cybergate | b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

Analysis

max time kernel
149s
max time network
189s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe
Size

336KB
MD5

8491bfa7c5d336e2111585a4def24ba0
SHA1

fb2ee6411f1075b813ca300046a0ba51d0f44a2f
SHA256

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5
SHA512

d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b
SSDEEP

6144:r3v2Z/M7Tz35V9rDTVFN4HaTyxKq56GhArdjp3JWXiuob0UCI81ibxxdL:T8/Mnz35fDre5BhArdjpJWSu2HTx3L

Score

10^/10

cybergate hack persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

HACK

xxxtheerrorcode.no-ip.biz:3460

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.
message_box_title
Application Error
password
xxxtheerrorcodepasswordnotbefoundpleasetrayagainxxx
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Executes dropped EXE 4 IoCs

Processes:

server.exeserver.EXEserver.exeserver.EXE

pid process

1740 server.exe
1988 server.EXE
332 server.exe
1816 server.EXE

pid	process
1740	server.exe
1988	server.EXE
332	server.exe
1816	server.EXE

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXEexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F11P1570-4615-80K6-1X4W-0IIDB474G218}	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F11P1570-4615-80K6-1X4W-0IIDB474G218}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F11P1570-4615-80K6-1X4W-0IIDB474G218}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F11P1570-4615-80K6-1X4W-0IIDB474G218}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1728-58-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-60-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-61-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-65-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-66-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-67-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-69-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/memory/1728-78-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2040-83-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/2040-86-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1728-87-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1728-90-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral1/memory/1728-115-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1728-120-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/980-121-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1988-122-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/980-123-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral1/memory/1816-142-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1988-143-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/1816-144-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/980-145-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

explorer.exeserver.exeb3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

pid	process
2040	explorer.exe
2040	explorer.exe
1740	server.exe
980	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
980	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Drops file in System32 directory 6 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXEserver.exeb3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXEserver.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\install\	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
File opened for modification	C:\Windows\SysWOW64\install\server.EXE	server.exe
File created	C:\Windows\SysWOW64\install\server.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
File opened for modification	C:\Windows\SysWOW64\install\server.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
File opened for modification	C:\Windows\SysWOW64\install\server.EXE	server.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exeserver.exeserver.exe

description	pid	process	target process
PID 836 set thread context of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 1740 set thread context of 1988	1740	server.exe	server.EXE
PID 332 set thread context of 1816	332	server.exe	server.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXEserver.EXE

pid process

1728 b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
1988 server.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

pid process

980 b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

pid	process
1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
1988	server.EXE

pid	process
980	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

description	pid	process
Token: SeDebugPrivilege	980	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Token: SeDebugPrivilege	980	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

pid process

1728 b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exeserver.exeserver.exe

pid process

836 b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe
1740 server.exe
332 server.exe

pid	process
1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

pid	process
836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe
1740	server.exe
332	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exeb3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE

description	pid	process	target process
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 836 wrote to memory of 1728	836	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE
PID 1728 wrote to memory of 1384	1728	b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE	Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe
"C:\Users\Admin\AppData\Local\Temp\b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
PID:2040

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Windows\SysWOW64\install\server.EXE
server.EXE
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1988

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE
"C:\Users\Admin\AppData\Local\Temp\b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5.EXE"
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\install\server.exe
"C:\Windows\system32\install\server.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:332

C:\Windows\SysWOW64\install\server.EXE
server.EXE
5⤵
- Executes dropped EXE
PID:1816

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
230KB

MD5
16214d0d0d43c50d482fdba4b511424a

SHA1
3da6940bae50044df3a0b4165e9bafd2ad4e3be8

SHA256
41d3a377da03c2c00808abfd0829ad4d6127eefc79c647083d70fa8b996c8dba

SHA512
1f20c4eb38a21b443ddcc1f55350740576f8fc37b00227bb047d40c958af44d662f8c7b5b85d34cee7376215c6376405d8332d62995e33c9d60bb88247d3442d

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
C:\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
\Windows\SysWOW64\install\server.exe
Filesize
336KB

MD5
8491bfa7c5d336e2111585a4def24ba0

SHA1
fb2ee6411f1075b813ca300046a0ba51d0f44a2f

SHA256
b3b162ecbf3c2d3e5188ce7c42c139e6a75184c8581b95de61ef0e0b1078a0a5

SHA512
d982236b5aeb6ca18b79fe1c6d67c53de5295a6ba4e1552ffe74086efee44f70c8a8841fb8d52ba4b1881b465f49bc41c3e1905827c78a35278064cc921b902b

Download Submit
memory/332-126-0x0000000000000000-mapping.dmp

Download
memory/836-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/980-121-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/980-98-0x0000000000000000-mapping.dmp

Download
memory/980-123-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/980-145-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1384-72-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1728-120-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-115-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1728-66-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-58-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-60-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-61-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-90-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1728-87-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-69-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1728-62-0x0000000000455C60-mapping.dmp

Download
memory/1728-67-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-64-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1728-57-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-65-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1728-78-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1740-92-0x0000000000000000-mapping.dmp

Download
memory/1816-142-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1816-144-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1816-136-0x0000000000455C60-mapping.dmp

Download
memory/1988-143-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1988-109-0x0000000000455C60-mapping.dmp

Download
memory/1988-122-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2040-75-0x0000000000000000-mapping.dmp

Download
memory/2040-83-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2040-77-0x00000000752C1000-0x00000000752C3000-memory.dmp

Filesize
8KB

Download
memory/2040-86-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download