cybergate | 15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Size

561KB
MD5

a378454e67d8cee3f1f3a2625b7d017e
SHA1

b5510f1092e2555ccba3a89d0086c0f722a1b317
SHA256

15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a
SHA512

d9dd64f478af755b8e211b9a6830ef398fa2266907ed5a209695fc3c2908f0fafbeb0794b5854e16f2a54f3ee2806efb50915c672f9eaf300858f65d4829143f
SSDEEP

6144:wVFn8bZv96J7r0+RVgJ/ZzZl9SgLE7fEkwN5QOUqwMhV9JUdPpZGpzG3ON0a76oc:wV2Nv96l9CRzn4Lckwws3ngfvM6

Score

10^/10

cybergate vítima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

zabzab.no-ip.biz:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
140208
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe

Executes dropped EXE 2 IoCs

pid	Process
4256	server.exe
4348	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7T15357K-536L-5O4V-K45K-KM32L37E5682}	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7T15357K-536L-5O4V-K45K-KM32L37E5682}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7T15357K-536L-5O4V-K45K-KM32L37E5682}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7T15357K-536L-5O4V-K45K-KM32L37E5682}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3632-134-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3632-136-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3632-138-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3632-139-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3632-141-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3632-146-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3672-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3672-150-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3632-155-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/3632-159-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3228-160-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4348-168-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4348-169-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4348-171-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4348-172-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/3672-173-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3228-174-0x00000000240F0000-0x0000000024152000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\	explorer.exe
File created	C:\Windows\SysWOW64\install\server.exe	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4592 set thread context of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4256 set thread context of 4348	4256	server.exe	93

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
File created	C:\Windows\assembly\Desktop.ini	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
4348	server.exe
4348	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3228	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Token: 33	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Token: SeIncBasePriorityPrivilege	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
Token: SeDebugPrivilege	3228	explorer.exe
Token: SeDebugPrivilege	3228	explorer.exe
Token: SeDebugPrivilege	4256	server.exe
Token: 33	4256	server.exe
Token: SeIncBasePriorityPrivilege	4256	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 4592 wrote to memory of 3632	4592	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	86
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29
PID 3632 wrote to memory of 3048	3632	15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048
- C:\Users\Admin\AppData\Local\Temp\15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
  "C:\Users\Admin\AppData\Local\Temp\15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe
    "C:\Users\Admin\AppData\Local\Temp\15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:3672
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3228
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
      - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\SysWOW64\install\server.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
4f4d4eebb7e07beac522f38f059ebd04

SHA1
da90a001ce97f17f44200ad43e6604d64754ad48

SHA256
44b0e6bab2ababcd5380543c257d6a0f0795c2ee8f1fe3c09eec19fe22666b93

SHA512
69281100094d48a5b89fba4b115b531df6eca0e333a2f3eacdc51604b6fa0549645e47d18ec94fc074f747dc73be14837d5582bba61c62bd2205e7d9bdf802fb

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
561KB

MD5
a378454e67d8cee3f1f3a2625b7d017e

SHA1
b5510f1092e2555ccba3a89d0086c0f722a1b317

SHA256
15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a

SHA512
d9dd64f478af755b8e211b9a6830ef398fa2266907ed5a209695fc3c2908f0fafbeb0794b5854e16f2a54f3ee2806efb50915c672f9eaf300858f65d4829143f

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
561KB

MD5
a378454e67d8cee3f1f3a2625b7d017e

SHA1
b5510f1092e2555ccba3a89d0086c0f722a1b317

SHA256
15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a

SHA512
d9dd64f478af755b8e211b9a6830ef398fa2266907ed5a209695fc3c2908f0fafbeb0794b5854e16f2a54f3ee2806efb50915c672f9eaf300858f65d4829143f

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
561KB

MD5
a378454e67d8cee3f1f3a2625b7d017e

SHA1
b5510f1092e2555ccba3a89d0086c0f722a1b317

SHA256
15c2bb43ea229cf6fa623d6d2df7256eb1b2fd99421df56bac0a77532207e12a

SHA512
d9dd64f478af755b8e211b9a6830ef398fa2266907ed5a209695fc3c2908f0fafbeb0794b5854e16f2a54f3ee2806efb50915c672f9eaf300858f65d4829143f

Download Submit
memory/3228-174-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3228-160-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3632-141-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3632-146-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3632-134-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3632-139-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3632-138-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3632-155-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3632-159-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3632-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3672-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3672-150-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3672-173-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4256-163-0x0000000072960000-0x0000000072F11000-memory.dmp

Filesize
5.7MB

Download
memory/4256-170-0x0000000072960000-0x0000000072F11000-memory.dmp

Filesize
5.7MB

Download
memory/4348-168-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4348-169-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4348-171-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4348-172-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4592-137-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download
memory/4592-132-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download