cybergate | c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1

General

Target

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Size

650KB
MD5

0fb32a643952a687bbaf7ab13f29abda
SHA1

7afd8e39e967ca86261d85269c0a96a12183e9e1
SHA256

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1
SHA512

3041eebbed86b7d12439aa3b7b58487d3d8fbb1ec1eee7dacb0c1e5a2edb3b26557c95febf51de31fdf9fbd7dce194e8807f0619f16f9aefc617f1bff58e7630
SSDEEP

12288:YHLUMuiv9RgfSjAzRtyQpNemrMqcWzYXO8lU/rpq:itARXPe5einU/rpq

Score

10^/10

cybergate spy persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

SPY

C2

compartilhar.no-ip.org:1338

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Arquivo Corrompido !!
message_box_title
Erro dll
password
invasor

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Executes dropped EXE 2 IoCs

Processes:

server.exeserver.exe

pid process

4804 server.exe
3840 server.exe

pid	process
4804	server.exe
3840	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCF2GOH1-NC1O-0E45-J1P8-UF5YKDJS1XMS}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCF2GOH1-NC1O-0E45-J1P8-UF5YKDJS1XMS}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCF2GOH1-NC1O-0E45-J1P8-UF5YKDJS1XMS}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{KCF2GOH1-NC1O-0E45-J1P8-UF5YKDJS1XMS}	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4532-132-0x0000000000400000-0x00000000004DA000-memory.dmp	upx
behavioral2/memory/4532-136-0x0000000000400000-0x00000000004DA000-memory.dmp	upx
behavioral2/memory/1880-141-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/1880-146-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1044-149-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
C:\Windows\SysWOW64\install\server.exe	upx
behavioral2/memory/1044-152-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1880-154-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/3984-159-0x0000000000400000-0x00000000004DA000-memory.dmp	upx
behavioral2/memory/1880-160-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3984-163-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3984-165-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
C:\Windows\SysWOW64\install\server.exe	upx
C:\Windows\SysWOW64\install\server.exe	upx
behavioral2/memory/4804-172-0x0000000000400000-0x00000000004DA000-memory.dmp	upx
behavioral2/memory/3984-175-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4532-132-0x0000000000400000-0x00000000004DA000-memory.dmp	autoit_exe
behavioral2/memory/4532-136-0x0000000000400000-0x00000000004DA000-memory.dmp	autoit_exe
behavioral2/memory/4804-172-0x0000000000400000-0x00000000004DA000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exec3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\install\	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
File created	C:\Windows\SysWOW64\install\server.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exeserver.exe

description	pid	process	target process
PID 4532 set thread context of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4804 set thread context of 3840	4804	server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4048 3840 WerFault.exe server.exe

pid	pid_target	process	target process
4048	3840	WerFault.exe	server.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

pid	process
1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

pid process

3984 c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

pid	process
3984	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

description	pid	process
Token: SeDebugPrivilege	3984	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
Token: SeDebugPrivilege	3984	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

pid process

1880 c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exec3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe

description	pid	process	target process
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 4532 wrote to memory of 1880	4532	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE
PID 1880 wrote to memory of 2376	1880	c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2376

C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
"C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4532

C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
"C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe"
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
PID:1044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe
"C:\Users\Admin\AppData\Local\Temp\c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1.exe"
4⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4804

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\SysWOW64\install\server.exe"
6⤵
- Executes dropped EXE
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 572
7⤵
- Program crash
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3840 -ip 3840
1⤵
PID:4228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
f13314d536a75037e9f15b423e5f1337

SHA1
e62d53e87fd73a1bb074f3da00f94b7632232221

SHA256
f496f51297be20c4ae3dfa125e3eb0e0d07034074f22ea799d1bc5789ba737a3

SHA512
0d9451a1c953b5b1121eb397850818e27470f2f1cdfe5a0e16d56c8200d362049b0692064cbe45099bdbae6d3f1b7e671dbabee8d5a9ba91fcca5b2d5a12117e

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
650KB

MD5
0fb32a643952a687bbaf7ab13f29abda

SHA1
7afd8e39e967ca86261d85269c0a96a12183e9e1

SHA256
c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1

SHA512
3041eebbed86b7d12439aa3b7b58487d3d8fbb1ec1eee7dacb0c1e5a2edb3b26557c95febf51de31fdf9fbd7dce194e8807f0619f16f9aefc617f1bff58e7630

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
650KB

MD5
0fb32a643952a687bbaf7ab13f29abda

SHA1
7afd8e39e967ca86261d85269c0a96a12183e9e1

SHA256
c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1

SHA512
3041eebbed86b7d12439aa3b7b58487d3d8fbb1ec1eee7dacb0c1e5a2edb3b26557c95febf51de31fdf9fbd7dce194e8807f0619f16f9aefc617f1bff58e7630

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
650KB

MD5
0fb32a643952a687bbaf7ab13f29abda

SHA1
7afd8e39e967ca86261d85269c0a96a12183e9e1

SHA256
c3ea96e56df3112f27c711e90fc770b12e3586e2d91d295b90441e62291506f1

SHA512
3041eebbed86b7d12439aa3b7b58487d3d8fbb1ec1eee7dacb0c1e5a2edb3b26557c95febf51de31fdf9fbd7dce194e8807f0619f16f9aefc617f1bff58e7630

Download Submit
memory/1044-145-0x0000000000000000-mapping.dmp

Download
memory/1044-152-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1044-149-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1880-139-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-134-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-133-0x0000000000000000-mapping.dmp

Download
memory/1880-146-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1880-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-141-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1880-135-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-154-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1880-164-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1880-160-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3840-168-0x0000000000000000-mapping.dmp

Download
memory/3840-173-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3840-174-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3984-159-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/3984-158-0x0000000000000000-mapping.dmp

Download
memory/3984-163-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3984-165-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3984-175-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4532-136-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4532-132-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4804-166-0x0000000000000000-mapping.dmp

Download
memory/4804-172-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads