cybergate | 6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317

General

Target

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Size

321KB
MD5

848271008cf08b94f60a3c490c4f1cd0
SHA1

406499c1835d7793af780c952d571e294328939c
SHA256

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317
SHA512

7b795cdaae48a55133d964ad3c0b91fd8f9ef0e93ae8ab53cb47b7dd87bb3f6c51405637afa8b0dbeb85f5744aa08db362bd09f9f3bdfb841e88d8401463e270
SSDEEP

6144:Sb8KgFXihaVPhsHMwq2VWU/5kWjRJHbBYseP4fJpS9snJ4rbDMf1x:SbDgFXdvwq2VWS9YuJp5n+DOx

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Victima

C2

legnalive.no-ip.info:3561

Mutex

33778157BPB72X

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system32
install_file
vmplayer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\vmplayer.exe"	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\vmplayer.exe"	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Executes dropped EXE 2 IoCs

Processes:

vmplayer.exevmplayer.exe

pid process

1704 vmplayer.exe
3848 vmplayer.exe

pid	process
1704	vmplayer.exe
3848	vmplayer.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6OW1IL35-210H-I6E5-VF1I-7007NX11X638}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6OW1IL35-210H-I6E5-VF1I-7007NX11X638}\StubPath = "C:\\Windows\\system32\\system32\\vmplayer.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6OW1IL35-210H-I6E5-VF1I-7007NX11X638}	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6OW1IL35-210H-I6E5-VF1I-7007NX11X638}\StubPath = "C:\\Windows\\system32\\system32\\vmplayer.exe Restart"	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4880-140-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/4880-145-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2724-148-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2724-151-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4880-153-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral2/memory/4880-158-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/2108-161-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/2108-163-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/2108-175-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\system32\\vmplayer.exe"	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\system32\\vmplayer.exe"	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Drops file in System32 directory 5 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exevmplayer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\system32\vmplayer.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
File opened for modification	C:\Windows\SysWOW64\system32\vmplayer.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
File opened for modification	C:\Windows\SysWOW64\system32\vmplayer.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
File opened for modification	C:\Windows\SysWOW64\system32\	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
File opened for modification	C:\Windows\SysWOW64\system32\vmplayer.exe	vmplayer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exevmplayer.exe

description	pid	process	target process
PID 3564 set thread context of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 1704 set thread context of 3848	1704	vmplayer.exe	vmplayer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1272 3848 WerFault.exe vmplayer.exe

pid	pid_target	process	target process
1272	3848	WerFault.exe	vmplayer.exe

Modifies registry class 1 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

pid	process
4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

pid process

2108 6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

pid	process
2108	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exe6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	pid	process
Token: SeBackupPrivilege	2724	explorer.exe
Token: SeRestorePrivilege	2724	explorer.exe
Token: SeBackupPrivilege	2108	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Token: SeRestorePrivilege	2108	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Token: SeDebugPrivilege	2108	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Token: SeDebugPrivilege	2108	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

pid process

4880 6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exevmplayer.exe

pid process

3564 6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
1704 vmplayer.exe

pid	process
3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
1704	vmplayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe

description	pid	process	target process
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 3564 wrote to memory of 4880	3564	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE
PID 4880 wrote to memory of 3048	4880	6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
"C:\Users\Admin\AppData\Local\Temp\6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Local\Temp\6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe
"C:\Users\Admin\AppData\Local\Temp\6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317.exe"
3⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\SysWOW64\system32\vmplayer.exe
"C:\Windows\system32\system32\vmplayer.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\SysWOW64\system32\vmplayer.exe
5⤵
- Executes dropped EXE
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 576
6⤵
- Program crash
PID:1272

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3848 -ip 3848
1⤵
PID:684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
8e9385a8338db2dc1efa12f4afdbbe59

SHA1
56798ed3a0e01f96e42148788d14a7b6241f0cbc

SHA256
abfca10e7e311aeba8d7ce430ead1d5b0d5a8e59e3fe441a671b59aa449d4751

SHA512
76bae93fd1424b300dd2d520da5ac609e32c13379803cd0980fb5824430029f3ac03e68fdbf93bfeeda697de066473becd5b31ee32b502ccb85c85fc44f5be73

Download Submit
C:\Windows\SysWOW64\system32\vmplayer.exe
Filesize
321KB

MD5
848271008cf08b94f60a3c490c4f1cd0

SHA1
406499c1835d7793af780c952d571e294328939c

SHA256
6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317

SHA512
7b795cdaae48a55133d964ad3c0b91fd8f9ef0e93ae8ab53cb47b7dd87bb3f6c51405637afa8b0dbeb85f5744aa08db362bd09f9f3bdfb841e88d8401463e270

Download Submit
C:\Windows\SysWOW64\system32\vmplayer.exe
Filesize
321KB

MD5
848271008cf08b94f60a3c490c4f1cd0

SHA1
406499c1835d7793af780c952d571e294328939c

SHA256
6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317

SHA512
7b795cdaae48a55133d964ad3c0b91fd8f9ef0e93ae8ab53cb47b7dd87bb3f6c51405637afa8b0dbeb85f5744aa08db362bd09f9f3bdfb841e88d8401463e270

Download Submit
C:\Windows\SysWOW64\system32\vmplayer.exe
Filesize
321KB

MD5
848271008cf08b94f60a3c490c4f1cd0

SHA1
406499c1835d7793af780c952d571e294328939c

SHA256
6bbb845d60a2ed15f707dcc91f1f72bae98dad0cce35469449211426f84b7317

SHA512
7b795cdaae48a55133d964ad3c0b91fd8f9ef0e93ae8ab53cb47b7dd87bb3f6c51405637afa8b0dbeb85f5744aa08db362bd09f9f3bdfb841e88d8401463e270

Download Submit
memory/1704-164-0x0000000000000000-mapping.dmp

Download
memory/2108-175-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/2108-163-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/2108-161-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/2108-157-0x0000000000000000-mapping.dmp

Download
memory/2724-144-0x0000000000000000-mapping.dmp

Download
memory/2724-151-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2724-148-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/3848-168-0x0000000000000000-mapping.dmp

Download
memory/3848-174-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3848-173-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3848-172-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4880-158-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4880-140-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/4880-138-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4880-137-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4880-134-0x0000000000000000-mapping.dmp

Download
memory/4880-136-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4880-162-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4880-145-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4880-153-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/4880-135-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads