cybergate | c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

General

Target

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Size

334KB
MD5

9f2f7476b19162efeb42cac9ef2889e4
SHA1

3956de2ac05f277a0281e4139d1512e7f1530f78
SHA256

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d
SHA512

4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb
SSDEEP

6144:r/feJ2ORBAdHuSSDpmFA6GCmjTEXxF0PjoreNVF9FnV36H:r/febUOSccV4CP0bMUH9FS

Score

10^/10

cybergate 3 persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

3

C2

127.0.0.1:80

whybifi.zapto.org:80

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
rundll
install_file
rundll32.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
rundll32
regkey_hklm
rundll

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll\\rundll32.exe"	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll\\rundll32.exe"	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

Executes dropped EXE 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

1608 rundll32.exe
1476 rundll32.exe

pid	process
1608	rundll32.exe
1476	rundll32.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{647G2VME-5MVS-6IJ0-L8OI-NUU74O04UH88}	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{647G2VME-5MVS-6IJ0-L8OI-NUU74O04UH88}\StubPath = "C:\\Windows\\system32\\rundll\\rundll32.exe Restart"	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{647G2VME-5MVS-6IJ0-L8OI-NUU74O04UH88}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{647G2VME-5MVS-6IJ0-L8OI-NUU74O04UH88}\StubPath = "C:\\Windows\\system32\\rundll\\rundll32.exe"	explorer.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/844-76-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/844-85-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/964-90-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/964-91-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/844-93-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/844-103-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1572-108-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1572-110-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/964-111-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1572-142-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exerundll32.exe

pid	process
1572	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
1572	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
1608	rundll32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rundll = "C:\\Windows\\system32\\rundll\\rundll32.exe"	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Windows\\system32\\rundll\\rundll32.exe"	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

Drops file in System32 directory 5 IoCs

Processes:

rundll32.exec25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exec25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\rundll\rundll32.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll\rundll32.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
File opened for modification	C:\Windows\SysWOW64\rundll\rundll32.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
File opened for modification	C:\Windows\SysWOW64\rundll\rundll32.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
File opened for modification	C:\Windows\SysWOW64\rundll\	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exerundll32.exe

description	pid	process	target process
PID 1408 set thread context of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1608 set thread context of 1476	1608	rundll32.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

pid process

844 c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

pid process

1572 c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

pid	process
844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

description	pid	process
Token: SeDebugPrivilege	1572	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Token: SeDebugPrivilege	1572	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

pid process

844 c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exerundll32.exe

pid process

1408 c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
1608 rundll32.exe

pid	process
844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

pid	process
1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
1608	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exec25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe

description	pid	process	target process
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 1408 wrote to memory of 844	1408	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE
PID 844 wrote to memory of 1272	844	c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
"C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:576

C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe
"C:\Users\Admin\AppData\Local\Temp\c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d.exe"
4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\SysWOW64\rundll\rundll32.exe
"C:\Windows\system32\rundll\rundll32.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1608

C:\Windows\SysWOW64\rundll\rundll32.exe
C:\Windows\SysWOW64\rundll\rundll32.exe
6⤵
- Executes dropped EXE
PID:1476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
c62724ec75057c2dcdde16175eef1537

SHA1
88e265a1db994a4996764bd89cb220ec7e6ab3fe

SHA256
b8af833f254b5b0426145cb26290f2b6ed6538836601437c9cb6cc70c54bfdfd

SHA512
780090092570a5ac034b69fc7431f8812a283f843e0958a2bb9b2b88f06fec21c20df822ec644901178f5fc5aabcc624ecc87a5a4598f85970a58d09fcebac7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-999675638-2867687379-27515722-1000\699c4b9cdebca7aaea5193cae8a50098_4d2ef0d5-1240-4a07-93d0-06481c31e0ad
Filesize
50B

MD5
5b63d4dd8c04c88c0e30e494ec6a609a

SHA1
884d5a8bdc25fe794dc22ef9518009dcf0069d09

SHA256
4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

SHA512
15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

Download Submit
C:\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
C:\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
C:\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
\Windows\SysWOW64\rundll\rundll32.exe
Filesize
334KB

MD5
9f2f7476b19162efeb42cac9ef2889e4

SHA1
3956de2ac05f277a0281e4139d1512e7f1530f78

SHA256
c25ed9b00e6df8695436560307f13e58e1d26d41dbe13670a8a5bf2ede7e637d

SHA512
4c1a10f2883ede1df88d34b60613b27a889df7479179cfca17e2f5fead2a97e87505fba037f21d8d4e023d4ca5b0dce6198ddf1187b4068caaec519f13e193bb

Download Submit
memory/844-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-58-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-65-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-69-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-98-0x0000000000220000-0x0000000000256000-memory.dmp

Filesize
216KB

Download
memory/844-64-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-72-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/844-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-67-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-68-0x000000000040BBF4-mapping.dmp

Download
memory/844-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-61-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-85-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/844-109-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-103-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/844-93-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/844-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-76-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/964-91-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/964-82-0x0000000000000000-mapping.dmp

Download
memory/964-90-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/964-111-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/964-84-0x00000000746D1000-0x00000000746D3000-memory.dmp

Filesize
8KB

Download
memory/1272-79-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1408-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1408-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1408-70-0x00000000003B0000-0x00000000003E6000-memory.dmp

Filesize
216KB

Download
memory/1408-71-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1476-133-0x000000000040BBF4-mapping.dmp

Download
memory/1476-138-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1476-143-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1476-141-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1476-140-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1572-110-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1572-99-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1572-97-0x0000000000000000-mapping.dmp

Download
memory/1572-108-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1572-118-0x0000000005190000-0x00000000051C6000-memory.dmp

Filesize
216KB

Download
memory/1572-142-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1572-117-0x0000000005190000-0x00000000051C6000-memory.dmp

Filesize
216KB

Download
memory/1608-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1608-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads