cybergate | 80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9

Analysis

max time kernel
245s
max time network
246s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Size

301KB
MD5

56bf4907b262062b8cfb118313856c41
SHA1

6fadba4362f9bce239d59737835d35dc7de24ce8
SHA256

80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9
SHA512

7bea0ffd0abfc2e19bed9691e7db5da19020d694b5920815e38363fe86d78f16bdd531a3ab9f32a2f3ab5a3165fdb18deeca0e8f6411c688a9f31517b7e43618
SSDEEP

6144:hyUQMCgjnpKuPlLTTIw6ldIcaNdptO/hneDkakhmIoLF82:hyUQM/pGldSLptoeDg3IF82

Score

10^/10

cybergate souf aspackv2 persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

souf

mr-souf.no-ip.biz:8080

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_file
windows.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
souf123

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a00000001230a-74.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230a-139.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230a-140.dat	aspack_v212_v242
behavioral1/files/0x000a00000001230a-142.dat	aspack_v212_v242

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe"	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\windows\\system32\\microsoft\\windows.exe"	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Executes dropped EXE 1 IoCs

pid	Process
1572	windows.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe Restart"	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "c:\\windows\\system32\\microsoft\\windows.exe"	explorer.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/268-55-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/268-57-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/268-62-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/268-67-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/588-72-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/files/0x000a00000001230a-74.dat	upx
behavioral1/memory/588-75-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/268-77-0x0000000000360000-0x00000000003C2000-memory.dmp	upx
behavioral1/memory/268-83-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/940-88-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/268-89-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/588-136-0x00000000318F0000-0x00000000318FD000-memory.dmp	upx
behavioral1/memory/940-137-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/940-138-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/files/0x000a00000001230a-139.dat	upx
behavioral1/files/0x000a00000001230a-140.dat	upx
behavioral1/files/0x000a00000001230a-142.dat	upx
behavioral1/memory/940-147-0x00000000068F0000-0x0000000006951000-memory.dmp	upx
behavioral1/memory/1572-148-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/1572-149-0x0000000031900000-0x000000003190D000-memory.dmp	upx
behavioral1/memory/1572-150-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/1572-151-0x0000000031900000-0x000000003190D000-memory.dmp	upx
behavioral1/memory/588-152-0x00000000318F0000-0x00000000318FD000-memory.dmp	upx
behavioral1/memory/940-153-0x00000000240F0000-0x0000000024152000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\microsoft\	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
File created	\??\c:\windows\SysWOW64\microsoft\windows.exe	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
File opened for modification	\??\c:\windows\SysWOW64\microsoft\windows.exe	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
File opened for modification	\??\c:\windows\SysWOW64\microsoft\windows.exe	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
Token: SeDebugPrivilege	940	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15
PID 268 wrote to memory of 1244	268	80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe	15

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1084
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:484
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1140
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1072
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1032
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:884
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:860
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:816
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:772
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:684
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:608

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1916

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1980

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
  "C:\Users\Admin\AppData\Local\Temp\80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:588
- - C:\Users\Admin\AppData\Local\Temp\80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe
    "C:\Users\Admin\AppData\Local\Temp\80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:940
  - - C:\windows\SysWOW64\microsoft\windows.exe
      "C:\windows\system32\microsoft\windows.exe"
      4⤵
      Executes dropped EXE
      PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
240KB

MD5
f19a4a3cc0a7bfb9cc8ef0f6999584e1

SHA1
f237e895e329b355a6af0134e17d50ad05b3ef35

SHA256
05a8eb1d22eeab478b6ae5d69f2e719eeb33e88eeeb80513a2ef22351a6ea275

SHA512
5fc8b0ec8fa43bd6a20ce2dd35374874f49216f3ca0e383088831c3055373e730bc412f8d6503f68f70b4f9d2528e73125efbb506ed787e7c1151562f836d1a3

Download Submit
C:\Windows\SysWOW64\microsoft\windows.exe

Filesize
301KB

MD5
56bf4907b262062b8cfb118313856c41

SHA1
6fadba4362f9bce239d59737835d35dc7de24ce8

SHA256
80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9

SHA512
7bea0ffd0abfc2e19bed9691e7db5da19020d694b5920815e38363fe86d78f16bdd531a3ab9f32a2f3ab5a3165fdb18deeca0e8f6411c688a9f31517b7e43618

Download Submit
\??\c:\windows\SysWOW64\microsoft\windows.exe

Filesize
301KB

MD5
56bf4907b262062b8cfb118313856c41

SHA1
6fadba4362f9bce239d59737835d35dc7de24ce8

SHA256
80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9

SHA512
7bea0ffd0abfc2e19bed9691e7db5da19020d694b5920815e38363fe86d78f16bdd531a3ab9f32a2f3ab5a3165fdb18deeca0e8f6411c688a9f31517b7e43618

Download Submit
\Windows\SysWOW64\microsoft\windows.exe

Filesize
301KB

MD5
56bf4907b262062b8cfb118313856c41

SHA1
6fadba4362f9bce239d59737835d35dc7de24ce8

SHA256
80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9

SHA512
7bea0ffd0abfc2e19bed9691e7db5da19020d694b5920815e38363fe86d78f16bdd531a3ab9f32a2f3ab5a3165fdb18deeca0e8f6411c688a9f31517b7e43618

Download Submit
\Windows\SysWOW64\microsoft\windows.exe

Filesize
301KB

MD5
56bf4907b262062b8cfb118313856c41

SHA1
6fadba4362f9bce239d59737835d35dc7de24ce8

SHA256
80ade96133506fef492f5b4d55d61bcaf09b8f2ad7287336f3d2aa00dd8109f9

SHA512
7bea0ffd0abfc2e19bed9691e7db5da19020d694b5920815e38363fe86d78f16bdd531a3ab9f32a2f3ab5a3165fdb18deeca0e8f6411c688a9f31517b7e43618

Download Submit
memory/260-90-0x0000000031770000-0x000000003177D000-memory.dmp

Filesize
52KB

Download
memory/268-89-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/268-83-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/268-67-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/268-62-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/268-57-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/268-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/268-77-0x0000000000360000-0x00000000003C2000-memory.dmp

Filesize
392KB

Download
memory/268-55-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/588-152-0x00000000318F0000-0x00000000318FD000-memory.dmp

Filesize
52KB

Download
memory/588-75-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/588-66-0x0000000075261000-0x0000000075263000-memory.dmp

Filesize
8KB

Download
memory/588-136-0x00000000318F0000-0x00000000318FD000-memory.dmp

Filesize
52KB

Download
memory/588-72-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/940-137-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/940-138-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/940-88-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/940-147-0x00000000068F0000-0x0000000006951000-memory.dmp

Filesize
388KB

Download
memory/940-153-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/940-154-0x00000000068F0000-0x0000000006951000-memory.dmp

Filesize
388KB

Download
memory/1244-60-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1572-148-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1572-149-0x0000000031900000-0x000000003190D000-memory.dmp

Filesize
52KB

Download
memory/1572-150-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1572-151-0x0000000031900000-0x000000003190D000-memory.dmp

Filesize
52KB

Download