cybergate | 8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57

General

Target

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Size

825KB
MD5

a8f080371495aa716102d7c95b8d45c1
SHA1

1c262215b12ff7740110ca16fd06e371ad196c79
SHA256

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57
SHA512

6e8f1b6ed89f9f9dca1f58f3f043faad4c15f418c0ac1a93a42cd5cb17c6ad6690a02f22ca3b7e6778812b9b8b5b356fac7364a71a63aa0cbf23cf0946d9893e
SSDEEP

12288:CcD663gTSP7VMTN6CGBkGC9hVwv03PfgjXir0hPVZXKB8VKO8KdRZ2zkPaCxm:CbmVu6CGBpurpRmtds8VV8KdRZOklQ

Score

10^/10

cybergate youtube persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

YouTube

C2

magaiver2.no-ip.org:2000

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
avast.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
123
regkey_hkcu
Win32
regkey_hklm
Win32

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\avast.exe"	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\avast.exe"	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Executes dropped EXE 2 IoCs

Processes:

Hack AwaY.exeavast.exe

pid process

1576 Hack AwaY.exe
2944 avast.exe

pid	process
1576	Hack AwaY.exe
2944	avast.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H503LAE3-66QL-D6M4-S87M-8GJ38K6L4834}	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H503LAE3-66QL-D6M4-S87M-8GJ38K6L4834}\StubPath = "C:\\Windows\\system32\\install\\avast.exe Restart"	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H503LAE3-66QL-D6M4-S87M-8GJ38K6L4834}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H503LAE3-66QL-D6M4-S87M-8GJ38K6L4834}\StubPath = "C:\\Windows\\system32\\install\\avast.exe"	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1268-133-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/1268-138-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4228-141-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4228-144-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1268-146-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/1268-151-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3364-154-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3364-158-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/3364-159-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system32\\install\\avast.exe"	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system32\\install\\avast.exe"	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Drops file in System32 directory 4 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\install\avast.exe	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
File opened for modification	C:\Windows\SysWOW64\install\	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
File created	C:\Windows\SysWOW64\install\avast.exe	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
File opened for modification	C:\Windows\SysWOW64\install\avast.exe	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Drops file in Windows directory 1 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description ioc process

File created C:\Windows\Hack AwaY.exe 8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2760 2944 WerFault.exe avast.exe

description	ioc	process
File created	C:\Windows\Hack AwaY.exe	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

pid	pid_target	process	target process
2760	2944	WerFault.exe	avast.exe

Modifies registry class 1 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

pid process

3364 8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

pid	process
3364	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	pid	process
Token: SeDebugPrivilege	3364	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
Token: SeDebugPrivilege	3364	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

pid process

1268 8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

pid	process
1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe

description	pid	process	target process
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE
PID 1268 wrote to memory of 1032	1268	8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
"C:\Users\Admin\AppData\Local\Temp\8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies Installed Components in the registry
PID:4228

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe
"C:\Users\Admin\AppData\Local\Temp\8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57.exe"
3⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\Hack AwaY.exe
"C:\Windows\Hack AwaY.exe"
4⤵
- Executes dropped EXE
PID:1576

C:\Windows\SysWOW64\install\avast.exe
"C:\Windows\system32\install\avast.exe"
4⤵
- Executes dropped EXE
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 564
5⤵
- Program crash
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
1⤵
PID:2436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
767KB

MD5
eacc562e186dd6b98889f8fe750a10b0

SHA1
3cec5ca9e2c3108d84c6cd194966459857dcac33

SHA256
4ec7772c50c9b8fdf765ad2cddec025e2966cb9da34c1257d2a4d26b626df7f8

SHA512
dba3ba301c8c0fb5690820d8875e232976da9a03ab400e09c9a547365b4f40ca2a195be9eaa319887ec1f702cf146a9cbb52044d033b36afd797bac6b442b799

Download Submit
C:\Windows\Hack AwaY.exe
Filesize
538KB

MD5
42944071915870b3694d04447647d701

SHA1
f3b3f749c74e822caea876bbd33440ecbcc1ed3a

SHA256
fb477c66169a0c7d4c05982f2a2fe26b5828cd64d6d15e24b345ab88e188ed86

SHA512
919f9b5eba155239d093388c0b613d6c97f3e96905541dcab9de159a88432c7bd5b4226ce38dd432c8421d13f1c847afb1d90a5dca7948b7eb214c33d1d07a3d

Download Submit
C:\Windows\Hack AwaY.exe
Filesize
538KB

MD5
42944071915870b3694d04447647d701

SHA1
f3b3f749c74e822caea876bbd33440ecbcc1ed3a

SHA256
fb477c66169a0c7d4c05982f2a2fe26b5828cd64d6d15e24b345ab88e188ed86

SHA512
919f9b5eba155239d093388c0b613d6c97f3e96905541dcab9de159a88432c7bd5b4226ce38dd432c8421d13f1c847afb1d90a5dca7948b7eb214c33d1d07a3d

Download Submit
C:\Windows\SysWOW64\install\avast.exe
Filesize
825KB

MD5
a8f080371495aa716102d7c95b8d45c1

SHA1
1c262215b12ff7740110ca16fd06e371ad196c79

SHA256
8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57

SHA512
6e8f1b6ed89f9f9dca1f58f3f043faad4c15f418c0ac1a93a42cd5cb17c6ad6690a02f22ca3b7e6778812b9b8b5b356fac7364a71a63aa0cbf23cf0946d9893e

Download Submit
C:\Windows\SysWOW64\install\avast.exe
Filesize
825KB

MD5
a8f080371495aa716102d7c95b8d45c1

SHA1
1c262215b12ff7740110ca16fd06e371ad196c79

SHA256
8603885c3a86ce815f630bdc10c7ac44a558c62df89bac5c3a850902f3680f57

SHA512
6e8f1b6ed89f9f9dca1f58f3f043faad4c15f418c0ac1a93a42cd5cb17c6ad6690a02f22ca3b7e6778812b9b8b5b356fac7364a71a63aa0cbf23cf0946d9893e

Download Submit
memory/1268-151-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1268-138-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1268-146-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1268-133-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1576-165-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/1576-164-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/1576-163-0x0000000004EC0000-0x0000000004F5C000-memory.dmp

Filesize
624KB

Download
memory/1576-155-0x0000000000000000-mapping.dmp

Download
memory/1576-160-0x00000000004A0000-0x000000000052E000-memory.dmp

Filesize
568KB

Download
memory/1576-167-0x0000000005310000-0x0000000005366000-memory.dmp

Filesize
344KB

Download
memory/1576-166-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

Filesize
40KB

Download
memory/2944-161-0x0000000000000000-mapping.dmp

Download
memory/3364-159-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3364-158-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3364-154-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/3364-150-0x0000000000000000-mapping.dmp

Download
memory/4228-144-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4228-141-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4228-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads