cybergate | d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede

General

Target

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Size

306KB
MD5

cd59b7f54511d626a7131abac83c6fd9
SHA1

8b4606d8619c3028cc5f3991c8e473a6119da9fb
SHA256

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede
SHA512

7c4fa737e325e31b3399adf70598060fadcaff7a7bdb831bbf664f7c5481e0021e5514573849fef8c81897e55455361574af0228e266c13d3f257e6aeedd0f3d
SSDEEP

6144:WABdcELRn5dxL2Ovgl3IFTBSGeXu0G8VukmoSlGwhaOf0:bZ95dxyOvKIxQhNVch7f0

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

victima

C2

127.0.0.1:81

getlife.zapto.org:8080

title.zapto.org:80

Mutex

tutopine

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
msn
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
angelo5421
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\msn\\server.exe"	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\msn\\server.exe"	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

3124 server.exe
1948 server.exe

pid	process
3124	server.exe
1948	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\msn\\server.exe Restart"	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\msn\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4568-138-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4568-143-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/384-146-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/384-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4568-151-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4568-156-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2040-159-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2040-161-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2040-170-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\msn\\server.exe"	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\msn\\server.exe"	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exeserver.exe

description	pid	process	target process
PID 5096 set thread context of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 3124 set thread context of 1948	3124	server.exe	server.exe

Drops file in Windows directory 4 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exed37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	ioc	process
File opened for modification	C:\Windows\msn\	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
File created	C:\Windows\msn\server.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
File opened for modification	C:\Windows\msn\server.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
File opened for modification	C:\Windows\msn\server.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4340 1948 WerFault.exe server.exe

pid	pid_target	process	target process
4340	1948	WerFault.exe	server.exe

Modifies registry class 1 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

pid	process
4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

pid process

2040 d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

pid	process
2040	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	pid	process
Token: SeDebugPrivilege	2040	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
Token: SeDebugPrivilege	2040	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

pid process

4568 d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exed37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe

description	pid	process	target process
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 5096 wrote to memory of 4568	5096	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE
PID 4568 wrote to memory of 2152	4568	d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2152

C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
"C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
"C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe"
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4908

C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe
"C:\Users\Admin\AppData\Local\Temp\d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede.exe"
4⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\msn\server.exe
"C:\Windows\msn\server.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3124

C:\Windows\msn\server.exe
"C:\Windows\msn\server.exe"
6⤵
- Executes dropped EXE
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 532
7⤵
- Program crash
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1948 -ip 1948
1⤵
PID:3412

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
d7221ac419a18f29c75c4b0202c15f2e

SHA1
c228785c61e602274bdc7e23f20fd577aa171adf

SHA256
280a3396c8dea8e302a3f697b4ebba892eb6721364dd9c925e6a829be353ff08

SHA512
5cad99beffd49d89486c3b51a091d77bc02aad693730c1625880877847f66d9241f7372fa23fd86f90346d229dfc941dae1227dd3e3a812f96b5f5dbb571120c

Download Submit
C:\Windows\msn\server.exe
Filesize
306KB

MD5
cd59b7f54511d626a7131abac83c6fd9

SHA1
8b4606d8619c3028cc5f3991c8e473a6119da9fb

SHA256
d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede

SHA512
7c4fa737e325e31b3399adf70598060fadcaff7a7bdb831bbf664f7c5481e0021e5514573849fef8c81897e55455361574af0228e266c13d3f257e6aeedd0f3d

Download Submit
C:\Windows\msn\server.exe
Filesize
306KB

MD5
cd59b7f54511d626a7131abac83c6fd9

SHA1
8b4606d8619c3028cc5f3991c8e473a6119da9fb

SHA256
d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede

SHA512
7c4fa737e325e31b3399adf70598060fadcaff7a7bdb831bbf664f7c5481e0021e5514573849fef8c81897e55455361574af0228e266c13d3f257e6aeedd0f3d

Download Submit
C:\Windows\msn\server.exe
Filesize
306KB

MD5
cd59b7f54511d626a7131abac83c6fd9

SHA1
8b4606d8619c3028cc5f3991c8e473a6119da9fb

SHA256
d37d6f7f1fe1a171225f9768e12bc1bc7b2cd099a64c0a64fd89f45ffcabeede

SHA512
7c4fa737e325e31b3399adf70598060fadcaff7a7bdb831bbf664f7c5481e0021e5514573849fef8c81897e55455361574af0228e266c13d3f257e6aeedd0f3d

Download Submit
memory/384-142-0x0000000000000000-mapping.dmp

Download
memory/384-146-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/384-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1948-164-0x0000000000000000-mapping.dmp

Download
memory/1948-168-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1948-169-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2040-159-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2040-170-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2040-161-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2040-155-0x0000000000000000-mapping.dmp

Download
memory/3124-162-0x0000000000000000-mapping.dmp

Download
memory/4568-160-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4568-156-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4568-151-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4568-132-0x0000000000000000-mapping.dmp

Download
memory/4568-143-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4568-138-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4568-136-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4568-135-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4568-134-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4568-133-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads