cybergate | c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

Analysis

max time kernel
149s
max time network
129s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Size

276KB
MD5

0056b497159f93ccb8deb9740c198000
SHA1

a211fc148ab55dccc185653e011d5126efac52cf
SHA256

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3
SHA512

39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b
SSDEEP

6144:Fk4qmfH1YkipdjvH9akfWs7px/ymnkxTsIg2FQJe1VKVgAJ:C9y1YkkvH9aAywkxThQJe/AF

Score

10^/10

cybergate victima persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victima

hackerholodm.sytes.net:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
spynet
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Este Programa No Funciona En Este PC
message_box_title
Windows
password
12345
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exeserver.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\spynet\\server.exe"	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\spynet\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

Executes dropped EXE 3 IoCs

Processes:

server.exeserver.exeserver.exe

pid process

2020 server.exe
2000 server.exe
1552 server.exe

pid	process
2020	server.exe
2000	server.exe
1552	server.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exec818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\spynet\\server.exe Restart"	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe Restart"	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{RU26QGPX-0331-U150-K5S8-V11O3N4B415Q}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1352-55-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1352-57-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1352-66-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/660-71-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
C:\Windows\SysWOW64\spynet\server.exe	upx
behavioral1/memory/660-74-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1352-76-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1352-82-0x00000000002B0000-0x0000000000307000-memory.dmp	upx
behavioral1/memory/1728-83-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1352-84-0x0000000000400000-0x0000000000457000-memory.dmp	upx
\Windows\SysWOW64\spynet\server.exe	upx
behavioral1/memory/660-86-0x00000000032A0000-0x00000000032F7000-memory.dmp	upx
\Windows\SysWOW64\spynet\server.exe	upx
behavioral1/memory/1352-91-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
C:\Windows\SysWOW64\spynet\server.exe	upx
behavioral1/memory/1728-97-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1352-96-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-99-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/2020-98-0x0000000000400000-0x0000000000457000-memory.dmp	upx
C:\Windows\SysWOW64\spynet\server.exe	upx
behavioral1/memory/2000-107-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2020-108-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2020-113-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2000-115-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1728-116-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
\Users\Admin\AppData\Roaming\spynet\server.exe	upx
C:\Users\Admin\AppData\Roaming\spynet\server.exe	upx
\Users\Admin\AppData\Roaming\spynet\server.exe	upx
behavioral1/memory/1552-123-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1552-124-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2000-125-0x0000000024080000-0x00000000240E2000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

explorer.exeserver.exe

pid process

660 explorer.exe
660 explorer.exe
2000 server.exe
2000 server.exe

pid	process
660	explorer.exe
660	explorer.exe
2000	server.exe
2000	server.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exeserver.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\spynet\\server.exe"	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	server.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\spynet\\server.exe"	server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\spynet\\server.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

Drops file in System32 directory 4 IoCs

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exeserver.exe

description	ioc	process
File created	C:\Windows\SysWOW64\spynet\server.exe	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	server.exe
File created	C:\Windows\SysWOW64\spynet\server.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exeserver.exe

pid process

1352 c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
2020 server.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe

pid process

1352 c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe

pid	process
1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
2020	server.exe

pid	process
1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe

description	pid	process	target process
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE
PID 1352 wrote to memory of 1284	1352	c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
"C:\Users\Admin\AppData\Local\Temp\c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
PID:660

C:\Windows\SysWOW64\spynet\server.exe
"C:\Windows\system32\spynet\server.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1924

C:\Windows\SysWOW64\spynet\server.exe
"C:\Windows\SysWOW64\spynet\server.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000

C:\Users\Admin\AppData\Roaming\spynet\server.exe
"C:\Users\Admin\AppData\Roaming\spynet\server.exe"
6⤵
- Executes dropped EXE
PID:1552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe
"C:\Users\Admin\AppData\Local\Temp\c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3.exe"
3⤵
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
a1ba263a25a2eced8a2daad491cdee38

SHA1
8970f5a46fec46b13f8614354146b144a5912bb3

SHA256
f2770708c64e41dff45e06ecda77ab88773c531821c0ee1060a7822791beccf2

SHA512
38baae862a0df3a913746b79d2ba1e79fbd1955f9a88bdd55aaf5cf8421173f242d0e63e8293b5f270be4c3678045e5f238a216c57b4f5c7ce6066dfdae3b8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
229KB

MD5
6d17c8a1dbdde89394c95058797c13c0

SHA1
f76249aa583009bee00e8f12588530be42f8495f

SHA256
93e2e6db66b4abeb8a84fe063fa4cde49d77a551fdacaf90021f92c81cff9e38

SHA512
b7de9a0dce0a6beae8018defe46c32f886053baa823fc265442695f5b13adf05f4f555405687ce644985038254017aa7937bdbf0a72f713f84b28622b2b19383

Download Submit
C:\Users\Admin\AppData\Roaming\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
C:\Windows\SysWOW64\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
C:\Windows\SysWOW64\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
C:\Windows\SysWOW64\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
\Users\Admin\AppData\Roaming\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
\Users\Admin\AppData\Roaming\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
\Windows\SysWOW64\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
\Windows\SysWOW64\spynet\server.exe
Filesize
276KB

MD5
0056b497159f93ccb8deb9740c198000

SHA1
a211fc148ab55dccc185653e011d5126efac52cf

SHA256
c818c56254fb99bcbfd68645aaec23996335876b0e03616b3e87da2992d983f3

SHA512
39d9758e68afa3e240b84473d7cd7514ec45fdf106cbc2fcf24fd5c2462bbe5accfd748c56a9581fea2d542251748e9a327c4c21fff7e0ac7c498398c1080c0b

Download Submit
memory/660-65-0x0000000074FE1000-0x0000000074FE3000-memory.dmp

Filesize
8KB

Download
memory/660-71-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/660-63-0x0000000000000000-mapping.dmp

Download
memory/660-74-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/660-86-0x00000000032A0000-0x00000000032F7000-memory.dmp

Filesize
348KB

Download
memory/1284-60-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1352-66-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1352-84-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1352-82-0x00000000002B0000-0x0000000000307000-memory.dmp

Filesize
348KB

Download
memory/1352-91-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1352-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1352-96-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1352-76-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1352-57-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1352-55-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1552-123-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1552-124-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-97-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1728-116-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1728-80-0x0000000000000000-mapping.dmp

Download
memory/1728-83-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-99-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/2000-115-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2000-107-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2000-105-0x0000000000000000-mapping.dmp

Download
memory/2000-121-0x0000000005CC0000-0x0000000005D17000-memory.dmp

Filesize
348KB

Download
memory/2000-122-0x0000000005CC0000-0x0000000005D17000-memory.dmp

Filesize
348KB

Download
memory/2000-125-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2000-126-0x0000000005CC0000-0x0000000005D17000-memory.dmp

Filesize
348KB

Download
memory/2000-127-0x0000000005CC0000-0x0000000005D17000-memory.dmp

Filesize
348KB

Download
memory/2020-98-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2020-88-0x0000000000000000-mapping.dmp

Download
memory/2020-113-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2020-108-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download