cybergate | 60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2

General

Target

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Size

544KB
MD5

5b13049a6d80ba43ebc28f1609f8bd50
SHA1

d3559baba53857bb393b7aa1c3cf25460c8ff64d
SHA256

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2
SHA512

89904d400f63d0995fdac33cbb44276970b539b09ddc6d43b7407c8557e2a97e4378b4e31b891612eda66c661f2a67dce9efb29a30f4b2a195f10201eda39cb1
SSDEEP

12288:rxF0fOZh6HDfNrlWugsu0UlHoZbaJ6N85KQ0:MOT6jl5WuMN+baJ6No

Score

10^/10

cybergate hacker persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.7 J/M SE

Botnet

hacker

C2

mohammadhmood.no-ip.org:81

Mutex

JoKeR/M@SK

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

2260 server.exe
2728 server.exe

pid	process
2260	server.exe
2728	server.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4824-141-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4824-146-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2456-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2456-152-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4824-155-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4488-158-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4488-160-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4488-172-0x00000000240F0000-0x0000000024152000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Drops file in System32 directory 4 IoCs

Processes:

explorer.exe60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\install\	explorer.exe
File created	C:\Windows\SysWOW64\install\server.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exeserver.exe

description	pid	process	target process
PID 4640 set thread context of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 2260 set thread context of 2728	2260	server.exe	server.exe

Drops file in Windows directory 3 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
File created	C:\Windows\assembly\Desktop.ini	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Modifies registry class 1 IoCs

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exeserver.exe

pid	process
4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
2728	server.exe
2728	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

4488 explorer.exe

pid	process
4488	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exeexplorer.exeserver.exe

description	pid	process
Token: SeDebugPrivilege	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Token: 33	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Token: SeIncBasePriorityPrivilege	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
Token: SeDebugPrivilege	4488	explorer.exe
Token: SeDebugPrivilege	4488	explorer.exe
Token: SeDebugPrivilege	2260	server.exe
Token: 33	2260	server.exe
Token: SeIncBasePriorityPrivilege	2260	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

pid process

4824 60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe

description	pid	process	target process
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4640 wrote to memory of 4824	4640	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE
PID 4824 wrote to memory of 2348	4824	60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2348

C:\Users\Admin\AppData\Local\Temp\60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
"C:\Users\Admin\AppData\Local\Temp\60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe"
2⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe
"C:\Users\Admin\AppData\Local\Temp\60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2.exe"
3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:2456

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\SysWOW64\install\server.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
232KB

MD5
183bcc93ff7464a7d0e2818578480295

SHA1
6a7d6eada49a8894ca93f408bf779975ac052d09

SHA256
36aae62941fccdc5da2ca943e5c974263570cb368a15b48a5f3c392af28f8807

SHA512
f5a8dfaf978393f3ab5cbbba8873b5d36432fae944b6f0f000fb8bc3e0a62f0c2f894cd5eac3b2fcda57084f767b64d4bf9fa926c164494c59c63deb757a1797

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
544KB

MD5
5b13049a6d80ba43ebc28f1609f8bd50

SHA1
d3559baba53857bb393b7aa1c3cf25460c8ff64d

SHA256
60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2

SHA512
89904d400f63d0995fdac33cbb44276970b539b09ddc6d43b7407c8557e2a97e4378b4e31b891612eda66c661f2a67dce9efb29a30f4b2a195f10201eda39cb1

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
544KB

MD5
5b13049a6d80ba43ebc28f1609f8bd50

SHA1
d3559baba53857bb393b7aa1c3cf25460c8ff64d

SHA256
60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2

SHA512
89904d400f63d0995fdac33cbb44276970b539b09ddc6d43b7407c8557e2a97e4378b4e31b891612eda66c661f2a67dce9efb29a30f4b2a195f10201eda39cb1

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
544KB

MD5
5b13049a6d80ba43ebc28f1609f8bd50

SHA1
d3559baba53857bb393b7aa1c3cf25460c8ff64d

SHA256
60a2e305ac345a40e5591ac60c0322202400744d0185016a0bbc01d17b5df1f2

SHA512
89904d400f63d0995fdac33cbb44276970b539b09ddc6d43b7407c8557e2a97e4378b4e31b891612eda66c661f2a67dce9efb29a30f4b2a195f10201eda39cb1

Download Submit
memory/2260-169-0x0000000071FC0000-0x0000000072571000-memory.dmp

Filesize
5.7MB

Download
memory/2260-163-0x0000000071FC0000-0x0000000072571000-memory.dmp

Filesize
5.7MB

Download
memory/2260-161-0x0000000000000000-mapping.dmp

Download
memory/2456-152-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2456-145-0x0000000000000000-mapping.dmp

Download
memory/2456-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2728-171-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2728-170-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2728-168-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2728-164-0x0000000000000000-mapping.dmp

Download
memory/4488-160-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4488-172-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4488-154-0x0000000000000000-mapping.dmp

Download
memory/4488-158-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4640-138-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/4640-132-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/4640-133-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Filesize
5.7MB

Download
memory/4824-159-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4824-137-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4824-136-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4824-135-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4824-155-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4824-134-0x0000000000000000-mapping.dmp

Download
memory/4824-141-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4824-139-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4824-146-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads