cybergate | f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

General

Target

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Size

436KB
MD5

bda41ce03fdaa442a73c686aeeb344d9
SHA1

1c829e5e4ec2b077474fafa6ebe7f7bec85a076c
SHA256

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab
SHA512

bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb
SSDEEP

12288:UEdNxCI9xJ2NL1Oy9R6b8YcTT3zGBQl0VMD:UOSN8ORAQzqLVMD

Score

10^/10

cybergate web bootkit persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0

Botnet

Web

C2

cybergatehost1337.no-ip.biz:1222

Mutex

16111Q2O3WMP68

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
.//public_html/logs
ftp_interval
5
injected_process
explorer.exe
install_dir
install
install_file
adobefll.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
hackmeDON

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobefl\\install\\adobefll.exe"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobefl\\install\\adobefll.exe"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Executes dropped EXE 3 IoCs

Processes:

adobefll.exeadobefll.exeadobefll.exe

pid process

604 adobefll.exe
1680 adobefll.exe
972 adobefll.exe

pid	process
604	adobefll.exe
1680	adobefll.exe
972	adobefll.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}\StubPath = "c:\\adobefl\\install\\adobefll.exe Restart"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}\StubPath = "c:\\adobefl\\install\\adobefll.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2000-83-0x0000000010410000-0x0000000010482000-memory.dmp	upx
behavioral1/memory/2000-92-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/928-97-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/928-100-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral1/memory/2000-102-0x0000000010510000-0x0000000010582000-memory.dmp	upx
behavioral1/memory/2000-108-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/1660-113-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/1660-114-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral1/memory/1660-152-0x0000000010590000-0x0000000010602000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid	process
2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
File opened for modification	\??\PhysicalDrive0	adobefll.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exeadobefll.exe

description	pid	process	target process
PID 2020 set thread context of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 set thread context of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 604 set thread context of 1680	604	adobefll.exe	adobefll.exe
PID 1680 set thread context of 972	1680	adobefll.exe	adobefll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid process

1660 f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid	process
1660	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	pid	process
Token: SeBackupPrivilege	928	explorer.exe
Token: SeRestorePrivilege	928	explorer.exe
Token: SeBackupPrivilege	1660	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeRestorePrivilege	1660	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeDebugPrivilege	1660	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeDebugPrivilege	1660	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid process

2000 f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exeadobefll.exe

pid	process
2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
604	adobefll.exe
1680	adobefll.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	pid	process	target process
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2020 wrote to memory of 1400	2020	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 1400 wrote to memory of 2000	1400	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 2000 wrote to memory of 1412	2000	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
5⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:604

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1680

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
7⤵
- Executes dropped EXE
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
236KB

MD5
94b10211102ce6578d3f4d07454fc9a1

SHA1
a7514351a36e9d53405f79c8ed343693566ee090

SHA256
31c8e1178fc88940a21bf29d1e1d3bfa16fc58a49a739262c32dc7d7947bc988

SHA512
f042fca00b9ab0d7eb36ac9d4a327438db2127d07c8cbea4092803644da896dea4959780cb33bff26fffdca08667f89863d4e923d639d237f34de37d27ab712a

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
\??\c:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
memory/604-118-0x0000000000000000-mapping.dmp

Download
memory/928-91-0x0000000074A01000-0x0000000074A03000-memory.dmp

Filesize
8KB

Download
memory/928-89-0x0000000000000000-mapping.dmp

Download
memory/928-100-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/928-97-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/928-90-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/972-151-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/972-150-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/972-145-0x000000000040A0C4-mapping.dmp

Download
memory/1400-63-0x0000000000401844-mapping.dmp

Download
memory/1400-59-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1400-57-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1400-80-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1400-62-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1400-56-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1412-86-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/1660-113-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/1660-106-0x0000000000000000-mapping.dmp

Download
memory/1660-152-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/1660-114-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/1680-130-0x0000000000401844-mapping.dmp

Download
memory/1680-149-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2000-73-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-71-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-122-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-72-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-79-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-68-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-92-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/2000-78-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-81-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-108-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/2000-102-0x0000000010510000-0x0000000010582000-memory.dmp

Filesize
456KB

Download
memory/2000-83-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/2000-76-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-77-0x000000000040A0C4-mapping.dmp

Download
memory/2000-67-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-70-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2000-74-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads