cybergate | f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

General

Target

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Size

436KB
MD5

bda41ce03fdaa442a73c686aeeb344d9
SHA1

1c829e5e4ec2b077474fafa6ebe7f7bec85a076c
SHA256

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab
SHA512

bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb
SSDEEP

12288:UEdNxCI9xJ2NL1Oy9R6b8YcTT3zGBQl0VMD:UOSN8ORAQzqLVMD

Score

10^/10

cybergate web bootkit persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0

Botnet

Web

C2

cybergatehost1337.no-ip.biz:1222

Mutex

16111Q2O3WMP68

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
.//public_html/logs
ftp_interval
5
injected_process
explorer.exe
install_dir
install
install_file
adobefll.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
hackmeDON

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobefl\\install\\adobefll.exe"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\adobefl\\install\\adobefll.exe"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Executes dropped EXE 3 IoCs

Processes:

adobefll.exeadobefll.exeadobefll.exe

pid process

3960 adobefll.exe
3820 adobefll.exe
3376 adobefll.exe

pid	process
3960	adobefll.exe
3820	adobefll.exe
3376	adobefll.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}\StubPath = "c:\\adobefl\\install\\adobefll.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}\StubPath = "c:\\adobefl\\install\\adobefll.exe Restart"	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{35P7TOCE-472I-5453-4HT4-M54B181D2I07}	explorer.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4984-146-0x0000000010410000-0x0000000010482000-memory.dmp	upx
behavioral2/memory/4984-151-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral2/memory/4908-154-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral2/memory/4908-157-0x0000000010490000-0x0000000010502000-memory.dmp	upx
behavioral2/memory/4984-159-0x0000000010510000-0x0000000010582000-memory.dmp	upx
behavioral2/memory/4984-164-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral2/memory/1432-167-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral2/memory/1432-168-0x0000000010590000-0x0000000010602000-memory.dmp	upx
behavioral2/memory/1432-188-0x0000000010590000-0x0000000010602000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
File opened for modification	\??\PhysicalDrive0	adobefll.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exeadobefll.exe

description	pid	process	target process
PID 4528 set thread context of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 set thread context of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 3960 set thread context of 3820	3960	adobefll.exe	adobefll.exe
PID 3820 set thread context of 3376	3820	adobefll.exe	adobefll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid process

1432 f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid	process
1432	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

explorer.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	pid	process
Token: SeBackupPrivilege	4908	explorer.exe
Token: SeRestorePrivilege	4908	explorer.exe
Token: SeBackupPrivilege	1432	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeRestorePrivilege	1432	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeDebugPrivilege	1432	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
Token: SeDebugPrivilege	1432	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid process

4984 f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

pid	process
4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exeadobefll.exeadobefll.exe

pid	process
4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
3960	adobefll.exe
3820	adobefll.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exef58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe

description	pid	process	target process
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4528 wrote to memory of 4416	4528	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4416 wrote to memory of 4984	4416	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE
PID 4984 wrote to memory of 740	4984	f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe
"C:\Users\Admin\AppData\Local\Temp\f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab.exe"
5⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3960

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3820

C:\adobefl\install\adobefll.exe
"C:\adobefl\install\adobefll.exe"
7⤵
- Executes dropped EXE
PID:3376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Filesize
236KB

MD5
94b10211102ce6578d3f4d07454fc9a1

SHA1
a7514351a36e9d53405f79c8ed343693566ee090

SHA256
31c8e1178fc88940a21bf29d1e1d3bfa16fc58a49a739262c32dc7d7947bc988

SHA512
f042fca00b9ab0d7eb36ac9d4a327438db2127d07c8cbea4092803644da896dea4959780cb33bff26fffdca08667f89863d4e923d639d237f34de37d27ab712a

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
C:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
\??\c:\adobefl\install\adobefll.exe
Filesize
436KB

MD5
bda41ce03fdaa442a73c686aeeb344d9

SHA1
1c829e5e4ec2b077474fafa6ebe7f7bec85a076c

SHA256
f58cd667cad8837496500b06cd0ba00f8b33d64bd14a6fdfe8fd3dc7d2ad5cab

SHA512
bc1fe351b98092880e0ef98ad683062eb3bc8f4562c989c97f61be669af558e14f8a3a64be68d2803f002de7f1910563b92190f53aba9bbd9006c50c707f30cb

Download Submit
memory/1432-168-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/1432-188-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/1432-163-0x0000000000000000-mapping.dmp

Download
memory/1432-167-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/3376-186-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3376-180-0x0000000000000000-mapping.dmp

Download
memory/3376-187-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3820-174-0x0000000000000000-mapping.dmp

Download
memory/3820-185-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3960-169-0x0000000000000000-mapping.dmp

Download
memory/4416-143-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4416-134-0x0000000000000000-mapping.dmp

Download
memory/4416-135-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4908-157-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/4908-154-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/4908-150-0x0000000000000000-mapping.dmp

Download
memory/4984-164-0x0000000010590000-0x0000000010602000-memory.dmp

Filesize
456KB

Download
memory/4984-159-0x0000000010510000-0x0000000010582000-memory.dmp

Filesize
456KB

Download
memory/4984-171-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4984-151-0x0000000010490000-0x0000000010502000-memory.dmp

Filesize
456KB

Download
memory/4984-146-0x0000000010410000-0x0000000010482000-memory.dmp

Filesize
456KB

Download
memory/4984-144-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4984-142-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4984-141-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4984-140-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4984-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads