cybergate | 67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2

General

Target

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Size

1.1MB
MD5

74f7cfd5940b6bc2692d1c98572bf494
SHA1

215b68b8ed387dc870c4865048d3af8b2cfbdb2b
SHA256

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2
SHA512

1e5b8d7efbc9d7c81a10b4457783fe932ede8eddc29d5f869ccd533b87f9dca3d940ae35d7c65805b129fc287f35d635ad3d7f91bf57aaab3423b9c946e409ae
SSDEEP

24576:/GbPNIWKv67XWcTyqgmUQEGUz/GFtENlBsX6n17wUhSHLF:g1IWKv673BUz/G0NlBbn17ULF

Score

10^/10

cybergate victime evasion persistence stealer themida trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

victime

C2

kaitokid.no-ip.biz:1357

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
lag.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\lag.exe"	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\lag.exe"	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Executes dropped EXE 2 IoCs

Processes:

lag.exelag.exe

pid process

4668 lag.exe
3556 lag.exe

pid	process
4668	lag.exe
3556	lag.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4LNI3G86-3J7A-5LV6-3084-36EJ3NK2OA58}	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4LNI3G86-3J7A-5LV6-3084-36EJ3NK2OA58}\StubPath = "C:\\Windows\\system32\\install\\lag.exe Restart"	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4LNI3G86-3J7A-5LV6-3084-36EJ3NK2OA58}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4LNI3G86-3J7A-5LV6-3084-36EJ3NK2OA58}\StubPath = "C:\\Windows\\system32\\install\\lag.exe"	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3480-143-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/3480-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2464-152-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2464-155-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/3480-157-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/3480-162-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2592-165-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2592-168-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2592-182-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

lag.exe67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Wine	lag.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Wine	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1272-132-0x0000000000400000-0x00000000006A5000-memory.dmp	themida
behavioral2/memory/1272-135-0x0000000000400000-0x00000000006A5000-memory.dmp	themida
behavioral2/memory/1272-140-0x0000000000400000-0x00000000006A5000-memory.dmp	themida
C:\Windows\SysWOW64\install\lag.exe	themida
behavioral2/memory/2592-167-0x0000000000400000-0x00000000006A5000-memory.dmp	themida
C:\Windows\SysWOW64\install\lag.exe	themida
behavioral2/memory/4668-173-0x0000000000400000-0x00000000006A5000-memory.dmp	themida
C:\Windows\SysWOW64\install\lag.exe	themida
behavioral2/memory/4668-179-0x0000000000400000-0x00000000006A5000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\lag.exe"	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\lag.exe"	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Drops file in System32 directory 4 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\install\lag.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
File opened for modification	C:\Windows\SysWOW64\install\lag.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
File opened for modification	C:\Windows\SysWOW64\install\lag.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
File opened for modification	C:\Windows\SysWOW64\install\	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exelag.exe

description	pid	process	target process
PID 1272 set thread context of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 4668 set thread context of 3556	4668	lag.exe	lag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

pid process

2592 67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

pid	process
2592	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	pid	process
Token: SeDebugPrivilege	2592	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Token: SeDebugPrivilege	2592	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

pid process

3480 67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exelag.exe

pid process

1272 67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
4668 lag.exe

pid	process
3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

pid	process
1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
4668	lag.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe

description	pid	process	target process
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 1272 wrote to memory of 3480	1272	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE
PID 3480 wrote to memory of 2764	3480	67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
"C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe"
2⤵
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3480

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:2464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe
"C:\Users\Admin\AppData\Local\Temp\67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2.exe"
4⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\SysWOW64\install\lag.exe
"C:\Windows\system32\install\lag.exe"
5⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Windows\SysWOW64\install\lag.exe
C:\Windows\SysWOW64\install\lag.exe
6⤵
- Executes dropped EXE
PID:3556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
bcb39f8020babfb5435e15dac427b12f

SHA1
7ece8c88bd85bda0934e023f807857a9c2ba7233

SHA256
e7c4f029a4844e33e6002f532d76f8d0e322e8e7d2017e5d288e1d90ab7d68a5

SHA512
fc40d97fc908441e3d83dde14a303cbce1660712553b18350fd3b53f69646c7175a592546d48b9941abe4608986dc9c834b43d71a437d26f92580878ade851e3

Download Submit
C:\Windows\SysWOW64\install\lag.exe
Filesize
1.1MB

MD5
74f7cfd5940b6bc2692d1c98572bf494

SHA1
215b68b8ed387dc870c4865048d3af8b2cfbdb2b

SHA256
67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2

SHA512
1e5b8d7efbc9d7c81a10b4457783fe932ede8eddc29d5f869ccd533b87f9dca3d940ae35d7c65805b129fc287f35d635ad3d7f91bf57aaab3423b9c946e409ae

Download Submit
C:\Windows\SysWOW64\install\lag.exe
Filesize
1.1MB

MD5
74f7cfd5940b6bc2692d1c98572bf494

SHA1
215b68b8ed387dc870c4865048d3af8b2cfbdb2b

SHA256
67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2

SHA512
1e5b8d7efbc9d7c81a10b4457783fe932ede8eddc29d5f869ccd533b87f9dca3d940ae35d7c65805b129fc287f35d635ad3d7f91bf57aaab3423b9c946e409ae

Download Submit
C:\Windows\SysWOW64\install\lag.exe
Filesize
1.1MB

MD5
74f7cfd5940b6bc2692d1c98572bf494

SHA1
215b68b8ed387dc870c4865048d3af8b2cfbdb2b

SHA256
67505b68f020cb3c75d48b0b6ce8b40e26608e175d9034426ac67ae338e40cb2

SHA512
1e5b8d7efbc9d7c81a10b4457783fe932ede8eddc29d5f869ccd533b87f9dca3d940ae35d7c65805b129fc287f35d635ad3d7f91bf57aaab3423b9c946e409ae

Download Submit
memory/1272-140-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/1272-132-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/1272-135-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2464-155-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2464-148-0x0000000000000000-mapping.dmp

Download
memory/2464-152-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2592-168-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2592-167-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2592-165-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2592-161-0x0000000000000000-mapping.dmp

Download
memory/2592-182-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3480-143-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/3480-138-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3480-162-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3480-146-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-166-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-141-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-139-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3480-136-0x0000000000000000-mapping.dmp

Download
memory/3480-157-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/3480-137-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3556-174-0x0000000000000000-mapping.dmp

Download
memory/3556-178-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3556-180-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3556-181-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4668-173-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/4668-179-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/4668-169-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads