cybergate | 737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527

Analysis

max time kernel
163s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe
Size

2.8MB
MD5

d73a56d2f067fdcf8299b3578dd811d2
SHA1

c523d4c624c4a2b181943e9b79a318d5e495492c
SHA256

737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527
SHA512

2b46924a844b932a386a0b7adfe816b9fb2e910db081edf912d025360508d542878fecc45867b8761468f281ef579f9eb73906bedc51e049cdccd633a9208ce5
SSDEEP

49152:XAI+BXJZoQrbTFZY1iaRgY1irVLdi8gLMpYw2o3ALP5rZwJnD1tSf:XAI+BXtrbTA1VyVL0zDowLxVYbY

Score

10^/10

cybergate facebook discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

facebook

goglechrome.ddns.net:6708

Mutex

W760NN1H828HU8

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
googlechromme
install_file
notepad.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
Mullvad123
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Cupondescuento.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\googlechromme\\notepad.exe"	Cupondescuento.scr
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Cupondescuento.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\googlechromme\\notepad.exe"	Cupondescuento.scr

Executes dropped EXE 5 IoCs

pid	Process
4832	Cupondescuento.scr
1340	Cupondescuento.scr
4608	Cupondescuento.scr
1848	notepad.exe
1444	notepad.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N606QHIW-502D-666U-4XFP-018AIR3SPMB7}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N606QHIW-502D-666U-4XFP-018AIR3SPMB7}\StubPath = "C:\\Windows\\googlechromme\\notepad.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N606QHIW-502D-666U-4XFP-018AIR3SPMB7}	Cupondescuento.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N606QHIW-502D-666U-4XFP-018AIR3SPMB7}\StubPath = "C:\\Windows\\googlechromme\\notepad.exe Restart"	Cupondescuento.scr

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1340-167-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/1340-172-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4152-175-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4152-178-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/1340-180-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/1340-186-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/4608-190-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/4608-193-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/4608-194-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Cupondescuento.scr

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Cupondescuento.scr
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\googlechromme\\notepad.exe"	Cupondescuento.scr
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	Cupondescuento.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\googlechromme\\notepad.exe"	Cupondescuento.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000022e12-133.dat	autoit_exe
behavioral2/files/0x0008000000022e12-134.dat	autoit_exe
behavioral2/files/0x0008000000022e12-162.dat	autoit_exe
behavioral2/files/0x0006000000022e23-177.dat	autoit_exe
behavioral2/files/0x0008000000022e12-185.dat	autoit_exe
behavioral2/files/0x0006000000022e23-192.dat	autoit_exe
behavioral2/files/0x0006000000022e23-197.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 1340	4832	Cupondescuento.scr	95
PID 1848 set thread context of 1444	1848	notepad.exe	104

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\googlechromme\notepad.exe	Cupondescuento.scr
File opened for modification	C:\Windows\googlechromme\notepad.exe	Cupondescuento.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4608	Cupondescuento.scr

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	4152	explorer.exe
Token: SeRestorePrivilege	4152	explorer.exe
Token: SeBackupPrivilege	4608	Cupondescuento.scr
Token: SeRestorePrivilege	4608	Cupondescuento.scr
Token: SeDebugPrivilege	4608	Cupondescuento.scr
Token: SeDebugPrivilege	4608	Cupondescuento.scr

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3208	AcroRd32.exe
1340	Cupondescuento.scr

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe
3208	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4832	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	80
PID 456 wrote to memory of 4832	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	80
PID 456 wrote to memory of 4832	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	80
PID 456 wrote to memory of 3208	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	81
PID 456 wrote to memory of 3208	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	81
PID 456 wrote to memory of 3208	456	737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe	81
PID 3208 wrote to memory of 2348	3208	AcroRd32.exe	83
PID 3208 wrote to memory of 2348	3208	AcroRd32.exe	83
PID 3208 wrote to memory of 2348	3208	AcroRd32.exe	83
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 5004	2348	RdrCEF.exe	86
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87
PID 2348 wrote to memory of 2228	2348	RdrCEF.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Temp\737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe
  "C:\Users\Admin\AppData\Local\Temp\737dc4e2c0c0b4c1c381155aff2168a7208e5d063a13027e32f494be086a3527.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr
    "C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr
      "C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr"
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of FindShellTrayWindow
      PID:1340
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        Modifies Installed Components in the registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr
        
        "C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
      - C:\Windows\googlechromme\notepad.exe
        
        "C:\Windows\googlechromme\notepad.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1848
        
        C:\Windows\googlechromme\notepad.exe
        
        "C:\Windows\googlechromme\notepad.exe"
        7⤵
        Executes dropped EXE
        
        PID:1444
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cupon20descuento.pdf"
    3⤵
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B4D71D794245F95CB5B82861BC164A7 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B3D1B29AD1B386FFA31E4A1AFA9FE2C2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B3D1B29AD1B386FFA31E4A1AFA9FE2C2 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DC69259FA3A948B976B7620DC5B4F0DE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DC69259FA3A948B976B7620DC5B4F0DE --renderer-client-id=4 --mojo-platform-channel-handle=2164 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:3612
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CAC75DDC32BA4D12F13EC5EC5ACB91BB --mojo-platform-channel-handle=2188 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=33C6B7B104027E0B97AA3E264B492130 --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:1480
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ED5595EA0CB702AA1D119F30021E39A5 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
a1a7e9b84ecfb1ac4c13348f561c220c

SHA1
6bd62cf00e86c4b9b9debd64eb1f64fc23fb9420

SHA256
0e2b227cddfb6e11d88818aba5a408058bbb884d00ecc5883f308562d061739f

SHA512
88caa85fe8b19fcd8c25eee367a3bb49c3a3f158b8e0f4d8e1a9c8ba7f5ac9ce4225c3cc1b2a0265481a0650964ef1eae00e6e6c7f5ee7e5c4dbd1534e64c3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cupondescuento.scr

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\cupon20descuento.pdf

Filesize
1.3MB

MD5
82ebdf593e221a888ddbe2f6b78aaf7d

SHA1
aef7d2b30a188c0edfdec871251c24eae15d433d

SHA256
a3f8323927fa38b379a86eba4d4ef6fc1b03a4a35ac573ca94fd74382dad0ee4

SHA512
bff7d957d7daebe0d724e80cf79d62b1bb5c7c2c1d2982c9f39f6ffe9c2d6133caa15749239c904a3ba144c5f92235a18af148c49c4de50e120857ce04ab7947

Download Submit
C:\Windows\googlechromme\notepad.exe

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Windows\googlechromme\notepad.exe

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
C:\Windows\googlechromme\notepad.exe

Filesize
1.2MB

MD5
ae26f3773cea35dbe915a9c5dfdb035d

SHA1
bd52bdca28b37fc998138901f3c40e52585138d3

SHA256
2bf90e5c0311a032b63129146c1187f1c0ffa9ce3888f16f129e280812f0df59

SHA512
4baae8d14cf4427e7125e1593736cafb048cb617a166fe6348d35488d4e918e191b38b0e78cf4c820912b447ca8bee2d9e3d1b4b04ba5169ffff83e1328494cd

Download Submit
memory/1340-189-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1340-164-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1340-186-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1340-161-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1340-163-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1340-180-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1340-172-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1340-165-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1340-167-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1444-200-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1444-199-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1444-201-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4152-178-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4152-175-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4608-190-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4608-193-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4608-194-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download