MD5
0e86fb2120544989ae54edc86983bfed

SHA1
d2e5f4353494e2d99a9287e2f5d0e66d22955a92

SHA256
e22f93f07544b0f475c263e30eb420c1aa3823264df3a6715aa6e33cfdf5dbb0

SHA512
8820b787e70af246255e68b9f8c8549a38d4fe6bf4e8586bdafbdc1fd970f94a1c6de3250babf97f2e3a6e206505538f1f3fbd27a21770b1e9f583afb92ff763

Download Submit
memory/1388-172-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1388-171-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1388-170-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3068-161-0x0000000024130000-0x0000000024190000-memory.dmp

Filesize
384KB

Download
memory/3068-165-0x0000000024130000-0x0000000024190000-memory.dmp

Filesize
384KB

Download
memory/3068-159-0x0000000024130000-0x0000000024190000-memory.dmp

Filesize
384KB

Download
memory/3984-146-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/3984-164-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/3984-147-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/4820-151-0x00000000240D0000-0x0000000024130000-memory.dmp

Filesize
384KB

Download
memory/4820-160-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4820-156-0x0000000024130000-0x0000000024190000-memory.dmp

Filesize
384KB

Download
memory/4820-143-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/4820-138-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4820-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4820-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4820-134-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4820-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads