cybergate | 3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed

General

Target

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Size

968KB
MD5

2f6c036677c948e2a9c9272450312f36
SHA1

9c6366cb63bf7f81cfdf5be8a52a5c65bde1236d
SHA256

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed
SHA512

0e66858912726a2838843fc60f5a2c08d09a664036a577621947cee7051279089dd62b3bafd0065f268ea19a790c02a5fb587cef6caa3af7960edabb802297ac
SSDEEP

24576:StIeDsYWyebySixpypehoxMUMzaoRCq68GN0wgeXZR:S6eDjzghSaeCxMTtCn8QXZ

Score

10^/10

cybergate e-mail amigo evasion persistence stealer themida trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

E-mail Amigo

C2

maxboy.no-ip.org:81

maxboy19.no-ip.org:200

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
1234567
regkey_hkcu
win32
regkey_hklm
win32

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\explorer.exe"	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\explorer.exe"	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Executes dropped EXE 2 IoCs

Processes:

explorer.exeexplorer.exe

pid process

3508 explorer.exe
944 explorer.exe

pid	process
3508	explorer.exe
944	explorer.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P5THI5Q0-H0X1-N11W-R563-411MO083B43B}\StubPath = "C:\\Windows\\system32\\install\\explorer.exe Restart"	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P5THI5Q0-H0X1-N11W-R563-411MO083B43B}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{P5THI5Q0-H0X1-N11W-R563-411MO083B43B}\StubPath = "C:\\Windows\\system32\\install\\explorer.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{P5THI5Q0-H0X1-N11W-R563-411MO083B43B}	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5104-145-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/5104-150-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2436-153-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2436-156-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/5104-158-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/5104-163-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1732-166-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1732-169-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1732-186-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine	explorer.exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/4772-133-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/4772-136-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/4772-140-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/4772-142-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
C:\Windows\SysWOW64\install\explorer.exe	themida
behavioral2/memory/1732-168-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
C:\Windows\SysWOW64\install\explorer.exe	themida
behavioral2/memory/3508-172-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/3508-175-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
C:\Windows\SysWOW64\install\explorer.exe	themida
behavioral2/memory/3508-181-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/3508-182-0x0000000000400000-0x00000000005C4000-memory.dmp	themida
behavioral2/memory/1732-185-0x0000000000400000-0x00000000005C4000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\system32\\install\\explorer.exe"	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\win32 = "C:\\Windows\\system32\\install\\explorer.exe"	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Drops file in System32 directory 5 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\install\explorer.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
File opened for modification	C:\Windows\SysWOW64\install\explorer.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
File opened for modification	C:\Windows\SysWOW64\install\	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
File opened for modification	C:\Windows\SysWOW64\install\explorer.exe	explorer.exe
File created	C:\Windows\SysWOW64\install\explorer.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

pid process

4772 3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
3508 explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

description	pid	process	target process
PID 4772 set thread context of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 3508 set thread context of 944	3508	explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

pid	process
4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
3508	explorer.exe
3508	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

pid process

1732 3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

pid	process
1732	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	pid	process
Token: SeDebugPrivilege	1732	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Token: SeDebugPrivilege	1732	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

pid process

5104 3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exeexplorer.exe

pid process

4772 3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
3508 explorer.exe

pid	process
5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe

description	pid	process	target process
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 4772 wrote to memory of 5104	4772	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE
PID 5104 wrote to memory of 2712	5104	3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
"C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe"
2⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:2436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe
"C:\Users\Admin\AppData\Local\Temp\3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed.exe"
4⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\SysWOW64\install\explorer.exe
"C:\Windows\system32\install\explorer.exe"
5⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Windows\SysWOW64\install\explorer.exe
C:\Windows\SysWOW64\install\explorer.exe
6⤵
- Executes dropped EXE
PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
145eb403e31f0b15b077172bbdc5c575

SHA1
72132ad24fa6d1bec07cc1cb9efd2d3b0779dd33

SHA256
f1c67e9f2b56d9a6ab4ab893e4e0797d9d8a67fe31c2e1be97fcda1f7af1e7e1

SHA512
f57d7c8887230887030bebe58d36da92c43237e41bcc00e0563f9790d2c1f1863c5baa5103ea9b66d07c967b2fa0cb28b4ec58222fd300a3d834eb75de3d345d

Download Submit
C:\Windows\SysWOW64\install\explorer.exe
Filesize
968KB

MD5
2f6c036677c948e2a9c9272450312f36

SHA1
9c6366cb63bf7f81cfdf5be8a52a5c65bde1236d

SHA256
3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed

SHA512
0e66858912726a2838843fc60f5a2c08d09a664036a577621947cee7051279089dd62b3bafd0065f268ea19a790c02a5fb587cef6caa3af7960edabb802297ac

Download Submit
C:\Windows\SysWOW64\install\explorer.exe
Filesize
968KB

MD5
2f6c036677c948e2a9c9272450312f36

SHA1
9c6366cb63bf7f81cfdf5be8a52a5c65bde1236d

SHA256
3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed

SHA512
0e66858912726a2838843fc60f5a2c08d09a664036a577621947cee7051279089dd62b3bafd0065f268ea19a790c02a5fb587cef6caa3af7960edabb802297ac

Download Submit
C:\Windows\SysWOW64\install\explorer.exe
Filesize
968KB

MD5
2f6c036677c948e2a9c9272450312f36

SHA1
9c6366cb63bf7f81cfdf5be8a52a5c65bde1236d

SHA256
3e4c52f880d3e6e2a764dc93b40ea34cd591c94c6d90d60aa991cb32023d95ed

SHA512
0e66858912726a2838843fc60f5a2c08d09a664036a577621947cee7051279089dd62b3bafd0065f268ea19a790c02a5fb587cef6caa3af7960edabb802297ac

Download Submit
memory/944-183-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-176-0x0000000000000000-mapping.dmp

Download
memory/944-180-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/944-184-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1732-185-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/1732-169-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1732-168-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/1732-166-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1732-186-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1732-162-0x0000000000000000-mapping.dmp

Download
memory/2436-149-0x0000000000000000-mapping.dmp

Download
memory/2436-156-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2436-153-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3508-181-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/3508-182-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/3508-175-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/3508-170-0x0000000000000000-mapping.dmp

Download
memory/3508-172-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/4772-140-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/4772-133-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/4772-142-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/4772-136-0x0000000000400000-0x00000000005C4000-memory.dmp

Filesize
1.8MB

Download
memory/5104-145-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/5104-167-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-163-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/5104-158-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/5104-150-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/5104-143-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-141-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5104-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads