cybergate | 5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Size

445KB
MD5

0ce08fd4c7c5add13722bb1e5bb4d781
SHA1

5a8eb705f97906d2cbda68d01b6627a8ac695278
SHA256

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106
SHA512

0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e
SSDEEP

6144:FxJsGLnl8StLmLeoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ:XJsG/mLe4h/xQp6+tqOYy9zo0

Score

10^/10

cybergate hack persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Hack

downsppp.no-ip.org:81

downsppp.no-ip.org:82

downsppp.no-ip.org:1117

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./
ftp_interval
30
injected_process
explorer.exe
install_dir
Microsoft
install_file
Pluguin.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Arquivo incompleto.
message_box_title
Erro
password
123
regkey_hkcu
Avirnt
regkey_hklm
Avgnt

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exePluguin.exePluguin.exe5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe

Executes dropped EXE 6 IoCs

Processes:

Pluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exe

pid process

3260 Pluguin.exe
2884 Pluguin.exe
2624 Pluguin.exe
4588 Pluguin.exe
3332 Pluguin.exe
3716 Pluguin.exe

pid	process
3260	Pluguin.exe
2884	Pluguin.exe
2624	Pluguin.exe
4588	Pluguin.exe
3332	Pluguin.exe
3716	Pluguin.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pluguin.exeexplorer.exePluguin.exe5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}\StubPath = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe Restart"	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KY5Y280B-VV17-4I28-K171-GW0AIXV3YV81}	Pluguin.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4960-133-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4960-138-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/1036-141-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/1036-144-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/2884-157-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4588-160-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/2624-165-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/3332-168-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/3332-170-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4588-169-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4588-173-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/3332-174-0x0000000024010000-0x0000000024070000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exePluguin.exePluguin.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Pluguin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Pluguin.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exeexplorer.exePluguin.exePluguin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe

Drops file in System32 directory 9 IoCs

Processes:

Pluguin.exe5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exePluguin.exePluguin.exePluguin.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4984 3332 WerFault.exe Pluguin.exe
3060 3716 WerFault.exe Pluguin.exe
Modifies registry class 1 IoCs

Processes:

Pluguin.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Pluguin.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Pluguin.exe

pid process

4588 Pluguin.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Pluguin.exe

description pid process

Token: SeDebugPrivilege 4588 Pluguin.exe
Token: SeDebugPrivilege 4588 Pluguin.exe

pid	pid_target	process	target process
4984	3332	WerFault.exe	Pluguin.exe
3060	3716	WerFault.exe	Pluguin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Pluguin.exe

pid	process
4588	Pluguin.exe

description	pid	process
Token: SeDebugPrivilege	4588	Pluguin.exe
Token: SeDebugPrivilege	4588	Pluguin.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exePluguin.exe

pid	process
4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
3260	Pluguin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe

description	pid	process	target process
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE
PID 4960 wrote to memory of 2640	4960	5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe
"C:\Users\Admin\AppData\Local\Temp\5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4960

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1036

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
PID:2624

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1004
6⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:3260

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
6⤵
- Executes dropped EXE
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 532
7⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3332 -ip 3332
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3716 -ip 3716
1⤵
PID:4612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
dda45d55e01ddcc69f5aefdd7d8091e9

SHA1
e23d1a63c7fe5e6d37ef4929f1c751d0791e65f6

SHA256
b856b810bbc054547d12bfb67948bb0744fb11ffef3a107fbbb29f4788934546

SHA512
a052f6c07335a13100708bbe9ff61e485fa8abb629f8305e3cd940053ad8480ce2bdb8de9854cf867e0fc04c60fd80278d417c1a0a9570d128ecce625a4fb799

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
1f5a3bdaefbc22bf661f07ab6477d82d

SHA1
f9b2c5e93b6277957d57c9292ef13574ac9ec514

SHA256
e40c1f4f131b68bc4bc62815dae17155ec656a9bf7844925400a29a069c66377

SHA512
7207cba0b9f0628a080598f4bbc24255d1c49165c6b728207e91262d4dc48be1d57dec36280a70a04c7d5118f3ac01285bf2c5b7324403b6a9b61ea39aaeefee

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
2c58e3513dc9febc651d44e345afabb4

SHA1
65531ad35cfbdbeb8555a1ce10139b4953c48e4d

SHA256
8555125d7f03d4d64c069bc2afa74b651a6e878d1245bb5cea7c38eaa16f3535

SHA512
b5a16876e22893324391f1f1ba672dc559d8a6192955ab6fe9c6e767cae0e4218cecc53105437c93a4e9ea4acac1ce537de712c891135c8b0b56fcf32e30c922

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
2c58e3513dc9febc651d44e345afabb4

SHA1
65531ad35cfbdbeb8555a1ce10139b4953c48e4d

SHA256
8555125d7f03d4d64c069bc2afa74b651a6e878d1245bb5cea7c38eaa16f3535

SHA512
b5a16876e22893324391f1f1ba672dc559d8a6192955ab6fe9c6e767cae0e4218cecc53105437c93a4e9ea4acac1ce537de712c891135c8b0b56fcf32e30c922

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
445KB

MD5
0ce08fd4c7c5add13722bb1e5bb4d781

SHA1
5a8eb705f97906d2cbda68d01b6627a8ac695278

SHA256
5d01d8b0d36d9be36ec82b72d05d46a248011549a600eb48fad92059d7993106

SHA512
0c667851c2e9d985979a24ed2f44afd8c6229b22636cd524ad61961f3fb672ca3fb46c882db4384c3dfce7663205ef9ba7cd85ac7f24ba3faf1c13d2d4b1289e

Download Submit
memory/1036-144-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/1036-141-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/1036-137-0x0000000000000000-mapping.dmp

Download
memory/2624-165-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/2624-150-0x0000000000000000-mapping.dmp

Download
memory/2884-147-0x0000000000000000-mapping.dmp

Download
memory/2884-157-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/3260-145-0x0000000000000000-mapping.dmp

Download
memory/3332-163-0x0000000000000000-mapping.dmp

Download
memory/3332-168-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/3332-170-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/3332-174-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/3716-171-0x0000000000000000-mapping.dmp

Download
memory/4588-160-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4588-155-0x0000000000000000-mapping.dmp

Download
memory/4588-169-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4588-173-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4960-133-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4960-138-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download