cybergate | b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Size 348KB
Sample221030-xtltraehe9
SHA256 b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c
MD5 81c8b45b8ca49646a30fc4de00e033c2
SHA1 d7046f24e78af57dd247e49b033e93d21fc53364
SHA512 998a1e0c5c89a2233414be192e31ebd5bca3810dc8918148c34b0d5b264afd60fe4219ba61d4117ccdef0cde0140469bcbb05e471edd4289d04f2d085a6a6598
SSDEEP 6144:LmLTgMZod2yGZBOLJ8RNBsJefjbXhhUiZ0XuL44B2ftt7kGU10Ub:LmYMZc2y3LJeNOAjdhj+Jk2ftt4aUb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate warpilein persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

warpilein

warpilein.dyndns.org:81
warpilein.dyndns.org:202
warpilein.dyndns.org:1499
warpilein.dyndns.org:2002
warpilein.dyndns.org:4661
dasgensu.dyndns.org:81
dasgensu.dyndns.org:202
dasgensu.dyndns.org:1499
dasgensu.dyndns.org:2002
dasgensu.dyndns.org:4661

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
adobe
install_file
adobetray.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
2x7mcw5
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\adobe\\adobetray.exe"	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\adobe\\adobetray.exe"	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Executes dropped EXE 2 IoCs

pid	Process
2564	adobetray.exe
4744	adobetray.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{838VB1MH-4HA5-60S7-28CX-81DE04SO14WH}	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{838VB1MH-4HA5-60S7-28CX-81DE04SO14WH}\StubPath = "C:\\Windows\\system32\\adobe\\adobetray.exe Restart"	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{838VB1MH-4HA5-60S7-28CX-81DE04SO14WH}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{838VB1MH-4HA5-60S7-28CX-81DE04SO14WH}\StubPath = "C:\\Windows\\system32\\adobe\\adobetray.exe"	explorer.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/644-132-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/644-138-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3964-142-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3964-147-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/816-150-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/files/0x0001000000022deb-152.dat	upx
behavioral2/memory/816-153-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3964-155-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/1564-160-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3964-161-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1564-164-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1564-166-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/files/0x0001000000022deb-168.dat	upx
behavioral2/files/0x0001000000022deb-173.dat	upx
behavioral2/memory/2564-176-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/1564-178-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\adobe\\adobetray.exe"	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\adobe\\adobetray.exe"	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\adobe\adobetray.exe	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
File opened for modification	C:\Windows\SysWOW64\adobe\adobetray.exe	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
File opened for modification	C:\Windows\SysWOW64\adobe\adobetray.exe	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
File opened for modification	C:\Windows\SysWOW64\adobe\	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
File opened for modification	C:\Windows\SysWOW64\adobe\adobetray.exe	adobetray.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 2564 set thread context of 4744	2564	adobetray.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	4744	WerFault.exe	88

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1564	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
Token: SeDebugPrivilege	1564	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
2564	adobetray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 644 wrote to memory of 3964	644	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	80
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51
PID 3964 wrote to memory of 3064	3964	b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3064
- C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
  "C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
    C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:816
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe
      "C:\Users\Admin\AppData\Local\Temp\b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1564
    - - C:\Windows\SysWOW64\adobe\adobetray.exe
        
        "C:\Windows\system32\adobe\adobetray.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Windows\SysWOW64\adobe\adobetray.exe
        
        C:\Windows\SysWOW64\adobe\adobetray.exe
        6⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 576
        7⤵
        Program crash
        
        PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4744 -ip 4744
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 230KB
SHA256 3e456d8990cc7cb9c1541642674e1e736f3962342328b51758dffed7a2a3596c
MD5 d26626e73d376e8948a4e3fd7b81c938
SHA1 4e2f3864cb0c7c69076c759ed5604c3cafccac40
SHA512 c9f0327b9a384e22893b0a21a1365d298ed5d66077d171ceecd6290b7fd060085dc1c00d68c73ee7d49bc6098ee37e72bf76611b427f6602dfdd5108d2ccbcd0
SSDEEP 3072:oGeP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiQ:I5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

adobetray.exe

Path C:\Windows\SysWOW64\adobe\adobetray.exe
Size 348KB
SHA256 b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c
MD5 81c8b45b8ca49646a30fc4de00e033c2
SHA1 d7046f24e78af57dd247e49b033e93d21fc53364
SHA512 998a1e0c5c89a2233414be192e31ebd5bca3810dc8918148c34b0d5b264afd60fe4219ba61d4117ccdef0cde0140469bcbb05e471edd4289d04f2d085a6a6598
SSDEEP 6144:LmLTgMZod2yGZBOLJ8RNBsJefjbXhhUiZ0XuL44B2ftt7kGU10Ub:LmYMZc2y3LJeNOAjdhj+Jk2ftt4aUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

adobetray.exe

Path C:\Windows\SysWOW64\adobe\adobetray.exe
Size 348KB
SHA256 b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c
MD5 81c8b45b8ca49646a30fc4de00e033c2
SHA1 d7046f24e78af57dd247e49b033e93d21fc53364
SHA512 998a1e0c5c89a2233414be192e31ebd5bca3810dc8918148c34b0d5b264afd60fe4219ba61d4117ccdef0cde0140469bcbb05e471edd4289d04f2d085a6a6598
SSDEEP 6144:LmLTgMZod2yGZBOLJ8RNBsJefjbXhhUiZ0XuL44B2ftt7kGU10Ub:LmYMZc2y3LJeNOAjdhj+Jk2ftt4aUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

adobetray.exe

Path C:\Windows\SysWOW64\adobe\adobetray.exe
Size 348KB
SHA256 b84377d53936ec116feeb803307dbfa899ee9035c1812696f5e3ccdb4e30644c
MD5 81c8b45b8ca49646a30fc4de00e033c2
SHA1 d7046f24e78af57dd247e49b033e93d21fc53364
SHA512 998a1e0c5c89a2233414be192e31ebd5bca3810dc8918148c34b0d5b264afd60fe4219ba61d4117ccdef0cde0140469bcbb05e471edd4289d04f2d085a6a6598
SSDEEP 6144:LmLTgMZod2yGZBOLJ8RNBsJefjbXhhUiZ0XuL44B2ftt7kGU10Ub:LmYMZc2y3LJeNOAjdhj+Jk2ftt4aUb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-138-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/644-132-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/816-150-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/816-153-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/1564-178-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/1564-166-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/1564-160-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1564-164-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/2564-176-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3964-142-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/3964-161-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/3964-155-0x00000000240F0000-0x0000000024152000-memory.dmp

Download

memory/3964-165-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3964-147-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/3964-140-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3964-139-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3964-137-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3964-136-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4744-175-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4744-177-0x0000000000400000-0x0000000000450000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads