cybergate | 273241597816c2dc3059a604fb92b0fa9f3ad5cd51f40409a774c11478d91d25

Modify Registry

Processes:

d909deddb7415e62af178501e474ac53.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d909deddb7415e62af178501e474ac53.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	d909deddb7415e62af178501e474ac53.exe
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d909deddb7415e62af178501e474ac53.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	d909deddb7415e62af178501e474ac53.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

d909deddb7415e62af178501e474ac53.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	d909deddb7415e62af178501e474ac53.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\install\\server.exe Restart"	d909deddb7415e62af178501e474ac53.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3592-9-0x0000000024010000-0x000000002406F000-memory.dmp	upx
behavioral2/memory/3592-69-0x0000000024070000-0x00000000240CF000-memory.dmp	upx
behavioral2/memory/756-74-0x0000000024070000-0x00000000240CF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

d909deddb7415e62af178501e474ac53.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe"	d909deddb7415e62af178501e474ac53.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe"	d909deddb7415e62af178501e474ac53.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exe

description pid process target process

PID 4324 set thread context of 3592 4324 d909deddb7415e62af178501e474ac53.exe d909deddb7415e62af178501e474ac53.exe

description	pid	process	target process
PID 4324 set thread context of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe

Drops file in Windows directory 2 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exe

description	ioc	process
File created	C:\Windows\install\server.exe	d909deddb7415e62af178501e474ac53.exe
File opened for modification	C:\Windows\install\server.exe	d909deddb7415e62af178501e474ac53.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exe

pid process

3592 d909deddb7415e62af178501e474ac53.exe
3592 d909deddb7415e62af178501e474ac53.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exe

pid process

3592 d909deddb7415e62af178501e474ac53.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exe

pid process

4324 d909deddb7415e62af178501e474ac53.exe

pid	process
3592	d909deddb7415e62af178501e474ac53.exe
3592	d909deddb7415e62af178501e474ac53.exe

pid	process
3592	d909deddb7415e62af178501e474ac53.exe

pid	process
4324	d909deddb7415e62af178501e474ac53.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d909deddb7415e62af178501e474ac53.exed909deddb7415e62af178501e474ac53.exe

description	pid	process	target process
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 4324 wrote to memory of 3592	4324	d909deddb7415e62af178501e474ac53.exe	d909deddb7415e62af178501e474ac53.exe
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE
PID 3592 wrote to memory of 3420	3592	d909deddb7415e62af178501e474ac53.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe
"C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324

C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe
C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\explorer.exe
explorer.exe
4⤵
PID:756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe
"C:\Users\Admin\AppData\Local\Temp\d909deddb7415e62af178501e474ac53.exe"
4⤵
PID:4048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry