cybergate | 4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce

Analysis

max time kernel
152s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
Size

643KB
MD5

dde9dfb24295d7b19cea9d06bbc70a89
SHA1

cac60a20c07c94a8fd293660313d37fb6613a692
SHA256

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce
SHA512

debfd350caa18f551110284173d2d1608bfb0792e044ce67ed898878ae1b78bbb912366c0ad2621ba364bc4f1d1b918c52f2f55d80a68fc6f6a384721cad4360
SSDEEP

12288:DYuG579ANtmDzgA9I4FpE00YglJLobyQqVtQhU7:JE5smDzDVPB0YMNYyQqV5

Score

10^/10

cybergate l2ru persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

l2ru

brosto.strangled.net:81

brosto.strangled.net:4123

brosto.strangled.net:6745

brosto.strangled.net:7534

brosto.strangled.net:7653

sasaze.chickenkiller.com:7875

sasaze.chickenkiller.com:8545

sasaze.chickenkiller.com:8642

sasaze.chickenkiller.com:8742

sasaze.chickenkiller.com:8954

brostod.jumpingcrab.com:9647

brostod.jumpingcrab.com:9743

brostod.jumpingcrab.com:9866

brostod.jumpingcrab.com:10535

brostod.jumpingcrab.com:10877

1844205166:53575

1844205166:58656

1844205166:59534

1844205166:59642

Mutex

08RFLO43TP8P33

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
interface
install_file
csrsc.exe
install_flag
false
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
a123123123
regkey_hkcu
exploruse
regkey_hklm
exploruse

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Executes dropped EXE 1 IoCs

Processes:

IpOverUsbSvrc.exe

pid process

1876 IpOverUsbSvrc.exe

pid	process
1876	IpOverUsbSvrc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1100-82-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral1/memory/1100-86-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral1/memory/1100-95-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral1/memory/988-100-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral1/memory/988-102-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral1/memory/988-145-0x00000000104F0000-0x0000000010560000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe

pid process

2004 4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Suspicious use of SetThreadContext 20 IoCs

Processes:

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe

description	pid	process	target process
PID 2004 set thread context of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1072	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1940	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1592	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1560	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1292	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 560	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1412	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 272	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 868	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 964	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1052	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1076	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1220	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1800	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1920	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 584	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 2000	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1620	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 set thread context of 1048	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exeAppLaunch.exeAppLaunch.exeAppLaunch.exeIpOverUsbSvrc.exeAppLaunch.exeAppLaunch.exe

pid	process
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1100	AppLaunch.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1072	AppLaunch.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1940	AppLaunch.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1592	AppLaunch.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1560	AppLaunch.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
1876	IpOverUsbSvrc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exeexplorer.exeIpOverUsbSvrc.exe

description	pid	process
Token: SeDebugPrivilege	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
Token: SeDebugPrivilege	988	explorer.exe
Token: SeDebugPrivilege	988	explorer.exe
Token: SeDebugPrivilege	1876	IpOverUsbSvrc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AppLaunch.exe

pid process

1100 AppLaunch.exe

pid	process
1100	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exeAppLaunch.exe

description	pid	process	target process
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1100	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	AppLaunch.exe
PID 2004 wrote to memory of 1876	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	IpOverUsbSvrc.exe
PID 2004 wrote to memory of 1876	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	IpOverUsbSvrc.exe
PID 2004 wrote to memory of 1876	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	IpOverUsbSvrc.exe
PID 2004 wrote to memory of 1876	2004	4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe	IpOverUsbSvrc.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe
PID 1100 wrote to memory of 1208	1100	AppLaunch.exe	iexplore.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe
"C:\Users\Admin\AppData\Local\Temp\4ae3ae114ba84c4e8eb7acef823ad4517e628b8f088126edb956c5c1480799ce.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1208

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1292

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:560

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:868

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1220

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:584

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:2000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1620

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
3⤵
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
234KB

MD5
00f501def6ae300ac4e4fa643be36261

SHA1
e8604a75db905720fb064044111dd642514953f2

SHA256
3e91209868ded73c538024ac67ec7b3fa17a23b94d817656bda6b1ea45ee076b

SHA512
a17e742b644256ab3e2edd5b09b51eedbbd83cf213634b4c1215c3d98f8abdf33a9a1e70f82bcd05d40037d8ae4cbc05f46954143233fdc089c33989df8d17e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
11KB

MD5
03c4f3f5cdbc342eb1c0349e001fdd0c

SHA1
7d45ed19db4eaed16d1985240c98fab7623798e5

SHA256
a395cb8bb6cdaa7f0dad2e012fb5107d0d307efea021be048bdd5b67479356bc

SHA512
d59ccd1ffffa884c8a7a96979ed19f0f8a586474c23d5b5ab23c235799044042f639e1834ee2e54a205a71caf97898ac8898d0da963fb006e443f3fb8f3c1162

Download Submit
memory/272-266-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/272-257-0x0000000000409860-mapping.dmp

Download
memory/272-265-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/560-217-0x0000000000409860-mapping.dmp

Download
memory/560-225-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/560-226-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/584-425-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/584-417-0x0000000000409860-mapping.dmp

Download
memory/584-426-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/868-277-0x0000000000409860-mapping.dmp

Download
memory/868-286-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/868-285-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/964-306-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/964-305-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/964-297-0x0000000000409860-mapping.dmp

Download
memory/988-92-0x0000000000000000-mapping.dmp

Download
memory/988-145-0x00000000104F0000-0x0000000010560000-memory.dmp

Filesize
448KB

Download
memory/988-94-0x0000000071371000-0x0000000071373000-memory.dmp

Filesize
8KB

Download
memory/988-100-0x00000000104F0000-0x0000000010560000-memory.dmp

Filesize
448KB

Download
memory/988-102-0x00000000104F0000-0x0000000010560000-memory.dmp

Filesize
448KB

Download
memory/1048-485-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1048-477-0x0000000000409860-mapping.dmp

Download
memory/1052-325-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1052-326-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1052-317-0x0000000000409860-mapping.dmp

Download
memory/1072-122-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1072-123-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1072-114-0x0000000000409860-mapping.dmp

Download
memory/1076-337-0x0000000000409860-mapping.dmp

Download
memory/1076-346-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1076-345-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-86-0x0000000010480000-0x00000000104F0000-memory.dmp

Filesize
448KB

Download
memory/1100-95-0x00000000104F0000-0x0000000010560000-memory.dmp

Filesize
448KB

Download
memory/1100-56-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-57-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-59-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-60-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-74-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-62-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-61-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-63-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-65-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-66-0x0000000000409860-mapping.dmp

Download
memory/1100-67-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-103-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1100-82-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/1100-69-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1220-357-0x0000000000409860-mapping.dmp

Download
memory/1220-365-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1220-366-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1292-206-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1292-197-0x0000000000409860-mapping.dmp

Download
memory/1292-205-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1372-89-0x0000000010480000-0x00000000104F0000-memory.dmp

Filesize
448KB

Download
memory/1412-237-0x0000000000409860-mapping.dmp

Download
memory/1412-246-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1412-245-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1560-185-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1560-186-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1560-177-0x0000000000409860-mapping.dmp

Download
memory/1592-157-0x0000000000409860-mapping.dmp

Download
memory/1592-166-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1592-165-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1620-457-0x0000000000409860-mapping.dmp

Download
memory/1620-465-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1620-466-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1800-386-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1800-377-0x0000000000409860-mapping.dmp

Download
memory/1800-385-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1876-143-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1876-80-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/1876-75-0x0000000000000000-mapping.dmp

Download
memory/1920-405-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1920-406-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1920-397-0x0000000000409860-mapping.dmp

Download
memory/1940-146-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1940-135-0x0000000000409860-mapping.dmp

Download
memory/1940-144-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2000-437-0x0000000000409860-mapping.dmp

Download
memory/2000-445-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2000-446-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2004-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2004-124-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download
memory/2004-55-0x0000000074110000-0x00000000746BB000-memory.dmp

Filesize
5.7MB

Download