cybergate | 987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005

Analysis

max time kernel
152s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Size

444KB
MD5

da843461c8693ff01265b18571d3c3e2
SHA1

18aa29919a750f8822583e3d31748e1c30dfd06a
SHA256

987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005
SHA512

5c4ce6ccca1d33a749f0d4cff3f937e2cd03ff371dee737471274e54303253be131ba6e600d5ed1d8d43fff0c00b582a2fc4f754a48322fc8962f8eb4bcda030
SSDEEP

6144:ioGD1UV/qdIMdT6SxcSJPQncDRFCCuH8HQKmc6xZfqZA7J:ZQgzMdGSxWURFruH8HQxxJd7J

Score

10^/10

cybergate con local persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

con local

127.0.0.1:3333

Mutex

sbbbvkljlñ

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
barrilete
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Executes dropped EXE 2 IoCs

pid	Process
1208	server.exe
3376	server.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T6J351AC-S643-4TAQ-VUAB-5XP56OKP4L02}	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T6J351AC-S643-4TAQ-VUAB-5XP56OKP4L02}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T6J351AC-S643-4TAQ-VUAB-5XP56OKP4L02}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T6J351AC-S643-4TAQ-VUAB-5XP56OKP4L02}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4284-135-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4284-137-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4284-138-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4284-139-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4284-140-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4284-142-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4284-147-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/228-150-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/228-151-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4284-153-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/4284-160-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4660-163-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4284-164-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/4660-165-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/228-166-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4660-167-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3376-177-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3376-178-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3376-179-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral2/memory/3376-180-0x0000000000400000-0x0000000000455000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\install\server.exe	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
File opened for modification	C:\Windows\SysWOW64\install\	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
File created	C:\Windows\SysWOW64\install\server.exe	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 1208 set thread context of 3376	1208	server.exe	90

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\buscaminas.ini	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
File opened for modification	C:\Windows\buscaminas.ini	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	3376	WerFault.exe	90

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4660	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
Token: SeDebugPrivilege	4660	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
1208	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 2092 wrote to memory of 4284	2092	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	82
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54
PID 4284 wrote to memory of 3060	4284	987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060
- C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
  "C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
    C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Modifies Installed Components in the registry
      PID:228
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe
      "C:\Users\Admin\AppData\Local\Temp\987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4660
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Windows\SysWOW64\install\server.exe
        
        C:\Windows\SysWOW64\install\server.exe
        6⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 576
        7⤵
        Program crash
        
        PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3376 -ip 3376
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
229KB

MD5
cb71e0a09a9e79ea09642806c3ffeb07

SHA1
98eab878b4be36a4cc177eb37cdf4a27693d59bf

SHA256
57bc070a0b41e2e8cbf5556ebce28cfa3cd54b9994f3775560d978f68234d016

SHA512
e32825926f3dd6d5830f365340d76e3794090a24fc62c71860b1f089761f3cb785022f54ecd113914321d035e665b14b2d442eb8d2afb8cc83f9e8e8d4e24167

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
444KB

MD5
da843461c8693ff01265b18571d3c3e2

SHA1
18aa29919a750f8822583e3d31748e1c30dfd06a

SHA256
987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005

SHA512
5c4ce6ccca1d33a749f0d4cff3f937e2cd03ff371dee737471274e54303253be131ba6e600d5ed1d8d43fff0c00b582a2fc4f754a48322fc8962f8eb4bcda030

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
444KB

MD5
da843461c8693ff01265b18571d3c3e2

SHA1
18aa29919a750f8822583e3d31748e1c30dfd06a

SHA256
987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005

SHA512
5c4ce6ccca1d33a749f0d4cff3f937e2cd03ff371dee737471274e54303253be131ba6e600d5ed1d8d43fff0c00b582a2fc4f754a48322fc8962f8eb4bcda030

Download Submit
C:\Windows\SysWOW64\install\server.exe

Filesize
444KB

MD5
da843461c8693ff01265b18571d3c3e2

SHA1
18aa29919a750f8822583e3d31748e1c30dfd06a

SHA256
987c1596286fc27307ddd2b9deedb71d01a2d24664ba453bdaeba54a576b0005

SHA512
5c4ce6ccca1d33a749f0d4cff3f937e2cd03ff371dee737471274e54303253be131ba6e600d5ed1d8d43fff0c00b582a2fc4f754a48322fc8962f8eb4bcda030

Download Submit
C:\Windows\buscaminas.ini

Filesize
131B

MD5
26dab844beb1c3502c78c5ccb6d00474

SHA1
2f45ff77e7ab17812ed36c6ab13772b7197d638f

SHA256
2f2cf1938aa57fb23a4d9bcb6f28ffc80a89f02bbb37fefca93c4bd41475e500

SHA512
b458a4912e5d1e0b9b2fdbd2efdded3f7e89b69bd9b17f3a92e620f2376d72d87dbf38302c463447131333ea7629866b69af58ed5c972c9a22438f648d62dac6

Download Submit
memory/228-151-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/228-166-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/228-150-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/3376-180-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3376-177-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3376-178-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3376-179-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-139-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-160-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4284-164-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-153-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/4284-147-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4284-140-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-138-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-137-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4284-142-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4284-135-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4660-167-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4660-165-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4660-163-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download