cybergate | 278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

Analysis

max time kernel
206s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Size

282KB
MD5

08996160b29a26eb2750d5dd608e0438
SHA1

97d264a4bb7db1ae2ef07bfb337003bb584c5de2
SHA256

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081
SHA512

0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888
SSDEEP

6144:VxJsGLnF5oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZO:HJsG554h/xQp6+tqOYy9zo0F

Score

10^/10

cybergate hacker persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Hacker

toto68.zapto.org:188

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./
ftp_interval
30
injected_process
explorer.exe
install_dir
Microsoft
install_file
Pluguin.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Plugins java Updeter
message_box_title
Windows
password
0123456789
regkey_hkcu
Avirnt
regkey_hklm
Avgnt

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exeexplorer.exePluguin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe

Executes dropped EXE 6 IoCs

Processes:

Pluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exe

pid process

4624 Pluguin.exe
4312 Pluguin.exe
4016 Pluguin.exe
4680 Pluguin.exe
4944 Pluguin.exe
2972 Pluguin.exe

pid	process
4624	Pluguin.exe
4312	Pluguin.exe
4016	Pluguin.exe
4680	Pluguin.exe
4944	Pluguin.exe
2972	Pluguin.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pluguin.exeexplorer.exePluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe Restart"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/976-133-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/976-138-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/4836-141-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/4836-144-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral2/memory/4312-157-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4680-160-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4016-165-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4944-168-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4680-169-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral2/memory/4944-170-0x0000000024010000-0x0000000024070000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Pluguin.exePluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Pluguin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Pluguin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exeexplorer.exePluguin.exePluguin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe

Drops file in System32 directory 9 IoCs

Processes:

Pluguin.exePluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exePluguin.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1520 4944 WerFault.exe Pluguin.exe
4284 2972 WerFault.exe Pluguin.exe
Modifies registry class 1 IoCs

Processes:

Pluguin.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Pluguin.exe

pid	pid_target	process	target process
1520	4944	WerFault.exe	Pluguin.exe
4284	2972	WerFault.exe	Pluguin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Pluguin.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exePluguin.exePluguin.exe

pid	process
976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
4624	Pluguin.exe
4624	Pluguin.exe
4312	Pluguin.exe
4312	Pluguin.exe
4016	Pluguin.exe
4016	Pluguin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Pluguin.exe

pid process

4680 Pluguin.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Pluguin.exe

description pid process

Token: SeDebugPrivilege 4680 Pluguin.exe
Token: SeDebugPrivilege 4680 Pluguin.exe

pid	process
4680	Pluguin.exe

description	pid	process
Token: SeDebugPrivilege	4680	Pluguin.exe
Token: SeDebugPrivilege	4680	Pluguin.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exe

pid	process
976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
4624	Pluguin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

description	pid	process	target process
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 976 wrote to memory of 3076	976	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3076

C:\Users\Admin\AppData\Local\Temp\278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
"C:\Users\Admin\AppData\Local\Temp\278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:4836

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4016

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 1000
6⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4624

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
6⤵
- Executes dropped EXE
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 544
7⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4944 -ip 4944
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2972 -ip 2972
1⤵
PID:4296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
7c20220dec20262572e7d3f5d278617e

SHA1
375f859c077a5433eb481e64ff0c73e5f950fd52

SHA256
871eda86246a73f340cd609f9152d573a424d1372fed445c73d73ff0264d20d6

SHA512
7cceaca6304fbbfaac5e15f80b2eb42cddcd1462ed76761a94fc0c86241c458d758688a27e937908a17e42f9bf341eb7f7dd8040a0adeff0d18bcb0c23e12fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
637f3c7efd621b37a472a48bac5a32ac

SHA1
342f24d6da64d317c8321ad99acfed170b1896df

SHA256
1ca33f6cf5138f29b6c35fac390d7bdeb8a130283803088a38289919c2ae04c0

SHA512
a89e61c3f0759b0ba984e7c1d5cc309ec616b3b68dea2936fcbfcf5abca4c27f8289c59058a4e7fcfb69d841d9293fd354d6140461cfaf3ac1b09a3e6149d2d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
113aaaa5837d8124d8338a54df9e2116

SHA1
25fdf3d7793d6955d0bd542edc2dba9d41430445

SHA256
674703a586b8803fe4ba9d8e4d1b26346a0736dd4d0e60ef8a922e40a9185606

SHA512
59c928930ebaf54e3d2b043e4f88d6a79a20bb37cac9cafb27bae2b797c39c60b252980746b7868f2a82de4e96b4b82144a20223ca6a346c86ce77f7e8d274fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
113aaaa5837d8124d8338a54df9e2116

SHA1
25fdf3d7793d6955d0bd542edc2dba9d41430445

SHA256
674703a586b8803fe4ba9d8e4d1b26346a0736dd4d0e60ef8a922e40a9185606

SHA512
59c928930ebaf54e3d2b043e4f88d6a79a20bb37cac9cafb27bae2b797c39c60b252980746b7868f2a82de4e96b4b82144a20223ca6a346c86ce77f7e8d274fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
memory/976-133-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/976-138-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/2972-171-0x0000000000000000-mapping.dmp

Download
memory/4016-165-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4016-150-0x0000000000000000-mapping.dmp

Download
memory/4312-147-0x0000000000000000-mapping.dmp

Download
memory/4312-157-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4624-145-0x0000000000000000-mapping.dmp

Download
memory/4680-160-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4680-155-0x0000000000000000-mapping.dmp

Download
memory/4680-169-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4836-144-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/4836-141-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/4836-137-0x0000000000000000-mapping.dmp

Download
memory/4944-163-0x0000000000000000-mapping.dmp

Download
memory/4944-168-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/4944-170-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download