cybergate | d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

Analysis

max time kernel
152s
max time network
127s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Size

413KB
MD5

9464ce6e3afa690fcc7ed1f6a6e1b3e1
SHA1

017d3429ae0954332576edb1f1903b8cb795dc28
SHA256

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34
SHA512

6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5
SSDEEP

12288:+iSC/HRo+iLb0Be5Wqp7ssBlRwWW6o6da:piJJ7zBlRwSo6d

Score

10^/10

cybergate system persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

system

javanetwork.servehttp.com:4711

Mutex

8O0F8C456M4VOS

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
system
install_file
updates.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
123456
regkey_hklm
dsaggdsdgs

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\WINDOWS\\system\\system\\updates.exe"	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\WINDOWS\\system\\system\\updates.exe"	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

Executes dropped EXE 2 IoCs

Processes:

updates.exeupdates.exe

pid process

364 updates.exe
432 updates.exe

pid	process
364	updates.exe
432	updates.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DJ3AI8O-E7UA-37Y1-3JPG-5Q446AB72KUR}	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DJ3AI8O-E7UA-37Y1-3JPG-5Q446AB72KUR}\StubPath = "C:\\WINDOWS\\system\\system\\updates.exe Restart"	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DJ3AI8O-E7UA-37Y1-3JPG-5Q446AB72KUR}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4DJ3AI8O-E7UA-37Y1-3JPG-5Q446AB72KUR}\StubPath = "C:\\WINDOWS\\system\\system\\updates.exe"	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1108-97-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral1/memory/1108-107-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1612-112-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1612-115-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral1/memory/1108-117-0x00000000104F0000-0x0000000010555000-memory.dmp	upx
behavioral1/memory/1108-123-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1652-129-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1652-137-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral1/memory/1652-153-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exeupdates.exe

pid process

1652 d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
364 updates.exe
364 updates.exe
364 updates.exe
364 updates.exe

pid	process
1652	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
364	updates.exe
364	updates.exe
364	updates.exe
364	updates.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dsaggdsdgs = "C:\\WINDOWS\\system\\system\\updates.exe"	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exeupdates.exe

description	pid	process	target process
PID 968 set thread context of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 364 set thread context of 432	364	updates.exe	updates.exe

Drops file in Windows directory 4 IoCs

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exed95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

description	ioc	process
File created	C:\WINDOWS\system\system\updates.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
File opened for modification	C:\WINDOWS\system\system\updates.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
File opened for modification	C:\WINDOWS\system\system\updates.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
File opened for modification	C:\WINDOWS\system\system\	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exed95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

description	pid	process
Token: SeBackupPrivilege	1612	explorer.exe
Token: SeRestorePrivilege	1612	explorer.exe
Token: SeBackupPrivilege	1652	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Token: SeRestorePrivilege	1652	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Token: SeDebugPrivilege	1652	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
Token: SeDebugPrivilege	1652	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

pid process

1108 d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

pid	process
1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exed95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe

description	pid	process	target process
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 968 wrote to memory of 1108	968	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE
PID 1108 wrote to memory of 1232	1108	d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
"C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
"C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe"
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe
"C:\Users\Admin\AppData\Local\Temp\d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34.exe"
4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\WINDOWS\system\system\updates.exe
"C:\WINDOWS\system\system\updates.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:364

C:\WINDOWS\system\system\updates.exe
"C:\WINDOWS\system\system\updates.exe"
6⤵
- Executes dropped EXE
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
224KB

MD5
2c60d3649adb0c92af14f77b8fb27c74

SHA1
6a84fb06421dad2e67d6e44c80f4b5d7c64773ab

SHA256
971d8f052cf62ac424eaf730ab6f6e4a395486bc7c414995c8a13042765c1cc8

SHA512
5dfd10095295129ce07a1edd800a7ef32bb71243a57f2f8ff77ce1eb54fdb3538b6483753afc253299f797bc64523c771da4802ae5931ad20c257fbdf0e9eac3

Download Submit
C:\WINDOWS\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
C:\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
C:\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
\Windows\system\system\updates.exe
Filesize
413KB

MD5
9464ce6e3afa690fcc7ed1f6a6e1b3e1

SHA1
017d3429ae0954332576edb1f1903b8cb795dc28

SHA256
d95d0d1f89781035e62d927c93e75fc8564c9ffc1ef72d954c58d9f5f25dbf34

SHA512
6fc13df02870a620babba0aaf1ea1397c190b69da3b3b32edac1ee06ea3fae5e12cec9fdb8c7e603a2f298ba742d9c9cd8500fdf4584385f3512a02918f061d5

Download Submit
memory/364-142-0x00000000734D0000-0x0000000073A7B000-memory.dmp

Filesize
5.7MB

Download
memory/364-131-0x0000000000000000-mapping.dmp

Download
memory/364-152-0x00000000734D0000-0x0000000073A7B000-memory.dmp

Filesize
5.7MB

Download
memory/432-150-0x000000000040E1A8-mapping.dmp

Download
memory/968-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/968-68-0x0000000074450000-0x00000000749FB000-memory.dmp

Filesize
5.7MB

Download
memory/968-55-0x0000000074450000-0x00000000749FB000-memory.dmp

Filesize
5.7MB

Download
memory/1108-95-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-72-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-80-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-82-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-84-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-86-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-88-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-90-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-92-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-94-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-76-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-97-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1108-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-102-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-57-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-59-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-107-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1108-60-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-74-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-78-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-61-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-117-0x00000000104F0000-0x0000000010555000-memory.dmp

Filesize
404KB

Download
memory/1108-62-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-123-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1108-63-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-128-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-70-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-67-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-65-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1108-66-0x000000000040E1A8-mapping.dmp

Download
memory/1232-100-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/1612-115-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1612-112-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/1612-106-0x00000000748B1000-0x00000000748B3000-memory.dmp

Filesize
8KB

Download
memory/1612-104-0x0000000000000000-mapping.dmp

Download
memory/1652-129-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1652-121-0x0000000000000000-mapping.dmp

Download
memory/1652-137-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/1652-153-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download