Analysis
-
max time kernel
211s -
max time network
250s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 21:47
Behavioral task
behavioral1
Sample
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe
Resource
win10v2004-20221111-en
General
-
Target
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe
-
Size
315KB
-
MD5
fa7e49c844abb9d84bb581e9d64cbb81
-
SHA1
671f00b6f79cf9822c15d44fbaee804cf8351090
-
SHA256
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a
-
SHA512
955b00f740fbf1378163033dfdd8c0ed7efe95112ce8338eca8d0001e1900e611180c134432ddbb35f77d653573640fab2083ceb1a00a4b74f23b1949c04cc60
-
SSDEEP
6144:lOpslFlq3hdBCkWYxuukP1pjSKSNVkq/MVJbU:lwslmTBd47GLRMTbU
Malware Config
Extracted
cybergate
v1.07.5
Cyber
crusaderthe.no-ip.biz:200
101S2A484O73H7
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule C:\Windows\install\server.exe modiloader_stage2 C:\Windows\install\server.exe modiloader_stage2 C:\Windows\install\server.exe modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Executes dropped EXE 2 IoCs
Processes:
server.exeserver.exepid process 4804 server.exe 3412 server.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{8H85THT8-7MJ0-L546-4520-H2K2G8PGO0WX} 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8H85THT8-7MJ0-L546-4520-H2K2G8PGO0WX}\StubPath = "C:\\Windows\\install\\server.exe Restart" 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Processes:
resource yara_rule behavioral2/memory/4960-139-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4520-142-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4520-144-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4520-147-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe" 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe" 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exeserver.exedescription pid process target process PID 3156 set thread context of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4804 set thread context of 3412 4804 server.exe server.exe -
Drops file in Windows directory 4 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process File opened for modification C:\Windows\install\ 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe File created C:\Windows\install\server.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe File opened for modification C:\Windows\install\server.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe File opened for modification C:\Windows\install\server.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4644 3412 WerFault.exe server.exe -
Modifies registry class 1 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exepid process 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exepid process 4520 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription pid process Token: SeBackupPrivilege 4520 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Token: SeRestorePrivilege 4520 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Token: SeDebugPrivilege 4520 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe Token: SeDebugPrivilege 4520 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exedescription pid process target process PID 3156 wrote to memory of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 3156 wrote to memory of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 3156 wrote to memory of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 3156 wrote to memory of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 3156 wrote to memory of 4960 3156 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe PID 4960 wrote to memory of 4520 4960 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe 82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe"C:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exeC:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe"C:\Users\Admin\AppData\Local\Temp\82064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a.exe"3⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\install\server.exe"C:\Windows\install\server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\install\server.exeC:\Windows\install\server.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 5566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3412 -ip 34121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD5f310fd8e312bd2ca97aa0c1c5cfa99c5
SHA18c8cabd0f5202169233ba30341a383f7466a2bb2
SHA256184a889c0c6c172c1f2340fb3e4b788a9039e9082fc977bb2b1cfc1ee105ae06
SHA5128319590abf7db89f33144673a3d7700550ec5a52fd28c0879f013b922d6e1673274dbc3879375f2bdf25126491eecb5426fc56682072426cd67f13d6ec826779
-
C:\Windows\install\server.exeFilesize
315KB
MD5fa7e49c844abb9d84bb581e9d64cbb81
SHA1671f00b6f79cf9822c15d44fbaee804cf8351090
SHA25682064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a
SHA512955b00f740fbf1378163033dfdd8c0ed7efe95112ce8338eca8d0001e1900e611180c134432ddbb35f77d653573640fab2083ceb1a00a4b74f23b1949c04cc60
-
C:\Windows\install\server.exeFilesize
315KB
MD5fa7e49c844abb9d84bb581e9d64cbb81
SHA1671f00b6f79cf9822c15d44fbaee804cf8351090
SHA25682064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a
SHA512955b00f740fbf1378163033dfdd8c0ed7efe95112ce8338eca8d0001e1900e611180c134432ddbb35f77d653573640fab2083ceb1a00a4b74f23b1949c04cc60
-
C:\Windows\install\server.exeFilesize
315KB
MD5fa7e49c844abb9d84bb581e9d64cbb81
SHA1671f00b6f79cf9822c15d44fbaee804cf8351090
SHA25682064f47eaf532b9a88b9ee5bef3c8a3b4a3b777778f5c61622f27c3942b236a
SHA512955b00f740fbf1378163033dfdd8c0ed7efe95112ce8338eca8d0001e1900e611180c134432ddbb35f77d653573640fab2083ceb1a00a4b74f23b1949c04cc60
-
memory/3412-156-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3412-155-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3412-154-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3412-150-0x0000000000000000-mapping.dmp
-
memory/4520-138-0x0000000000000000-mapping.dmp
-
memory/4520-142-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4520-144-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4520-147-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4804-148-0x0000000000000000-mapping.dmp
-
memory/4960-133-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4960-135-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4960-132-0x0000000000000000-mapping.dmp
-
memory/4960-134-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4960-143-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4960-139-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4960-136-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB